spysheriff | 4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f

Resubmissions

14/09/2026, 16:24

260914-twb6jstdnd10

18/08/2026, 08:18

260818-j7jdwsgb9410

Analysis

user interaction
yes
max time kernel
18s
max time network
16s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/09/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpySheriff.exe
Size 48KB
Sample260914-twb6jstdnd
SHA256 4f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f
MD5 ab3e43a60f47a98962d50f2da0507df7
SHA1 4177228a54c15ac42855e87854d4cd9a1722fe39
SHA512 9e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f
SSDEEP 768:18Gch4aqHnKckG0HrloMOInk3RicH0wDrF5X9gFEvkk3p:1hN/k/ZomkhewDR5NVvkk3p
TLSH
T147237C0B7A848412C8758531C5A29B17973B7E625E148E0B6784BF4F7F322C3AE7635B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery spysheriff

Malware Config

Signatures

Family: SpySheriff
SpySheriff is a Windows adware written in C++.
adware spysheriff

Detects SpySheriff adware 2 IoCs

resource	yara_rule
behavioral2/memory/4860-0-0x0000000000400000-0x000000000040E000-memory.dmp	family_adware_spysheriff
behavioral2/memory/4860-1-0x0000000000400000-0x000000000040E000-memory.dmp	family_adware_spysheriff

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5016	4860	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SpySheriff.exe

C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe
"C:\Users\Admin\AppData\Local\Temp\SpySheriff.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 804
  2⤵
  - Program crash
  PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4860 -ip 4860
1⤵
PID:2840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4860-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/4860-1-0x0000000000400000-0x000000000040E000-memory.dmp