Analysis
-
max time kernel
560s -
max time network
361s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
15-11-2021 14:57
Static task
static1
Behavioral task
behavioral1
Sample
file000_spoolcv.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
file000_spoolcv.exe
Resource
win10-en-20211014
General
-
Target
file000_spoolcv.exe
-
Size
400KB
-
MD5
e6688d5a1565053e114263a98daca7de
-
SHA1
eb9c95ee5c0835406e27478099020ac1eee2c479
-
SHA256
f4dbc868579e467f9e05766f67497ae6d8f4b3be91165d40df4a18ec912e5e89
-
SHA512
c152cf41b58017466823e3d329265fb0dcf82fde8751587799d678ae46ab3745190d1e3686ecb97106abbd0990786eea90afe70b6ee10951b209f1e00583b9db
Malware Config
Extracted
C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt
hakbit
hakbit@protonmail.com
12grtxACJZkgT2nGAvMesgoM4ADHJ6NTaW
Signatures
-
Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolcv.exe disable_win_def C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolcv.exe disable_win_def -
Hakbit
Ransomware which encrypts files using AES, first seen in November 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
Processes:
spoolcv.exepid process 3808 spoolcv.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
spoolcv.exedescription ioc process File created C:\Users\Admin\Pictures\RepairExit.png.crypted spoolcv.exe File created C:\Users\Admin\Pictures\SaveExit.tiff.crypted spoolcv.exe File opened for modification C:\Users\Admin\Pictures\SaveExit.tiff spoolcv.exe -
Drops startup file 2 IoCs
Processes:
file000_spoolcv.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolcv.exe file000_spoolcv.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolcv.exe file000_spoolcv.exe -
Drops file in Program Files directory 64 IoCs
Processes:
spoolcv.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\over-arrow-navigation.svg spoolcv.exe File created C:\Program Files\Java\jdk1.8.0_66\jre\THIRDPARTYLICENSEREADME.txt.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-16.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-100_contrast-black.png.crypted spoolcv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations_retina.png spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\SmallTile.scale-200.png.crypted spoolcv.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_unselected_18.svg.crypted spoolcv.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\HELP_ME_RECOVER_MY_FILES.txt spoolcv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-80.png spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-40.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated_contrast-black.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-16.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\10912_48x48x32.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-white_scale-100.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsStoreLogo.scale-100.png.crypted spoolcv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png spoolcv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-180.png spoolcv.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11701.1001.87.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreSmallTile.scale-100.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_altform-unplated.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Messaging_3.26.24002.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo1.targetsize-36.png.crypted spoolcv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\organize.svg spoolcv.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.16112.11601.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Emoticons\small\bike.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-unplated_contrast-white.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16_contrast-white.png.crypted spoolcv.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_neutral_split.scale-140_8wekyb3d8bbwe\Assets\Office\Simplify.scale-140.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36_altform-unplated.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7260_20x20x32.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_5_Point_Star.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxBadge.scale-150.png.crypted spoolcv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\HELP_ME_RECOVER_MY_FILES.txt spoolcv.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\SmallTile.scale-125.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2017.125.40.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-40_altform-unplated.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-150.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\MapsAppList.targetsize-96_altform-unplated.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-300.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\dz_60x42.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_16.511.8780.0_x64__8wekyb3d8bbwe\Lumia.ViewerPlugin\Assets\IconEditMoment.contrast-white_scale-200.png.crypted spoolcv.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.scale-140.png spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.scale-100_contrast-white.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Classic\mask\1d.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.scale-125.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-fullcolor.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\2818_20x20x32.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\OutlookMailSmallTile.scale-100.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-250.png.crypted spoolcv.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt spoolcv.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.crypted spoolcv.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_large.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupSmallTile.scale-125.png.crypted spoolcv.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\export.svg.crypted spoolcv.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_checkbox_unselected_18.svg.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Western\western_11s.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\md_60x42.png.crypted spoolcv.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-200.png.crypted spoolcv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png spoolcv.exe File created C:\Program Files\WindowsApps\Microsoft.OneConnect_2.1701.277.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OneConnectAppList.targetsize-20.png.crypted spoolcv.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf.crypted spoolcv.exe File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7989_32x32x32.png.crypted spoolcv.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot_2x.png.crypted spoolcv.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\cstm_brand_preview2x.png spoolcv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1924 vssadmin.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
notepad.exepid process 1232 notepad.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
file000_spoolcv.exespoolcv.exevssvc.exedescription pid process Token: SeDebugPrivilege 2728 file000_spoolcv.exe Token: SeDebugPrivilege 3808 spoolcv.exe Token: SeBackupPrivilege 516 vssvc.exe Token: SeRestorePrivilege 516 vssvc.exe Token: SeAuditPrivilege 516 vssvc.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
file000_spoolcv.exespoolcv.execmd.execmd.exedescription pid process target process PID 2728 wrote to memory of 3808 2728 file000_spoolcv.exe spoolcv.exe PID 2728 wrote to memory of 3808 2728 file000_spoolcv.exe spoolcv.exe PID 2728 wrote to memory of 2760 2728 file000_spoolcv.exe cmd.exe PID 2728 wrote to memory of 2760 2728 file000_spoolcv.exe cmd.exe PID 3808 wrote to memory of 1924 3808 spoolcv.exe vssadmin.exe PID 3808 wrote to memory of 1924 3808 spoolcv.exe vssadmin.exe PID 2760 wrote to memory of 2324 2760 cmd.exe choice.exe PID 2760 wrote to memory of 2324 2760 cmd.exe choice.exe PID 3808 wrote to memory of 1232 3808 spoolcv.exe notepad.exe PID 3808 wrote to memory of 1232 3808 spoolcv.exe notepad.exe PID 3808 wrote to memory of 1312 3808 spoolcv.exe cmd.exe PID 3808 wrote to memory of 1312 3808 spoolcv.exe cmd.exe PID 1312 wrote to memory of 1512 1312 cmd.exe choice.exe PID 1312 wrote to memory of 1512 1312 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file000_spoolcv.exe"C:\Users\Admin\AppData\Local\Temp\file000_spoolcv.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolcv.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolcv.exe"2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin" delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe" C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txt3⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolcv.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\file000_spoolcv.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolcv.exeMD5
e6688d5a1565053e114263a98daca7de
SHA1eb9c95ee5c0835406e27478099020ac1eee2c479
SHA256f4dbc868579e467f9e05766f67497ae6d8f4b3be91165d40df4a18ec912e5e89
SHA512c152cf41b58017466823e3d329265fb0dcf82fde8751587799d678ae46ab3745190d1e3686ecb97106abbd0990786eea90afe70b6ee10951b209f1e00583b9db
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\spoolcv.exeMD5
e6688d5a1565053e114263a98daca7de
SHA1eb9c95ee5c0835406e27478099020ac1eee2c479
SHA256f4dbc868579e467f9e05766f67497ae6d8f4b3be91165d40df4a18ec912e5e89
SHA512c152cf41b58017466823e3d329265fb0dcf82fde8751587799d678ae46ab3745190d1e3686ecb97106abbd0990786eea90afe70b6ee10951b209f1e00583b9db
-
C:\Users\Admin\Desktop\HELP_ME_RECOVER_MY_FILES.txtMD5
5ba06cf0bdc5318c5270b1e8d0e36cf5
SHA112be906105cd651245143fa2a64e2c18f8f8e35c
SHA2565a741fbab1c3b0566778934ac2ecdef7d69fa6e6c433f79873d6c285760df304
SHA5123927c3e79f855a46adf2a95f1b9e34e760ea371472be4262d56925ead9383605279928edf04cb86576b200bcf7c9dc1fd37f955dadba909b7c3deeeb1bef4b46
-
memory/1232-126-0x0000000000000000-mapping.dmp
-
memory/1312-127-0x0000000000000000-mapping.dmp
-
memory/1512-128-0x0000000000000000-mapping.dmp
-
memory/1924-123-0x0000000000000000-mapping.dmp
-
memory/2324-124-0x0000000000000000-mapping.dmp
-
memory/2728-115-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB
-
memory/2760-122-0x0000000000000000-mapping.dmp
-
memory/3808-117-0x0000000000000000-mapping.dmp
-
memory/3808-125-0x0000000001120000-0x0000000001122000-memory.dmpFilesize
8KB