096f36981c1424d9e815be4fef0b11c1ad9b32bec9ad0e94b91c749d42e89905

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spooferrr.exe
Size 821KB
Sample260916-xd1b7sthph
SHA256 096f36981c1424d9e815be4fef0b11c1ad9b32bec9ad0e94b91c749d42e89905
MD5 944312c509c41a68f28fec3133b0e2f3
SHA1 05686f33da9797159681e629848d94d1cb4e3692
SHA512 5c4dfff43ba087a0e56a08d279fa0abd9908d7a4c9b73c6308ff3feddfaa4795e6d56fbebc9499608a9e2a5c910acec54fb848b0af1f5ec050e104ee028bfe97
SSDEEP 24576:paTV9+L5rcO5kWoOlh6PWpJa4hHmW7K8P3pyIH:p8EiO5AGWWraIHhjY4
TLSH
T198052307F68119BBD4C37B7895A873AC0B72DCB666650B23F7FA181B7C21934E95014A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Control Panel\International\Geo\Nation	spooferrr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spooferrr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 416 wrote to memory of 1424	416	spooferrr.exe	87

C:\Users\Admin\AppData\Local\Temp\spooferrr.exe
"C:\Users\Admin\AppData\Local\Temp\spooferrr.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z8ED551A0\spooferrr.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

spooferrr.bat

Path C:\Users\Admin\AppData\Local\Temp\7z8ED551A0\spooferrr.bat
Size 2KB
SHA256 d8379427a991ee024dadd93ae1b184446282f0b01d76288f639f54cc63230e6f
MD5 93de52c477b676bf97546efeee3913cc
SHA1 0ca9a1213a42c9cec18700e1220b249dd89f6575
SHA512 192bbafacf0313d1e056371f6b3005998dfc8767c2ed2bae40af0e43341b27edc1aada5a9e7234a3d466cf38942eda95ff852f342317fbfeec3df64b1141707f
TLSH
T17741A0233431AD0C53909AC68EC65651725093479ED71EE0F8CFB372EB51DC366B4DA8
MD5 SHA1 SHA512 TLSH

Submit Download