Overview
overview
8Static
static
printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
8printerfix...pl.dll
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...sv.exe
windows7-x64
printerfix...sv.exe
windows10-2004-x64
1printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1printerfix...er.bat
windows7-x64
8printerfix...er.bat
windows10-2004-x64
8printerfix...pl.dll
windows7-x64
1printerfix...pl.dll
windows10-2004-x64
1Analysis
-
max time kernel
184s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2022 08:10
Static task
static1
Behavioral task
behavioral1
Sample
printerfix/LTSC/Fix_PrintSpooler.bat
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
printerfix/LTSC/Fix_PrintSpooler.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
printerfix/LTSC/win32spl.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
printerfix/LTSC/win32spl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
printerfix/Win 2012/Fix_PrintSpooler.bat
Resource
win7-20220901-en
Behavioral task
behavioral6
Sample
printerfix/Win 2012/Fix_PrintSpooler.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
printerfix/Win 2012/win32spl.dll
Resource
win7-20220901-en
Behavioral task
behavioral8
Sample
printerfix/Win 2012/win32spl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
printerfix/Win 2016/Fix_PrintSpooler.bat
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
printerfix/Win 2016/Fix_PrintSpooler.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
printerfix/Win 2016/win32spl.dll
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
printerfix/Win 2016/win32spl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
printerfix/Win 2019/Fix_PrintSpooler.bat
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
printerfix/Win 2019/Fix_PrintSpooler.bat
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
printerfix/Win 2019/win32spl.dll
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
printerfix/Win 2019/win32spl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
printerfix/win7/Fix_PrintSpooler.bat
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
printerfix/win7/Fix_PrintSpooler.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
printerfix/win7/win32spl.dll
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
printerfix/win7/win32spl.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral21
Sample
printerfix/旧文件归档/localspl.dll
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
printerfix/旧文件归档/localspl.dll
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
printerfix/旧文件归档/spoolsv.exe
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
printerfix/旧文件归档/spoolsv.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
printerfix/旧文件归档/win32spl.dll
Resource
win7-20220901-en
Behavioral task
behavioral26
Sample
printerfix/旧文件归档/win32spl.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
printerfix/适合win10-20H版本后/Fix_PrintSpooler.bat
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
printerfix/适合win10-20H版本后/Fix_PrintSpooler.bat
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
printerfix/适合win10-20H版本后/win32spl.dll
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
printerfix/适合win10-20H版本后/win32spl.dll
Resource
win10v2004-20220812-en
General
-
Target
printerfix/Win 2016/Fix_PrintSpooler.bat
-
Size
1KB
-
MD5
b4bcdad4dae1d57e6e38f81deb446e6e
-
SHA1
40509574224f0610c65e127cfc19f1664136d905
-
SHA256
7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82
-
SHA512
696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c
Malware Config
Signatures
-
Possible privilege escalation attempt 3 IoCs
Processes:
icacls.exetakeown.exeicacls.exepid process 2464 icacls.exe 1272 takeown.exe 1328 icacls.exe -
Registers new Print Monitor 2 TTPs 12 IoCs
Processes:
spoolsv.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts spoolsv.exe -
Loads dropped DLL 1 IoCs
Processes:
spoolsv.exepid process 704 spoolsv.exe -
Modifies file permissions 1 TTPs 3 IoCs
Processes:
takeown.exeicacls.exeicacls.exepid process 1272 takeown.exe 1328 icacls.exe 2464 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
cmd.exedescription ioc process File opened for modification C:\Windows\System32\win32spl.dll cmd.exe File created C:\Windows\System32\win32spl.dll cmd.exe -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
spoolsv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID spoolsv.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1796 timeout.exe -
Modifies data under HKEY_USERS 18 IoCs
Processes:
spoolsv.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45" spoolsv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:" spoolsv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45" spoolsv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:" spoolsv.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
takeown.exedescription pid process Token: SeTakeOwnershipPrivilege 1272 takeown.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cmd.exenet.exenet.exedescription pid process target process PID 4896 wrote to memory of 3872 4896 cmd.exe net.exe PID 4896 wrote to memory of 3872 4896 cmd.exe net.exe PID 3872 wrote to memory of 2488 3872 net.exe net1.exe PID 3872 wrote to memory of 2488 3872 net.exe net1.exe PID 4896 wrote to memory of 1796 4896 cmd.exe timeout.exe PID 4896 wrote to memory of 1796 4896 cmd.exe timeout.exe PID 4896 wrote to memory of 1272 4896 cmd.exe takeown.exe PID 4896 wrote to memory of 1272 4896 cmd.exe takeown.exe PID 4896 wrote to memory of 1328 4896 cmd.exe icacls.exe PID 4896 wrote to memory of 1328 4896 cmd.exe icacls.exe PID 4896 wrote to memory of 2464 4896 cmd.exe icacls.exe PID 4896 wrote to memory of 2464 4896 cmd.exe icacls.exe PID 4896 wrote to memory of 4336 4896 cmd.exe reg.exe PID 4896 wrote to memory of 4336 4896 cmd.exe reg.exe PID 4896 wrote to memory of 5024 4896 cmd.exe net.exe PID 4896 wrote to memory of 5024 4896 cmd.exe net.exe PID 5024 wrote to memory of 1996 5024 net.exe net1.exe PID 5024 wrote to memory of 1996 5024 net.exe net1.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\printerfix\Win 2016\Fix_PrintSpooler.bat"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\system32\net.exenet stop spooler2⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop spooler3⤵PID:2488
-
C:\Windows\system32\timeout.exetimeout /t 3 /nobreak2⤵
- Delays execution with timeout.exe
PID:1796 -
C:\Windows\system32\takeown.exeTakeown /A /F C:\Windows\System32\win32spl.dll2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1272 -
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\win32spl.dll" /grant "administrators":F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1328 -
C:\Windows\system32\icacls.exeicacls "C:\Windows\System32\win32spl.dll" /grant SYSTEM:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2464 -
C:\Windows\system32\reg.exereg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print" /v RpcAuthnLevelPrivacyEnabled /t REG_DWORD /d 0 /f2⤵PID:4336
-
C:\Windows\system32\net.exenet start spooler2⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start spooler3⤵PID:1996
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
- Registers new Print Monitor
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:704
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System32\win32spl.dllFilesize
818KB
MD514e5d5013d1c11eafad5aff79795fce2
SHA133dbeb7cc68fd6fe048b2d5d505d105e9cbaaf52
SHA256cdca1b6a9a10a594bf5a7d48c0fe480d8116145739c78ff2af7cbbbafb9aea06
SHA512ba2593927eb76b8141eded1cb33671e115b000c899ee281569500b857300ef5105191c6399727c9cf3068b40e4081393dc5a7a51fd54850a975e5c290b06dccc
-
C:\Windows\System32\win32spl.dllFilesize
818KB
MD514e5d5013d1c11eafad5aff79795fce2
SHA133dbeb7cc68fd6fe048b2d5d505d105e9cbaaf52
SHA256cdca1b6a9a10a594bf5a7d48c0fe480d8116145739c78ff2af7cbbbafb9aea06
SHA512ba2593927eb76b8141eded1cb33671e115b000c899ee281569500b857300ef5105191c6399727c9cf3068b40e4081393dc5a7a51fd54850a975e5c290b06dccc
-
memory/1272-135-0x0000000000000000-mapping.dmp
-
memory/1328-136-0x0000000000000000-mapping.dmp
-
memory/1796-134-0x0000000000000000-mapping.dmp
-
memory/1996-140-0x0000000000000000-mapping.dmp
-
memory/2464-137-0x0000000000000000-mapping.dmp
-
memory/2488-133-0x0000000000000000-mapping.dmp
-
memory/3872-132-0x0000000000000000-mapping.dmp
-
memory/4336-138-0x0000000000000000-mapping.dmp
-
memory/5024-139-0x0000000000000000-mapping.dmp