119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0

Analysis

max time kernel
124s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 04:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe
Size

303KB
MD5

2ef9704ae2006c30910cd926e256d9a5
SHA1

f39d724f7b4ea8d126a6287f07bdbf243fbfb11c
SHA256

119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0
SHA512

fde00647cdb691d5f0dcae711d5f3e1ac8d1b4542381f598d902f5dd6ad542eb10580569b6e35334ef1bff42d948e41085e7d237e893263b16ffcd4d4513d53a
SSDEEP

3072:9TEFDGAGLgqBHwyjOj5jCyQT+IEmwKli4b7HTCKFVsj7dHoK49NoY46DedtUWZeo:hEGJBQ9FjCyQTTEm/EoiLUoh1iVc

Score

8^/10

persistence

Malware Config

Signatures

Registers new Print Monitor 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\INF\oem0.PNF	PnPutil.exe
File created	C:\Windows\INF\oem1.PNF	PnPutil.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne01:"	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne01:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne01:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne01:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:"	spoolsv.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2944	PnPutil.exe
Token: SeRestorePrivilege	2896	spoolsv.exe
Token: SeRestorePrivilege	2896	spoolsv.exe
Token: SeRestorePrivilege	2896	spoolsv.exe
Token: SeRestorePrivilege	2896	spoolsv.exe
Token: SeRestorePrivilege	2896	spoolsv.exe
Token: SeRestorePrivilege	2896	spoolsv.exe
Token: SeRestorePrivilege	2896	spoolsv.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 1740	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	29
PID 1460 wrote to memory of 1740	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	29
PID 1460 wrote to memory of 1740	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	29
PID 1740 wrote to memory of 2944	1740	cmd.exe	30
PID 1740 wrote to memory of 2944	1740	cmd.exe	30
PID 1740 wrote to memory of 2944	1740	cmd.exe	30
PID 1460 wrote to memory of 3000	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	32
PID 1460 wrote to memory of 3000	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	32
PID 1460 wrote to memory of 3000	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	32
PID 3000 wrote to memory of 3016	3000	cmd.exe	31
PID 3000 wrote to memory of 3016	3000	cmd.exe	31
PID 3000 wrote to memory of 3016	3000	cmd.exe	31
PID 3016 wrote to memory of 1760	3016	net.exe	33
PID 3016 wrote to memory of 1760	3016	net.exe	33
PID 3016 wrote to memory of 1760	3016	net.exe	33
PID 1460 wrote to memory of 2784	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	36
PID 1460 wrote to memory of 2784	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	36
PID 1460 wrote to memory of 2784	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	36
PID 2784 wrote to memory of 2796	2784	cmd.exe	35
PID 2784 wrote to memory of 2796	2784	cmd.exe	35
PID 2784 wrote to memory of 2796	2784	cmd.exe	35
PID 1460 wrote to memory of 2760	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	37
PID 1460 wrote to memory of 2760	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	37
PID 1460 wrote to memory of 2760	1460	119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe	37
PID 2760 wrote to memory of 2648	2760	cmd.exe	40
PID 2760 wrote to memory of 2648	2760	cmd.exe	40
PID 2760 wrote to memory of 2648	2760	cmd.exe	40
PID 2648 wrote to memory of 2616	2648	net.exe	39
PID 2648 wrote to memory of 2616	2648	net.exe	39
PID 2648 wrote to memory of 2616	2648	net.exe	39

C:\Users\Admin\AppData\Local\Temp\119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe
"C:\Users\Admin\AppData\Local\Temp\119d9e9121dfc475999a3551eba6ef8f9943a4df2e101c5e189608f0b806bcb0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pnputil -e
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\system32\PnPutil.exe
    pnputil -e
    3⤵
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:2944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop Spooler
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\GWI Port Monitor\Ports" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start Spooler
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\system32\net.exe
    net start Spooler
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2648

C:\Windows\system32\net.exe
net stop Spooler
1⤵
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Windows\system32\net1.exe
  C:\Windows\system32\net1 stop Spooler
  2⤵
  PID:1760

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:3048

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\GWI Port Monitor\Ports" /f
1⤵
PID:2796

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Registers new Print Monitor
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start Spooler
1⤵
PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads