5586c5e1a139fffc4c11136a6d371a6173f363a46ee9f2b46e8fb9e7df363b74 | Triage

Sharing

General

Target

5586c5e1a139fffc4c11136a6d371a6173f363a46ee9f2b46e8fb9e7df363b74
Size

3.1MB
Sample

221106-j2ztpadfcn
MD5

5c5d6b425cc606073b8e9c94d27854c4
SHA1

49313d4d7923b21fc6e983f41343c3d2119a2d34
SHA256

5586c5e1a139fffc4c11136a6d371a6173f363a46ee9f2b46e8fb9e7df363b74
SHA512

2f0d6f54e298b465dfd6706f146b1aeb93cf03b327b113fac97c7740ec29e37cc10aa2242672a7930d11711cac6c344febbc1e6f968131952c87886e9f624a5d
SSDEEP

49152:OjzTb1Mchm5lYEoaykao9f1wpagy/TdcpTqxsFiQSplEO0W2raz5I:kTb15hm5l3bl1wZy/IksFaXL2mI

Score

8^/10

discovery exploit persistence

Malware Config

Targets

- Target
  
  printerfix/LTSC/Fix_PrintSpooler.bat
- Size
  
  1KB
- MD5
  
  b4bcdad4dae1d57e6e38f81deb446e6e
- SHA1
  
  40509574224f0610c65e127cfc19f1664136d905
- SHA256
  
  7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82
- SHA512
  
  696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c
Score

8^/10

discovery exploit persistence
- Possible privilege escalation attempt
  exploit
- Registers new Print Monitor
  persistence
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  printerfix/LTSC/win32spl.dll
- Size
  
  828KB
- MD5
  
  937dddf8be82ae84d207b7dea83ec6fd
- SHA1
  
  df86817c4a95283fe19d3be966cbc37282b5cbdc
- SHA256
  
  40bc894b387c867e8264bf9a3d3910cd1693fc1c8cb557f1a460607bf67d53d0
- SHA512
  
  0c5641f3e3d6cac2bfd12a258d45d4270d43a5b89ca50ffb2a414a1b3aa24ae0d0319f21ed90776cd2d00fac59c29b80ba0fb5372c585df99805bdca04f1c4b8
- SSDEEP
  
  12288:YrTWRai8FK/RZ1/1dLuDYvu3kQ3+fl8K2n4UH9yKhod9hs5ZN+8GM:Kwai26j/1g73mfl8K24w9yTCZNWM
Score

1^/10
behavioral3 behavioral4
- Target
  
  printerfix/Win 2012/Fix_PrintSpooler.bat
- Size
  
  1KB
- MD5
  
  b4bcdad4dae1d57e6e38f81deb446e6e
- SHA1
  
  40509574224f0610c65e127cfc19f1664136d905
- SHA256
  
  7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82
- SHA512
  
  696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c
Score

8^/10

discovery exploit persistence
- Possible privilege escalation attempt
  exploit
- Registers new Print Monitor
  persistence
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral5 behavioral6
- Target
  
  printerfix/Win 2012/win32spl.dll
- Size
  
  849KB
- MD5
  
  501ff59564283bd160341c7f99c6c81a
- SHA1
  
  fdc6d92a23f3d75dd9ae4ab613a7f052d526114d
- SHA256
  
  f04fc42a91b517b6b6f57fea03e9c1b23ccde3b9fdc9bcb537ee09d552c602b9
- SHA512
  
  d4c0174ace128d976432a7264c9f4a1c74305f9ba00d1127feb479ebf9ac5fd056ffcab91275d2a0fa4dd46018a55546a8a8b7073b497528819c39d81e476904
- SSDEEP
  
  12288:FXOFkMeM900LUU1YBc0wTFpYIPmj/XoFuS3GVy5BYkj6RLdL:FeGMeYY2FpYIPYorY1tdL
Score

1^/10
behavioral7 behavioral8
- Target
  
  printerfix/Win 2016/Fix_PrintSpooler.bat
- Size
  
  1KB
- MD5
  
  b4bcdad4dae1d57e6e38f81deb446e6e
- SHA1
  
  40509574224f0610c65e127cfc19f1664136d905
- SHA256
  
  7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82
- SHA512
  
  696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c
Score

8^/10

discovery exploit persistence
- Possible privilege escalation attempt
  exploit
- Registers new Print Monitor
  persistence
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  
  printerfix/Win 2016/win32spl.dll
- Size
  
  818KB
- MD5
  
  14e5d5013d1c11eafad5aff79795fce2
- SHA1
  
  33dbeb7cc68fd6fe048b2d5d505d105e9cbaaf52
- SHA256
  
  cdca1b6a9a10a594bf5a7d48c0fe480d8116145739c78ff2af7cbbbafb9aea06
- SHA512
  
  ba2593927eb76b8141eded1cb33671e115b000c899ee281569500b857300ef5105191c6399727c9cf3068b40e4081393dc5a7a51fd54850a975e5c290b06dccc
- SSDEEP
  
  24576:zsoXgjmt1azIARklladrwv2x9T2IE6L2q:zscgCKndr82XS6aq
Score

1^/10
behavioral11 behavioral12
- Target
  
  printerfix/Win 2019/Fix_PrintSpooler.bat
- Size
  
  1KB
- MD5
  
  b4bcdad4dae1d57e6e38f81deb446e6e
- SHA1
  
  40509574224f0610c65e127cfc19f1664136d905
- SHA256
  
  7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82
- SHA512
  
  696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c
Score

8^/10

discovery exploit persistence
- Possible privilege escalation attempt
  exploit
- Registers new Print Monitor
  persistence
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral13 behavioral14
- Target
  
  printerfix/Win 2019/win32spl.dll
- Size
  
  831KB
- MD5
  
  26327b93ebcad7bf061b63894923a78f
- SHA1
  
  4fc07b0cf4a9a54e5fdd71c33e329abe05b88823
- SHA256
  
  258058689cef565f5ab1938e1cfed2753bbf5ef2325ad5f8501afd932d42b53e
- SHA512
  
  fe0ac07985793ba1a0682ffc0375e07782b63588458d839293eeb5aa8d1cb0809f90051864f7620025bc49a67fd87720523fecaffb62ea895bec7f255a88199b
- SSDEEP
  
  24576:B1C5fSpV5zc9yles+O8rbwDFYoyUklnJz:B1MSf5QsX8rEDuoypnJ
Score

1^/10
behavioral15 behavioral16
- Target
  
  printerfix/win7/Fix_PrintSpooler.bat
- Size
  
  1KB
- MD5
  
  b4bcdad4dae1d57e6e38f81deb446e6e
- SHA1
  
  40509574224f0610c65e127cfc19f1664136d905
- SHA256
  
  7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82
- SHA512
  
  696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c
Score

8^/10

discovery exploit persistence
- Possible privilege escalation attempt
  exploit
- Registers new Print Monitor
  persistence
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral17 behavioral18
- Target
  
  printerfix/win7/win32spl.dll
- Size
  
  743KB
- MD5
  
  6fc904493f366f0a10d6cd03a8c4b933
- SHA1
  
  c8cac1aa85ac7417ea64d3ad77b7c13ebc02f1f4
- SHA256
  
  81be67de5cbff88e8b950fc28a786dc64c8de80e9aba4438432ab9f1776af1aa
- SHA512
  
  ab438ed0b4c87825b0219050185892fbc1831c3343ef6bb03276fa02615b0e9ea8adb844a5f5fd617ba62560d99fc325246ad29c3e774840342f814c9a0dbfb7
- SSDEEP
  
  6144:lCwDdWRKFexLic4IV1510RfjkEsZzBKfa/1UodGcSuZ1OkZ5TGTri4NTYYZP+E5V:wwD4KFeBijIDSfjkVrUodJ3Z529v3E6
Score

8^/10

persistence
- Registers COM server for autorun
  persistence
behavioral19 behavioral20
- Target
  
  printerfix/旧文件归档/localspl.dll.good
- Size
  
  992KB
- MD5
  
  07e5f06f35dd427990578e74d57301ad
- SHA1
  
  c7bd47d8d3051d8457684ab9e27fcb01c0e2885d
- SHA256
  
  872cbe00d1283f89e6655370654afd67c0a1db7a97cf0196e092b412c532b07d
- SHA512
  
  8c77bd31b761360577294d2e97d4ec64d832a9176f961de0396574fe78614559930b20fd1851b4d7f1a75d8dd236e322430085806e164b5d8aa2d286cecf81da
- SSDEEP
  
  24576:eMF6kukUhKvHbHmF6edxT/UKjXP7wRhkE4+RTZlonPlhTX7:0YzW6EhjXP74RTmPlhz
Score

1^/10
behavioral21 behavioral22
- Target
  
  printerfix/旧文件归档/spoolsv.exe.good
- Size
  
  527KB
- MD5
  
  a250292a645bc628531b0645e174e847
- SHA1
  
  c324c1ea99538d9f21b8c4eb450eeed9a3c030e7
- SHA256
  
  4092f47050b49dd4d8ea8a343cbd057387974089c0ea326fd7e43090cb913d56
- SHA512
  
  5aa49c3a93c1a0b2e5079bb60b1da999afd09225fd65c113c9cb82e361af50a8a474703d05a170198dcbd54f3edd45d59a8abfe200843c46fa871c0a2955d6eb
- SSDEEP
  
  12288:PZFo6UKqV2r2CTAj6xqMF7Nd4UdsR75KCdZ2FXG:3PMV2qCA6xqMF7NezR75K5G
Score

1^/10
behavioral23 behavioral24
- Target
  
  printerfix/旧文件归档/win32spl.dll.good
- Size
  
  613KB
- MD5
  
  829f9e0d63e9a4e8c1a40a821114e189
- SHA1
  
  356f13b8db6918d4fbc4c59b50c970d3b175bedc
- SHA256
  
  b027966e23657a6007806a69624a211d3e7ae0cbf1a80ce057fd5072aa2bf1a7
- SHA512
  
  e40b8b59fa129c455e2530ff15a63127da09adf897b82775badc27036fbfdf36a8c93822b0023f788f8a16ddc3dd983a718c24acda355a51b7162bee01c4cb27
- SSDEEP
  
  12288:NcDnAlo784gqSp1k/Lfr8aJ3sWuib49isyUnVhZzj0leLkh1z24pN:NcDnAlo7LRCk/LfjsWuibiisyUnJzj0t
Score

1^/10
behavioral25 behavioral26
- Target
  
  printerfix/适合win10-20H版本后/Fix_PrintSpooler.bat
- Size
  
  1KB
- MD5
  
  b4bcdad4dae1d57e6e38f81deb446e6e
- SHA1
  
  40509574224f0610c65e127cfc19f1664136d905
- SHA256
  
  7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82
- SHA512
  
  696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c
Score

8^/10

discovery exploit persistence
- Possible privilege escalation attempt
  exploit
- Registers new Print Monitor
  persistence
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral27 behavioral28
- Target
  
  printerfix/适合win10-20H版本后/win32spl.dll
- Size
  
  868KB
- MD5
  
  2e9581b7b9cd276a5ab115e4df69f6f9
- SHA1
  
  800cdb03e4f2125200974a72f43653110426e56d
- SHA256
  
  d417f0b2c3d9cc2bcae46358a391d308993ae537325663647ffb2d2c4679018a
- SHA512
  
  c3e39ada472a82a707a6e3e79590c40cfc4fe5f46462fd7bd324ec682505a63be413e3453d703942985a73437d21ba6fac5b19ad96c4b55d524716fdf9257bd9
- SSDEEP
  
  12288:c8ygJA2sRsHn6fOKAWPLL11fcGHft7TWZZAicrK1HZQk:c8yf2mC6fwWPLTEGHfxTWZGrK1HZQk
Score

1^/10
behavioral29 behavioral30

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

File Permissions Modification

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

discoveryexploitpersistence

behavioral2

discoveryexploitpersistence

behavioral3

behavioral4

behavioral5

discoveryexploitpersistence

behavioral6

discoveryexploitpersistence

behavioral7

behavioral8

behavioral9

discoveryexploitpersistence

behavioral10

discoveryexploitpersistence

behavioral11

behavioral12

behavioral13

discoveryexploitpersistence

behavioral14

discoveryexploitpersistence

behavioral15

behavioral16

behavioral17

discoveryexploitpersistence

behavioral18

discoveryexploitpersistence

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

discoveryexploitpersistence

behavioral28

discoveryexploit

behavioral29

behavioral30