Overview
overview
8Static
static
3spoofer.7z
windows10-2004-x64
1spoofer.7z
windows11-ltsc_2024-x64
1bin/Debug/...IN.exe
windows10-2004-x64
3bin/Debug/...IN.exe
windows11-ltsc_2024-x64
3bin/Debug/...s_2.7z
windows10-2004-x64
1bin/Debug/...s_2.7z
windows11-ltsc_2024-x64
1bin/Debug/...nt.dll
windows10-2004-x64
3bin/Debug/...nt.dll
windows11-ltsc_2024-x64
3bin/Debug/...s.json
windows10-2004-x64
3bin/Debug/...s.json
windows11-ltsc_2024-x64
3bin/Debug/...er.exe
windows10-2004-x64
1bin/Debug/...er.exe
windows11-ltsc_2024-x64
1bin/Debug/...er.exe
windows10-2004-x64
8bin/Debug/...er.exe
windows11-ltsc_2024-x64
8bin/Debug/...er.pdb
windows10-2004-x64
3bin/Debug/...er.pdb
windows11-ltsc_2024-x64
3bin/Debug/...g.json
windows10-2004-x64
3bin/Debug/...g.json
windows11-ltsc_2024-x64
3make_icon.ps1
windows10-2004-x64
3make_icon.ps1
windows11-ltsc_2024-x64
3obj/Debug/...tes.cs
windows10-2004-x64
3obj/Debug/...tes.cs
windows11-ltsc_2024-x64
3obj/Debug/...st.exe
windows10-2004-x64
1obj/Debug/...st.exe
windows11-ltsc_2024-x64
1obj/Debug/...er.exe
windows10-2004-x64
1obj/Debug/...er.exe
windows11-ltsc_2024-x64
1obj/Debug/...er.exe
windows10-2004-x64
1obj/Debug/...er.exe
windows11-ltsc_2024-x64
1obj/Debug/...nfo.cs
windows10-2004-x64
3obj/Debug/...nfo.cs
windows11-ltsc_2024-x64
3obj/Debug/....cache
windows10-2004-x64
3obj/Debug/....cache
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
spoofer.7z
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
spoofer.7z
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
bin/Debug/net10.0-windows/AMIDEWIN.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
bin/Debug/net10.0-windows/AMIDEWIN.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
bin/Debug/net10.0-windows/net10.0-windows_2.7z
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
bin/Debug/net10.0-windows/net10.0-windows_2.7z
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
bin/Debug/net10.0-windows/runtimes/win/lib/net10.0/System.Management.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
bin/Debug/net10.0-windows/runtimes/win/lib/net10.0/System.Management.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
bin/Debug/net10.0-windows/spoofer.deps.json
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
bin/Debug/net10.0-windows/spoofer.deps.json
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral11
Sample
bin/Debug/net10.0-windows/spoofer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
bin/Debug/net10.0-windows/spoofer.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
bin/Debug/net10.0-windows/spoofer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
bin/Debug/net10.0-windows/spoofer.exe
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral15
Sample
bin/Debug/net10.0-windows/spoofer.pdb
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
bin/Debug/net10.0-windows/spoofer.pdb
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
bin/Debug/net10.0-windows/spoofer.runtimeconfig.json
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
bin/Debug/net10.0-windows/spoofer.runtimeconfig.json
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral19
Sample
make_icon.ps1
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
make_icon.ps1
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
obj/Debug/net10.0-windows/.NETCoreApp,Version=v10.0.AssemblyAttributes.cs
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
obj/Debug/net10.0-windows/.NETCoreApp,Version=v10.0.AssemblyAttributes.cs
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
obj/Debug/net10.0-windows/apphost.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
obj/Debug/net10.0-windows/apphost.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
obj/Debug/net10.0-windows/ref/spoofer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
obj/Debug/net10.0-windows/ref/spoofer.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
obj/Debug/net10.0-windows/refint/spoofer.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
obj/Debug/net10.0-windows/refint/spoofer.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
obj/Debug/net10.0-windows/spoofer.AssemblyInfo.cs
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
obj/Debug/net10.0-windows/spoofer.AssemblyInfo.cs
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
obj/Debug/net10.0-windows/spoofer.AssemblyInfoInputs.cache
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
obj/Debug/net10.0-windows/spoofer.AssemblyInfoInputs.cache
Resource
win11ltsc2024-20260709-en
General
- Target spoofer.7z
- Size 716KB
- Sample260729-eafjhsv1bv
- SHA256 693ee39a219641de6bd6d5c2074da057ce938e0b4c37dfba29d66af187971f3c
- MD5 11f3fe1a16d72c441965f836db3be5e9
- SHA1 c778f88c5ebf777d30efcaad6686afd95a7f1d48
- SHA512 30178ece8805df527117820e74c0f42e99dc70c44253656de854e77bbdd0d71f9a0426807d67881228f3637a4df8dfbf5e26b980aa7b2855e7f361dd7de6062b
- SSDEEP 12288:LDzMbHGPnKlMirOwpA5X1hEb264ZPG0H8PnK3MJrOgpz5X1hEjZ:fEHnrOwpi1eVM/KrOgpl1ejZ
- TLSH T143F423974E138FCDA79D043583A97A61E60EF73EF64F3F41F0152A81190C0A99991FB9
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 7zFM.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3308 7zFM.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3308 7zFM.exe Token: 35 3308 7zFM.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3308 7zFM.exe