Analysis
- max time kernel
143s - max time network
147s - platform
windows7_x64 - resource
win7v20201028 - submitted
13/11/2020, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe
- Size 222KB
- Sample201113-evvyt447ws
- SHA256 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf
- MD5 b9e351b1448c617d3f60d57cd42c2473
- SHA1 d8368be5171f0013b43258c44031e5c536a3b52c
- SHA512 38171513c711dc61c334503f989fb7b7ee849311ff98c4437a75bc4f0e4eb9e486aa9fad1065ca2a631028098f51a01f43256029ac26fad3327a89cc30badd4b
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\spoolsv32.exe" spoolsv32.exe - Executes dropped EXE 3 IoCs
pid Process 1940 spoolsv32.exe 1712 spoolsv32.exe 1776 spoolsv32.exe - Deletes itself 1 IoCs
pid Process 1788 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*spoolsv32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe" 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe" 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage spoolsv32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 spoolsv32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 spoolsv32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "4" spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage spoolsv32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 spoolsv32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 spoolsv32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage spoolsv32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage spoolsv32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 spoolsv32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1021 = "132497556812019216" spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage spoolsv32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage spoolsv32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 spoolsv32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage spoolsv32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage spoolsv32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 908 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2024 timeout.exe - Suspicious behavior: EnumeratesProcesses 68 IoCs
pid Process 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe 1940 spoolsv32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1940 spoolsv32.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1940 1588 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe 26 PID 1588 wrote to memory of 1940 1588 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe 26 PID 1588 wrote to memory of 1940 1588 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe 26 PID 1588 wrote to memory of 1896 1588 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe 27 PID 1588 wrote to memory of 1896 1588 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe 27 PID 1588 wrote to memory of 1896 1588 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe 27 PID 1588 wrote to memory of 1788 1588 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe 28 PID 1588 wrote to memory of 1788 1588 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe 28 PID 1588 wrote to memory of 1788 1588 5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe 28 PID 1788 wrote to memory of 2024 1788 cmd.exe 31 PID 1788 wrote to memory of 2024 1788 cmd.exe 31 PID 1788 wrote to memory of 2024 1788 cmd.exe 31 PID 1940 wrote to memory of 908 1940 spoolsv32.exe 35 PID 1940 wrote to memory of 908 1940 spoolsv32.exe 35 PID 1940 wrote to memory of 908 1940 spoolsv32.exe 35 PID 1500 wrote to memory of 1712 1500 taskeng.exe 40 PID 1500 wrote to memory of 1712 1500 taskeng.exe 40 PID 1500 wrote to memory of 1712 1500 taskeng.exe 40 PID 1500 wrote to memory of 1776 1500 taskeng.exe 41 PID 1500 wrote to memory of 1776 1500 taskeng.exe 41 PID 1500 wrote to memory of 1776 1500 taskeng.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe"C:\Users\Admin\AppData\Local\Temp\5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\spoolsv32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\spoolsv32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\spoolsv32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:908
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1896
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe" && del "C:\Users\Admin\AppData\Local\Temp\5fc0a6037edc8b1dcdf7680d3702ce9f68b2bbc7184782e60c2cfe898c84fdaf.exe.config"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:2024
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1452
-
C:\Windows\system32\taskeng.exetaskeng.exe {F4177D85-BDB9-4CAF-A6CC-C50D9778B300} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\spoolsv32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\spoolsv32.exe arguments2⤵
- Executes dropped EXE
PID:1712
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\spoolsv32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\spoolsv32.exe arguments2⤵
- Executes dropped EXE
PID:1776
-