Static task
static1
Behavioral task
behavioral1
Sample
spinstall.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
spinstall.exe
Resource
win10v2004-20230220-en
General
-
Target
spinstall.exe
-
Size
127KB
-
MD5
8aa6c43ca7aa28e8851c9224e2e21be5
-
SHA1
7e2378cbb4c52503d30b1749a8b31dd82f534226
-
SHA256
0aba742c7cec729912017cbe9f1be87234822730aae4702202d5459df48685bf
-
SHA512
6eb052d860ec5d894c0d1e8f58d8e703456c525e5d43e0f3cbde62ff99041828b0a1da3c196cafb65e907836983c1cd4545d4f3ac13c22829bb75b9b48d93d47
-
SSDEEP
3072:BECE1c5mUGbyxXC0uDGAeHSaae1ARggXU0/4nT7FS/V+yp0XZ7y/7:Ac5mUGbyxXCzGAeHSaaCkwOiZM7
Malware Config
Signatures
Files
-
spinstall.exe.exe windows x86
b71f603b7ac8790e7a07a42282e921cc
Code Sign
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before10/01/1997, 07:00Not After31/12/2020, 07:00SubjectCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation61:06:bf:fe:00:00:00:00:00:14Certificate
IssuerCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before22/06/2007, 21:56Not After22/09/2008, 22:06SubjectCN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
61:47:52:ba:00:00:00:00:00:04Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:53Not After16/09/2011, 02:03SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
61:49:7c:ed:00:00:00:00:00:05Certificate
IssuerCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before16/09/2006, 01:55Not After16/09/2011, 02:05SubjectCN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate
IssuerCN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft CorporationNot Before16/09/2006, 01:04Not After15/09/2019, 07:00SubjectCN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
79:ad:16:a1:4a:a0:a5:ad:4c:73:58:f4:07:13:2e:65Certificate
IssuerCN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6dNot Before09/05/2001, 23:19Not After09/05/2021, 23:28SubjectCN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6dKey Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
61:15:08:27:00:00:00:00:00:0cCertificate
IssuerCN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6dNot Before25/01/2006, 23:22Not After25/01/2017, 23:32SubjectCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
45:47:71:25:18:c2:90:03:28:a7:49:16:fc:d7:f9:1a:85:ab:fb:b7Signer
Actual PE Digest45:47:71:25:18:c2:90:03:28:a7:49:16:fc:d7:f9:1a:85:ab:fb:b7Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
ControlTraceW
EnableTrace
StartTraceW
FreeSid
ConvertSidToStringSidW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
LookupAccountNameW
RegFlushKey
InitiateShutdownW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
kernel32
GetSystemDefaultLCID
SetCurrentDirectoryW
GetCurrentProcessId
SetLastError
CreateEventW
WaitForSingleObjectEx
WaitForSingleObject
InterlockedIncrement
SetEvent
Sleep
InterlockedDecrement
CreateThread
EnumUILanguagesW
GetProductInfo
SystemTimeToFileTime
GetSystemTime
GetFileMUIPath
GetSystemPowerStatus
DeviceIoControl
LocalFree
LocalAlloc
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
FreeLibrary
GetProcAddress
LoadLibraryW
GetUILanguageInfo
GetModuleFileNameW
CreateDirectoryW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetSystemWindowsDirectoryW
FindClose
FindNextFileW
FindFirstFileW
lstrlenW
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
GetSystemWow64DirectoryW
ReadFile
SetFilePointer
GetFileSize
GetFullPathNameW
WriteFile
SetEndOfFile
GetFileAttributesExW
ReleaseMutex
GetVersionExW
GetCurrentProcess
IsWow64Process
GetFileAttributesW
CreateFileW
GetFileSizeEx
CloseHandle
CreateMutexW
GetModuleHandleW
GetLastError
GetWindowsDirectoryW
MoveFileExW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
user32
LoadStringW
MessageBoxW
msvcrt
__set_app_type
?terminate@@YAXXZ
__p__fmode
??3@YAXPAX@Z
_except_handler4_common
_vsnwprintf
_wtol
_controlfp
isdigit
_wcsnicmp
_wcsicmp
_ftol2
_wtoi
wcstok
??2@YAPAXI@Z
__p__commode
memset
_adjust_fdiv
wcsstr
wcsncmp
towupper
wcsrchr
wcstol
memcpy
wcschr
wcstoul
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
__setusermatherr
_amsg_exit
shell32
SHFileOperationW
ole32
CoInitializeEx
CoGetMalloc
CoInitialize
CoInitializeSecurity
CoCreateInstance
CoUninitialize
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
ntdll
RtlNumberOfClearBits
RtlAreBitsClear
RtlAreBitsSet
RtlSetBits
RtlInitializeBitMap
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
spwizui
?StartInstallUI@@YGJPAUISPInstall@@H@Z
?ShowError@@YGJJPBG@Z
sqmapi
SqmEndSession
SqmWaitForUploadComplete
SqmStartUpload
SqmAddToStreamV
SqmSet
SqmSetMachineId
SqmWriteSharedMachineId
SqmCreateNewId
SqmReadSharedMachineId
SqmSetEnabled
SqmSetAppId
SqmGetSession
SqmIsWindowsOptedIn
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ