Analysis
- user interaction
yes - max time kernel
78s - max time network
66s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/10/2026, 23:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Saryx OGFN Spoofer (unlocked).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Saryx OGFN Spoofer (unlocked).exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Saryx OGFN Spoofer (unlocked).exe
- Size 2.6MB
- Sample261027-24btraxthz
- SHA256 7a630f502adb6d0bd9832a2c24ebe14569a382b6f14894822535a3653de06823
- MD5 8a13cb68ec8bece95e7035b39a6b6959
- SHA1 3ac27a6dfaaa8fb82673c52c6a6baa51237478a1
- SHA512 b0a1158134435f31ebc01210d5dd23e926093e94f1acf09696e3f51c19339613014792dd75c8373d6f2618a6beb5240f6b0723c94c377e2ae074481c5c281085
- SSDEEP 49152:53TYnhdBHLacCbrvn2rBdZBKYZYdQ4ZwM1ghkv5Ov0f:1cnv4vn2rBdZBKYZYdzw
- TLSH T1E1D5CF5E5AAD04ECD2A6C27CC55B4707F7F27C4D03209FEB16E08DA50E17AE5663AB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs
pid Process 2564 Saryx OGFN Spoofer (unlocked).exe - Suspicious use of SetThreadContext 48 IoCs
description pid Process PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe PID 2564 set thread context of 0 2564 Saryx OGFN Spoofer (unlocked).exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1132 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Saryx OGFN Spoofer (unlocked).exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Saryx OGFN Spoofer (unlocked).exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe 2564 Saryx OGFN Spoofer (unlocked).exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSystemtimePrivilege 2564 Saryx OGFN Spoofer (unlocked).exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2564 wrote to memory of 1132 2564 Saryx OGFN Spoofer (unlocked).exe 90 PID 1132 wrote to memory of 3688 1132 cmd.exe 91 PID 1132 wrote to memory of 4212 1132 cmd.exe 92 PID 1132 wrote to memory of 4896 1132 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\Saryx OGFN Spoofer (unlocked).exe"C:\Users\Admin\AppData\Local\Temp\Saryx OGFN Spoofer (unlocked).exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Saryx OGFN Spoofer (unlocked).exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\Saryx OGFN Spoofer (unlocked).exe" MD53⤵PID:3688
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:4212
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:4896
-
-