Overview

overview

8

Static

static

打印共...er.bat

windows7-x64

8

打印共...er.bat

windows10-2004-x64

8

打印共...pl.dll

windows7-x64

1

打印共...pl.dll

windows10-2004-x64

1

打印共...er.bat

windows7-x64

8

打印共...er.bat

windows10-2004-x64

8

打印共...pl.dll

windows7-x64

1

打印共...pl.dll

windows10-2004-x64

1

打印共...er.bat

windows7-x64

8

打印共...er.bat

windows10-2004-x64

8

打印共...pl.dll

windows7-x64

8

打印共...pl.dll

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0bb6eadf8a17bd99c76b17265bf6107001a23af1554835bb4e63d5aa352b64b4

  • Size

    875KB

  • Sample

    221030-q923caddb2

  • MD5

    2d75b1d69e871d0eb95e77a441580c7d

  • SHA1

    3c36b82d9fe2101f9165cdc6c1fff1e1f0eaddf8

  • SHA256

    0bb6eadf8a17bd99c76b17265bf6107001a23af1554835bb4e63d5aa352b64b4

  • SHA512

    6cf48132c691c2fa94b8a90acf19ac9bfd901b69f51bb23fa090551937d476962b15fe8c05ff184377b94141912aa8148a644b508b26a6c70ab36a0b82e9eeb8

  • SSDEEP

    24576:20mui58SXO9a725hsUuclC/PmVxaiTLUW0PExHNepIr75:ZfiRXkaC/W/Qbf0sfrF

Score
8/10
discoveryexploitpersistence

Malware Config

Targets

    • Target

      打印共享修复Fix/Fix_PrintSpooler/Fix_PrintSpooler.bat

    • Size

      1KB

    • MD5

      b4bcdad4dae1d57e6e38f81deb446e6e

    • SHA1

      40509574224f0610c65e127cfc19f1664136d905

    • SHA256

      7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82

    • SHA512

      696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c

    Score
    8/10
    discoveryexploitpersistence

    • Possible privilege escalation attempt

      exploit

    • Registers new Print Monitor

      persistence

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      打印共享修复Fix/Fix_PrintSpooler/win32spl.dll

    • Size

      868KB

    • MD5

      2e9581b7b9cd276a5ab115e4df69f6f9

    • SHA1

      800cdb03e4f2125200974a72f43653110426e56d

    • SHA256

      d417f0b2c3d9cc2bcae46358a391d308993ae537325663647ffb2d2c4679018a

    • SHA512

      c3e39ada472a82a707a6e3e79590c40cfc4fe5f46462fd7bd324ec682505a63be413e3453d703942985a73437d21ba6fac5b19ad96c4b55d524716fdf9257bd9

    • SSDEEP

      12288:c8ygJA2sRsHn6fOKAWPLL11fcGHft7TWZZAicrK1HZQk:c8yf2mC6fwWPLTEGHfxTWZGrK1HZQk

    Score
    1/10
    behavioral3behavioral4

    • Target

      打印共享修复Fix/LTSC/Fix_PrintSpooler.bat

    • Size

      1KB

    • MD5

      b4bcdad4dae1d57e6e38f81deb446e6e

    • SHA1

      40509574224f0610c65e127cfc19f1664136d905

    • SHA256

      7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82

    • SHA512

      696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c

    Score
    8/10
    discoveryexploitpersistence

    • Possible privilege escalation attempt

      exploit

    • Registers new Print Monitor

      persistence

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral5behavioral6

    • Target

      打印共享修复Fix/LTSC/win32spl.dll

    • Size

      828KB

    • MD5

      937dddf8be82ae84d207b7dea83ec6fd

    • SHA1

      df86817c4a95283fe19d3be966cbc37282b5cbdc

    • SHA256

      40bc894b387c867e8264bf9a3d3910cd1693fc1c8cb557f1a460607bf67d53d0

    • SHA512

      0c5641f3e3d6cac2bfd12a258d45d4270d43a5b89ca50ffb2a414a1b3aa24ae0d0319f21ed90776cd2d00fac59c29b80ba0fb5372c585df99805bdca04f1c4b8

    • SSDEEP

      12288:YrTWRai8FK/RZ1/1dLuDYvu3kQ3+fl8K2n4UH9yKhod9hs5ZN+8GM:Kwai26j/1g73mfl8K24w9yTCZNWM

    Score
    1/10
    behavioral7behavioral8

    • Target

      打印共享修复Fix/Win7_X64/Fix_PrintSpooler.bat

    • Size

      1KB

    • MD5

      b4bcdad4dae1d57e6e38f81deb446e6e

    • SHA1

      40509574224f0610c65e127cfc19f1664136d905

    • SHA256

      7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82

    • SHA512

      696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c

    Score
    8/10
    discoveryexploitpersistence

    • Possible privilege escalation attempt

      exploit

    • Registers new Print Monitor

      persistence

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Drops file in System32 directory

    behavioral9behavioral10

    • Target

      打印共享修复Fix/Win7_X64/win32spl.dll

    • Size

      743KB

    • MD5

      6fc904493f366f0a10d6cd03a8c4b933

    • SHA1

      c8cac1aa85ac7417ea64d3ad77b7c13ebc02f1f4

    • SHA256

      81be67de5cbff88e8b950fc28a786dc64c8de80e9aba4438432ab9f1776af1aa

    • SHA512

      ab438ed0b4c87825b0219050185892fbc1831c3343ef6bb03276fa02615b0e9ea8adb844a5f5fd617ba62560d99fc325246ad29c3e774840342f814c9a0dbfb7

    • SSDEEP

      6144:lCwDdWRKFexLic4IV1510RfjkEsZzBKfa/1UodGcSuZ1OkZ5TGTri4NTYYZP+E5V:wwD4KFeBijIDSfjkVrUodJ3Z529v3E6

    Score
    8/10
    persistence
    behavioral11behavioral12

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

4
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

File Permissions Modification

3
T1222

Credential Access

Discovery

Query Registry

3
T1012

Peripheral Device Discovery

3
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks