Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-de - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows - submitted
25/08/2026, 16:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ICE Temp Spoofer.exe
Resource
win10v2004-20260513-de
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ICE Temp Spoofer.exe
Resource
win11ltsc2024-20260709-de
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target ICE Temp Spoofer.exe
- Size 5.3MB
- Sample260825-t384vscl61
- SHA256 6ffe4b8060d232eb4a5a62dd9c3719e987a9863153cc460ad919c98d2458c058
- MD5 22b8912acaaae9a44748678b095c5867
- SHA1 a043a11313a3af156815765ba0d631c407f7f1a6
- SHA512 e17b4b0d52d9201d697d42aacd130d3a89d091b02f786f569493d308149f7b894186d9c7297baa5f46b9ef28ec7a0e2963f29c50c6a194403bf25fe19b8115a7
- SSDEEP 98304:YkrRlwLisY4jnIfFDfrmbzRBmPdc+cTna4NpAV8O5Hm+PIjrKQ2VS+XWkIX/2gbH:TrRK3Y8IdfrmbzXi8lOZA/BkmkKegD
- TLSH T1DC4633DA36C726FDE045CBB49501247D71D47FCA45A0CD492F89E922AC67B2EAF3A304
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools ICE Temp Spoofer.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ICE Temp Spoofer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ICE Temp Spoofer.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum ICE Temp Spoofer.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum ICE Temp Spoofer.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN ICE Temp Spoofer.exe - Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID ICE Temp Spoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 ICE Temp Spoofer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID ICE Temp Spoofer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 ICE Temp Spoofer.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor ICE Temp Spoofer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS ICE Temp Spoofer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer ICE Temp Spoofer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName ICE Temp Spoofer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe 6116 ICE Temp Spoofer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6116 ICE Temp Spoofer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 6116 ICE Temp Spoofer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ICE Temp Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\ICE Temp Spoofer.exe"1⤵
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks for VirtualBox DLLs, possible anti-VM trick
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1512