Analysis
- max time kernel
150s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 21:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
VMAX_spoof_cracked.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
VMAX_spoof_cracked.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target VMAX_spoof_cracked.exe
- Size 5.4MB
- Sample260812-1afeeavenc
- SHA256 015c5c5ed6f6e1ee63603d50da8f62b787df148500b5743796d8df2dd2e5c900
- MD5 7326bab6a827ebc624f0aac403ef52e8
- SHA1 9dd43d22590d8aca9defe763c2545d4d894ec5f6
- SHA512 708ee94940b2d7157d39ce04017d9e94804578f8ed61553394088753ba28f2b47404a47f83895eb25b16a86ea2802c5614b74236401aee187ec8569ac460e088
- SSDEEP 98304:vFXvxYGLeo2GBwpa5u/ot9du0nzwWbPiE3G50KvfioaBOfdPW:pxYGLeo2GBwsg2du0zwWbPi6S3ioaUfc
- TLSH T15846E002A3640598D2A39238C566D733E6753C445365C6CB17F0BEA37F636E22E7A7C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes dropped EXE 6 IoCs
pid Process 5048 vmax_spoof_cracked.exe 1212 icsys.icn.exe 2768 explorer.exe 5140 spoolsv.exe 4232 svchost.exe 4780 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\Resources\Themes\icsys.icn.exe VMAX_spoof_cracked.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe icsys.icn.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VMAX_spoof_cracked.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icsys.icn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 1212 icsys.icn.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2768 explorer.exe 4232 svchost.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 4980 VMAX_spoof_cracked.exe 4980 VMAX_spoof_cracked.exe 1212 icsys.icn.exe 1212 icsys.icn.exe 2768 explorer.exe 2768 explorer.exe 5140 spoolsv.exe 5140 spoolsv.exe 4232 svchost.exe 4232 svchost.exe 4780 spoolsv.exe 4780 spoolsv.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4980 wrote to memory of 5048 4980 VMAX_spoof_cracked.exe 89 PID 4980 wrote to memory of 1212 4980 VMAX_spoof_cracked.exe 90 PID 1212 wrote to memory of 2768 1212 icsys.icn.exe 91 PID 2768 wrote to memory of 5140 2768 explorer.exe 92 PID 5140 wrote to memory of 4232 5140 spoolsv.exe 93 PID 4232 wrote to memory of 4780 4232 svchost.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\VMAX_spoof_cracked.exe"C:\Users\Admin\AppData\Local\Temp\VMAX_spoof_cracked.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\users\admin\appdata\local\temp\vmax_spoof_cracked.exec:\users\admin\appdata\local\temp\vmax_spoof_cracked.exe2⤵
- Executes dropped EXE
PID:5048
-
-
C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe3⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5140 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe5⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4780
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\vmax_spoof_cracked.exe
- Size 5.3MB
- SHA256 25b85ae3c8e64eed2c7f18ee6740d9938f543133d171fb93a762e33bdc8d0ddf
- MD5 74c9567c3f29b4295fa2198e17b4d9ea
- SHA1 e7eaef1d6e981fe71bab43249bbeb6f0ac0043af
- SHA512 6e0b28597d8773e91b630549e39ba2ba12b4c8d18a79a82b6e43d4c3e5fd5a0fbb2de7ce2e70268d444cfa3c04824bb919c465aa08bbf9df47c2b400ce88771b
- SSDEEP 98304:GFXvxYGLeo2GBwpa5u/ot9du0nzwWbPiE3G50KvfioaBOfdP:kxYGLeo2GBwsg2du0zwWbPi6S3ioaUf5
- TLSH T12B46F10673A40598D2A39238C552D733E6753C449365C2CB17F0AEA3BF636E26E7A7C1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 ce4c7ddbce4dfe5ee69d5df72c797e3a2ba3880439c44196ef37c54e33c30db5
- MD5 245185c344afa75fcc75755b1cdfe7e4
- SHA1 d65293692837e73b9c9c3e91dd6b439baa51afea
- SHA512 a281349a20fa4a468fd50eb2b0ab5ec0d458eee5410932593d69d0a5974de5de2d5f73ae19676ae1008cab6df494b1b13678e59edc28476786e7fee1ae87da83
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVu9GlK:UVqoCl/YgjxEufVU0TbTyDDalUiK
- TLSH T1D8D31823BE60506EE92285F158A5D66EB9216E3A1FF4BD477353BB01277220375F022F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\Themes\icsys.icn.exe
- Size 135KB
- SHA256 c08e83aad669858b5f63174abecda9fe7e20d61a555c251d4774ab7280893ca2
- MD5 f744da94312d30d1144c26574d36dd57
- SHA1 be23c4d2cb699165e0e06179791e180ca63d8b41
- SHA512 ccd40370faff6393cc55f7f97a97729ace72cea235f5dc9094c672b72b9ca07e2c8cc4ee1220a96e3f0b93d06bbfb4677f50ded8e43ceedd3a738b0b6421ee4d
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVu9Gls:UVqoCl/YgjxEufVU0TbTyDDalUis
- TLSH T16FD3F823AF14282BD962C6F028E9E679B9110F361F95BD07765AFB02267710776F120F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\resources\spoolsv.exe
- Size 135KB
- SHA256 40ffada07e7a669cbecdc164c843ff0039f1a5c3bbd2486740d88235f9c4374b
- MD5 7c79aed56f32c4fa188780fa1ec92690
- SHA1 bafd67d05d116d363dca2fe2c508092cb99a2049
- SHA512 8886ce65f7e03af7c594b5e57dae89905d052133d07ba6cee907c12d17e14479fbb0d98f877828a5276ecd1264d2c2738696da63f087e0bb9dd8928ac9f8725d
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVu9GlI:UVqoCl/YgjxEufVU0TbTyDDalUiI
- TLSH T1FCD31B23BE20A42EDC118AF698BDD6697A225F751BF06D4377A6E70035B610376F120F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\windows\resources\svchost.exe
- Size 135KB
- SHA256 4353c80df90cdc2b7db013f0af792754e176060f2c77022997c68f73d3b8d2da
- MD5 93371d0a0828b0561df3b76ad474ca8a
- SHA1 c21cd1adb5e83b18797c2ceb1aa8e091401b9f30
- SHA512 43f5eb02cd2656f2711c12a887c0912149be89b2fa3ff040bd11a9f2f61a8f2044f6e56ef4dbc87c86085e18ebe636ebb2de4f1ca1cc0ea31d22385ef3b260a4
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVu9Glh:UVqoCl/YgjxEufVU0TbTyDDalUih
- TLSH T15CD3D7237E10902FD86186F168B5EA9E76166F3A1BE0AD037366BF0029B614775F431F
- MD5 SHA1 SHA512 SSDEEP TLSH