Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 15:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
spoof.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
spoof.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
spoof.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target spoof.exe
- Size 5.3MB
- Sample260815-srv77ayfrc
- SHA256 6ffe4b8060d232eb4a5a62dd9c3719e987a9863153cc460ad919c98d2458c058
- MD5 22b8912acaaae9a44748678b095c5867
- SHA1 a043a11313a3af156815765ba0d631c407f7f1a6
- SHA512 e17b4b0d52d9201d697d42aacd130d3a89d091b02f786f569493d308149f7b894186d9c7297baa5f46b9ef28ec7a0e2963f29c50c6a194403bf25fe19b8115a7
- SSDEEP 98304:YkrRlwLisY4jnIfFDfrmbzRBmPdc+cTna4NpAV8O5Hm+PIjrKQ2VS+XWkIX/2gbH:TrRK3Y8IdfrmbzXi8lOZA/BkmkKegD
- TLSH T1DC4633DA36C726FDE045CBB49501247D71D47FCA45A0CD492F89E922AC67B2EAF3A304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools spoof.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion spoof.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion spoof.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum spoof.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum spoof.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN spoof.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 spoof.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID spoof.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 spoof.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID spoof.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS spoof.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer spoof.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName spoof.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor spoof.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe 2640 spoof.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2640 spoof.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2640 spoof.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\spoof.exe"C:\Users\Admin\AppData\Local\Temp\spoof.exe"1⤵
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2640