bcb1db78d0562ea1c33f57dfa254d09877df0e2c12dc4038905df02144761aa8

Analysis

max time kernel
133s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/09/2026, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FluxusZ Spoofer 1.0.1_29994555.exe
Size 695KB
Sample260913-nywebawfma
SHA256 bcb1db78d0562ea1c33f57dfa254d09877df0e2c12dc4038905df02144761aa8
MD5 f067b449ff414f0b6897bf29b004d9c9
SHA1 ae3de32992652d13cb2da554e52d520037766710
SHA512 269aea73db9c98e6217425c7c1049fe3405befe42c1720b737a007451462a7bfc06c126674afe0565c2a95c390a8c1639ee03a5cc32d4c2d45e4fd9b79e19c5e
SSDEEP 12288:f2Zgkw/BOOEAeeQrshOyqow07DLWYDbCq:OZp2BOO7YrshmT0xuq
TLSH
T185E48D16B66801FCE1B7D179C9924913F7B1B84B437197CF03A04AA6AF2B6E05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	FluxusZ Spoofer 1.0.1_29994555.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	FluxusZ Spoofer 1.0.1_29994555.exe

Opens file in notepad (likely ransom note) 13 IoCs

ransomware

pid	Process
2512	NOTEPAD.EXE
4536	NOTEPAD.EXE
1364	NOTEPAD.EXE
5828	NOTEPAD.EXE
5320	NOTEPAD.EXE
4840	NOTEPAD.EXE
2624	NOTEPAD.EXE
4288	NOTEPAD.EXE
1828	NOTEPAD.EXE
1460	NOTEPAD.EXE
4912	NOTEPAD.EXE
1920	NOTEPAD.EXE
6056	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1364	764	FluxusZ Spoofer 1.0.1_29994555.exe	93
PID 764 wrote to memory of 1460	764	FluxusZ Spoofer 1.0.1_29994555.exe	94
PID 764 wrote to memory of 5828	764	FluxusZ Spoofer 1.0.1_29994555.exe	95
PID 764 wrote to memory of 4912	764	FluxusZ Spoofer 1.0.1_29994555.exe	96
PID 764 wrote to memory of 1920	764	FluxusZ Spoofer 1.0.1_29994555.exe	97
PID 764 wrote to memory of 6056	764	FluxusZ Spoofer 1.0.1_29994555.exe	98
PID 764 wrote to memory of 5320	764	FluxusZ Spoofer 1.0.1_29994555.exe	99
PID 764 wrote to memory of 4840	764	FluxusZ Spoofer 1.0.1_29994555.exe	100
PID 764 wrote to memory of 2512	764	FluxusZ Spoofer 1.0.1_29994555.exe	101
PID 764 wrote to memory of 2624	764	FluxusZ Spoofer 1.0.1_29994555.exe	104
PID 764 wrote to memory of 4288	764	FluxusZ Spoofer 1.0.1_29994555.exe	105

C:\Users\Admin\AppData\Local\Temp\FluxusZ Spoofer 1.0.1_29994555.exe
"C:\Users\Admin\AppData\Local\Temp\FluxusZ Spoofer 1.0.1_29994555.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1364
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1460
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5828
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4912
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1920
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6056
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5320
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4840
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2512
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2624
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4288
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4536
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\file.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

file.txt

Path C:\Users\Admin\AppData\Local\file.txt
Size 58B
SHA256 3e2960dc2abf6bd623778c0f338011bee4a813b4015ae997f5fd5ee7ff224491
MD5 cfa1db797bece1bd7832909e925465c5
SHA1 a608130e45f70898923d195f7fdedd39f9a07a0b
SHA512 1d2ffee40c1f688f9a15306afd19aaebdd475bd698ea8e47f9db5e1024cfab05f01d9699b3a724d47706ae2a3afb11fa87257cbbe4689e31434fa63fde669de9
TLSH
T10AA0025894D7275D685A87CD3AA459962014056321BDD259CE369642484670251A254A
MD5 SHA1 SHA512 TLSH

Submit Download