f2c460675e4a64665a685968a1e8123ce5cce4f1a419d13f9a819554305731ee

Analysis

max time kernel
144s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2023, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Windows6.0-KB936330-X86.exe
Size

544.3MB
MD5

fcb3bb346d1c97a59af92d66dcad24b9
SHA1

b8a3fa8f819269e37d8acde799e7a9aea3dd4529
SHA256

f2c460675e4a64665a685968a1e8123ce5cce4f1a419d13f9a819554305731ee
SHA512

6ab1620af3ddda910bfb10b77a66a0f0a4506e5da75872f74e0094d7092532a23f9f39e3ef77aaa9681f02ef778ac502bc7939456603beedee3a435b8489cdba
SSDEEP

12582912:ArnyfElWuvSVWPht3TE0w81fHq9Sn0MN+75zftkXrTuM88:ADEuq055Vw81fKI0M4mB88

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
684	spinstall.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	Windows6.0-KB936330-X86.exe

Loads dropped DLL 1 IoCs

pid	Process
684	spinstall.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	spinstall.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
684	spinstall.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 684	4312	Windows6.0-KB936330-X86.exe	79
PID 4312 wrote to memory of 684	4312	Windows6.0-KB936330-X86.exe	79
PID 4312 wrote to memory of 684	4312	Windows6.0-KB936330-X86.exe	79

C:\Users\Admin\AppData\Local\Temp\Windows6.0-KB936330-X86.exe
"C:\Users\Admin\AppData\Local\Temp\Windows6.0-KB936330-X86.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4312
- C:\08ecf3cb915f76c3cc\spinstall.exe
  "C:\08ecf3cb915f76c3cc\spinstall.exe" /path:"C:\Users\Admin\AppData\Local\Temp\Windows6.0-KB936330-X86.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\08ecf3cb915f76c3cc\SpWizUI.dll

Filesize
149KB

MD5
562f9c10ed7a3092e177dc936a5364e6

SHA1
29880609110ca6968b0b42fff4088d0a98a466a7

SHA256
bd2fd1bf5b65feb4b1ee15afbf0f7d6b40a0646251131748413cefc9b30d28b3

SHA512
3f441aa13814a9c68a1bbf005ad826ef76b094bc6b181ab03385e9c949091ab5a7eb9951fc834f3651276c5d9f366e6d5db2e50624165a7e6788d53c7dd104a1

Download Submit
C:\08ecf3cb915f76c3cc\en-US\SpWizUI.dll.mui

Filesize
20KB

MD5
c3599c3a6f6be618021eb2b080b1066a

SHA1
a367e797ad156a682669743154b9e242655d3908

SHA256
814c7a649a88ed5733f96d26de705854ed8a2d035de9ea155607940fb210222a

SHA512
358ce4b7c576eb1084f9b59a74e349a8fd8e32aa333f1624bcbcf14c1425d2bf1060592f0c0614a148be2071cb10ab7285d0ba480f5e7465dcfec6fff9f9f165

Download Submit
C:\08ecf3cb915f76c3cc\en-US\spinstall.exe.mui

Filesize
5KB

MD5
95661bd162290be0082df7c659596435

SHA1
0fe3b15af97312f25cd9236e69e366e714b9d5f6

SHA256
4c1c038a39abe71886f3028427903b3d076bcc3643c747ec285e3841edabaffa

SHA512
26b54bb47aeb01d77d579bbb2d0477633f1fda1fc612f2d7137553fa08c99341df651642e49274f0aee61fdfbc4e31c597680eb112f4c6df8c2a6c972cf493c3

Download Submit
C:\08ecf3cb915f76c3cc\spinstall.exe

Filesize
127KB

MD5
8aa6c43ca7aa28e8851c9224e2e21be5

SHA1
7e2378cbb4c52503d30b1749a8b31dd82f534226

SHA256
0aba742c7cec729912017cbe9f1be87234822730aae4702202d5459df48685bf

SHA512
6eb052d860ec5d894c0d1e8f58d8e703456c525e5d43e0f3cbde62ff99041828b0a1da3c196cafb65e907836983c1cd4545d4f3ac13c22829bb75b9b48d93d47

Download Submit
C:\08ecf3cb915f76c3cc\spinstall.exe

Filesize
127KB

MD5
8aa6c43ca7aa28e8851c9224e2e21be5

SHA1
7e2378cbb4c52503d30b1749a8b31dd82f534226

SHA256
0aba742c7cec729912017cbe9f1be87234822730aae4702202d5459df48685bf

SHA512
6eb052d860ec5d894c0d1e8f58d8e703456c525e5d43e0f3cbde62ff99041828b0a1da3c196cafb65e907836983c1cd4545d4f3ac13c22829bb75b9b48d93d47

Download Submit
C:\08ecf3cb915f76c3cc\spwizui.dll

Filesize
149KB

MD5
562f9c10ed7a3092e177dc936a5364e6

SHA1
29880609110ca6968b0b42fff4088d0a98a466a7

SHA256
bd2fd1bf5b65feb4b1ee15afbf0f7d6b40a0646251131748413cefc9b30d28b3

SHA512
3f441aa13814a9c68a1bbf005ad826ef76b094bc6b181ab03385e9c949091ab5a7eb9951fc834f3651276c5d9f366e6d5db2e50624165a7e6788d53c7dd104a1

Download Submit