0a9e739910578192e2ad3f8f805a863d5cbcacbc38cde6488d7bbef5395dba87

Analysis

max time kernel
63s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spsetup132.exe
Size

8.6MB
MD5

2e57838af780fba75f9085a67cde99e4
SHA1

8070b4e5c50a4a981f6dcf78ffd424c065182b09
SHA256

0a9e739910578192e2ad3f8f805a863d5cbcacbc38cde6488d7bbef5395dba87
SHA512

84d58581d306c568db4ce572c509f69751932fe9293218f531e4d92951dd7d804756aeca8ede459c0a634e6f140fd9455693955325739657b5699d5d48d0ce63
SSDEEP

196608:FuYr1j0wlfy/tycs/bZ6ctLCyoZcmtZs47ctad+UK7HZDLtHw57I:FuYr5ik/TtLCfXOad+/ZHs7I

Score

7^/10

bootkit discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4324	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Speccy64.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	Speccy64.exe
File opened (read-only)	\??\M:	Speccy64.exe
File opened (read-only)	\??\P:	Speccy64.exe
File opened (read-only)	\??\W:	Speccy64.exe
File opened (read-only)	\??\N:	Speccy64.exe
File opened (read-only)	\??\E:	Speccy64.exe
File opened (read-only)	\??\I:	Speccy64.exe
File opened (read-only)	\??\J:	Speccy64.exe
File opened (read-only)	\??\W:	Speccy64.exe
File opened (read-only)	\??\X:	Speccy64.exe
File opened (read-only)	\??\S:	Speccy64.exe
File opened (read-only)	\??\L:	Speccy64.exe
File opened (read-only)	\??\O:	Speccy64.exe
File opened (read-only)	\??\R:	Speccy64.exe
File opened (read-only)	\??\T:	Speccy64.exe
File opened (read-only)	\??\K:	Speccy64.exe
File opened (read-only)	\??\R:	Speccy64.exe
File opened (read-only)	\??\U:	Speccy64.exe
File opened (read-only)	\??\X:	Speccy64.exe
File opened (read-only)	\??\G:	Speccy64.exe
File opened (read-only)	\??\K:	Speccy64.exe
File opened (read-only)	\??\V:	Speccy64.exe
File opened (read-only)	\??\Z:	Speccy64.exe
File opened (read-only)	\??\I:	Speccy64.exe
File opened (read-only)	\??\A:	Speccy64.exe
File opened (read-only)	\??\Q:	Speccy64.exe
File opened (read-only)	\??\V:	Speccy64.exe
File opened (read-only)	\??\Z:	Speccy64.exe
File opened (read-only)	\??\M:	Speccy64.exe
File opened (read-only)	\??\P:	Speccy64.exe
File opened (read-only)	\??\Q:	Speccy64.exe
File opened (read-only)	\??\Y:	Speccy64.exe
File opened (read-only)	\??\H:	Speccy64.exe
File opened (read-only)	\??\N:	Speccy64.exe
File opened (read-only)	\??\O:	Speccy64.exe
File opened (read-only)	\??\Y:	Speccy64.exe
File opened (read-only)	\??\B:	Speccy64.exe
File opened (read-only)	\??\E:	Speccy64.exe
File opened (read-only)	\??\J:	Speccy64.exe
File opened (read-only)	\??\S:	Speccy64.exe
File opened (read-only)	\??\B:	Speccy64.exe
File opened (read-only)	\??\G:	Speccy64.exe
File opened (read-only)	\??\A:	Speccy64.exe
File opened (read-only)	\??\H:	Speccy64.exe
File opened (read-only)	\??\T:	Speccy64.exe
File opened (read-only)	\??\U:	Speccy64.exe

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	Speccy64.exe
File opened for modification	\??\PhysicalDrive0	Speccy64.exe
File opened for modification	\??\PHYSICALDRIVE0	Speccy64.exe
File opened for modification	\??\PhysicalDrive0	Speccy64.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	spsetup132.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2818691465-3043947619-2475182763-1000\Control Panel\International\Geo\Nation	Speccy64.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	Speccy64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	Speccy64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	Speccy64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	Speccy64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_1793a485b491b199\msmouse.PNF	Speccy64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Speccy64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	Speccy64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	Speccy64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_5938c699b80ebb8f\keyboard.PNF	Speccy64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Speccy64.exe
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Speccy64.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	Speccy64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 37 IoCs

description	ioc	Process
File created	C:\Program Files\Speccy\Lang\lang-1062.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1066.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1071.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1026.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1037.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1041.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1055.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Speccy64.exe	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1060.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1102.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-9999.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1059.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1079.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-2074.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-3098.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1034.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1051.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1068.dll	spsetup132.exe
File created	C:\Program Files\Speccy\uninst.exe	spsetup132.exe
File created	C:\Program Files\Speccy\Speccy.exe	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1045.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1058.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1052.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1031.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1038.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1043.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1050.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1046.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1049.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1067.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-2052.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-2070.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-5146.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1036.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1035.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1040.dll	spsetup132.exe
File created	C:\Program Files\Speccy\Lang\lang-1053.dll	spsetup132.exe

Executes dropped EXE 3 IoCs

pid	Process
4304	Speccy64.exe
4276	Speccy64.exe
3856	Speccy64.exe

Loads dropped DLL 64 IoCs

pid	Process
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	Speccy64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	Speccy64.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	Speccy64.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell\ = "open"	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\DefaultIcon	spsetup132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\DefaultIcon\ = "C:\\Program Files\\Speccy\\Speccy64.exe,0"	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell\open\command	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell\open	spsetup132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell\open\command\ = "\"C:\\Program Files\\Speccy\\Speccy64.exe\" \"%1\""	spsetup132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.speccy\ = "Speccy.SPECCY"	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\shell	spsetup132.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.speccy	spsetup132.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Speccy.SPECCY\ = "Speccy Snapshot"	spsetup132.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeRestorePrivilege	1892	spsetup132.exe
Token: SeLoadDriverPrivilege	4304	Speccy64.exe
Token: SeLoadDriverPrivilege	3856	Speccy64.exe
Token: SeShutdownPrivilege	3856	Speccy64.exe
Token: SeCreatePagefilePrivilege	3856	Speccy64.exe
Token: SeDebugPrivilege	3856	Speccy64.exe
Token: SeShutdownPrivilege	3856	Speccy64.exe
Token: SeCreatePagefilePrivilege	3856	Speccy64.exe
Token: SeShutdownPrivilege	3856	Speccy64.exe
Token: SeCreatePagefilePrivilege	3856	Speccy64.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
3856	Speccy64.exe
3856	Speccy64.exe
3856	Speccy64.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
4304	Speccy64.exe
4304	Speccy64.exe
4304	Speccy64.exe
3856	Speccy64.exe
3856	Speccy64.exe
3856	Speccy64.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
1892	spsetup132.exe
4304	Speccy64.exe
4304	Speccy64.exe
3856	Speccy64.exe
3856	Speccy64.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 4304	1892	spsetup132.exe	95
PID 1892 wrote to memory of 4304	1892	spsetup132.exe	95
PID 4304 wrote to memory of 3208	4304	Speccy64.exe	99
PID 4304 wrote to memory of 3208	4304	Speccy64.exe	99
PID 3208 wrote to memory of 4324	3208	java.exe	102
PID 3208 wrote to memory of 4324	3208	java.exe	102
PID 4304 wrote to memory of 2652	4304	Speccy64.exe	104
PID 4304 wrote to memory of 2652	4304	Speccy64.exe	104
PID 3856 wrote to memory of 2900	3856	Speccy64.exe	112
PID 3856 wrote to memory of 2900	3856	Speccy64.exe	112
PID 3856 wrote to memory of 4448	3856	Speccy64.exe	115
PID 3856 wrote to memory of 4448	3856	Speccy64.exe	115
PID 3856 wrote to memory of 392	3856	Speccy64.exe	117
PID 3856 wrote to memory of 392	3856	Speccy64.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\spsetup132.exe
"C:\Users\Admin\AppData\Local\Temp\spsetup132.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Program Files\Speccy\Speccy64.exe
  "C:\Program Files\Speccy\Speccy64.exe"
  2⤵
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files\Java\jre-1.8\bin\java.exe
    "C:\Program Files\Java\jre-1.8\bin\java" -version
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      4⤵
      Modifies file permissions
      PID:4324
- - C:\Program Files\Java\jdk-1.8\bin\java.exe
    "C:\Program Files\Java\jdk-1.8\bin\java" -version
    3⤵
    PID:2652

C:\Program Files\Speccy\Speccy64.exe
"C:\Program Files\Speccy\Speccy64.exe"
1⤵
- Executes dropped EXE
PID:4276

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1424

C:\Program Files\Speccy\Speccy64.exe
"C:\Program Files\Speccy\Speccy64.exe"
1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks computer location settings
- Drops file in System32 directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Program Files\Java\jre-1.8\bin\java.exe
  "C:\Program Files\Java\jre-1.8\bin\java" -version
  2⤵
  PID:2900
- C:\Program Files\Java\jdk-1.8\bin\java.exe
  "C:\Program Files\Java\jdk-1.8\bin\java" -version
  2⤵
  PID:4448
- C:\Windows\system32\secedit.exe
  /export /cfg "C:\Users\Admin\AppData\Local\Temp\spc_se.txt" /quiet /areas SECURITYPOLICY
  2⤵
  PID:392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Speccy\Lang\lang-1026.dll

Filesize
78KB

MD5
4679b87ceb52b6a2c4f58fbc4f81b903

SHA1
7c655ecd763cf44ff7217f17c700186e6bf53e1b

SHA256
0eaaf207d8bf0ce106bc357c2e388384cd49d8eb3deda1d471274d141ffc63fd

SHA512
fa4d40a7ac5d41c8f495b263b2f241c55815337b41760383d9e2b3fe317a385d3a3da9b2436c55c3541e8f235450348c3bc101e0ddae4961081d74c1ed647299

Download Submit
C:\Program Files\Speccy\Lang\lang-1031.dll

Filesize
78KB

MD5
fbe8a53b36d7ba86bfc7d0c3a1d7659f

SHA1
1ced3b3d2af5250289080f524c41de2ef484eaac

SHA256
2c8095af8905d8b72204bd896e7865b91f6f77c375a5a1c9cffa0e3887ba8577

SHA512
f8de0d37e3ef3972504e6a05c58ce3d3a3ce13e8f55fac7795fde468add2648305f055aa7b6de47fab23e5446a22748da989dbaf1bf189a006fbc70efe0f475d

Download Submit
C:\Program Files\Speccy\Lang\lang-1034.dll

Filesize
86KB

MD5
52e6a2417cb6855d34b2c29e8c46a7cf

SHA1
9fe0c63039728334f023b8b08f3d45c3c3b739a2

SHA256
a84dbfab73568b73ee5f94bce0b43cc2487638962d3e500d1fdb1d666ec1e024

SHA512
d1161a7cb8b1e7cda982ca96758c0ef3e2ad039fe1f5b913c704c189bf960a9e02cdeae310512227881d559fa3cee226e5c4616b3279198c38a983102750ad35

Download Submit
C:\Program Files\Speccy\Lang\lang-1035.dll

Filesize
83KB

MD5
17aa2f62022349d437c88fa20e4a2614

SHA1
9a42e8eb8fd0cccf90ea090c22221078f85f005f

SHA256
3e85a29e06e9b3249f07f01f5b1d28bc9596d3c5a3e9a1c0f59ab4febede2af0

SHA512
fc2f49fdc448ddad09db040cb549139c971db92f9379fb19fc3b3bc5afeb7aaf236a3ff9e844246515d80bfbf892619129219020bc391fb200d43803242938f0

Download Submit
C:\Program Files\Speccy\Lang\lang-1038.dll

Filesize
81KB

MD5
16e8b36b7d32c9ba1244acc916f61875

SHA1
3e87cedec5899f7d35121b07faa1bb1b00a5bcd4

SHA256
007d6edd16d867fd90ef10ba1e0dbdbc3a1d00f675df8c58a654dd1c3633689d

SHA512
5db00a5ddae227cf7c4b99dbe8ccb3a7a4bff55ed902bd349c343a33668a3b19ec63f322ad9eb7b3a5a62944bfb39f7ac8225b6410b1d1e202f1f7246b9a2e68

Download Submit
C:\Program Files\Speccy\Lang\lang-1040.dll

Filesize
81KB

MD5
0bbd0dd2123f0134289e1899beeadcfa

SHA1
c1b0d49f4d5c24b5f0605b3a514fe8b3cb5de02c

SHA256
e3b75bd3ffaa7a165adaf2101bbd0190afc7515194069856edc3397959f3a0a4

SHA512
4c85aedc57025c89d9f7719f96fc7cda02fb4bc57e506ade8cbb03cd77c5bab3ba358b3925cf2fccc9bdc4f8f1b9ae0be5840f91e351ae1b3d62b44a27bfbe87

Download Submit
C:\Program Files\Speccy\Lang\lang-1043.dll

Filesize
82KB

MD5
ffb6e35bc7a5998ff5d5ba24a869f466

SHA1
d5a642bb6aa88fff2459cda34fbda8b4cd816f23

SHA256
4fd71f7dc6932583940f26c87032fd370999ef92ddaa828d6298984850348701

SHA512
30c3282538c6b599d4d469e5ab7558a24f5f781627d40211b00f1ad88df619ba8d199e000c3ab87d5be40760272aac389ee31a48ff2784e22312519770a49b1a

Download Submit
C:\Program Files\Speccy\Lang\lang-1045.dll

Filesize
81KB

MD5
0c56b1b96b3be18b7ec58b1c663a524c

SHA1
64159f43ce937b180b71e331693671631df07168

SHA256
c578d97c07dd5422fdd2a73e66c3555fbf302e25c85dd9a15e9c75120930402b

SHA512
031d6d25416e5a0a9a7a911a850d90e98eea174e1e630e3e7292feb5e5831e131b996b0cd7b72048fbebb90db7922fca1e4401b74d76ee5b849e8ca4421e49bc

Download Submit
C:\Program Files\Speccy\Lang\lang-1046.dll

Filesize
78KB

MD5
1ff7950eeeeeac8ae4a0eaea33ee7b42

SHA1
918cb4b578f579f0aeb59aea3d64aa918c43f964

SHA256
e4f747fc2c6d19f38aa0b04852e9ab8152bb4b04468d6115bb76cb5d06b46031

SHA512
f6fb85e66e56320bf93e38abcce29bf6a67a8df7f6a5cb1a9abd9aa794394d302f7bbf7a0249f6c8552517ed9eed960e08c21f73fda883fd52a983c841fd2ff6

Download Submit
C:\Program Files\Speccy\Lang\lang-1049.dll

Filesize
77KB

MD5
6fbe3b991761678df3943a4fdacd53b4

SHA1
23121473e2b0356ea46ee4105813c2bb6d4a1d8e

SHA256
1ace20196a9ba651d8267314fdce3686eddb82c47a8f97593a865daa18c2e7bd

SHA512
5b5632a05b50ac6d7159c7bade950c9c11d04d4d2f6e7520a612680bc6d253492da21c5bd561c2d7301fd39715021915b8d91d92146da8f0557c6d2adf4e4795

Download Submit
C:\Program Files\Speccy\Lang\lang-1050.dll

Filesize
85KB

MD5
9151b422df85c5332162254567c0c9d0

SHA1
8cb5a1b093bdd7338010d44dd954b4ca0f26f67d

SHA256
d9fb740bb46df481c44356684fe644fc945bc57ff269f8b619419a26b11d3d35

SHA512
8660a05b82de92582cbe46e79f1801c9c0516d9465ac2b6ad3417face79e1b1471fb03c9ce07927e87c03a0ee0f26237c11d3a3e333dfa8a1794718bc5344c47

Download Submit
C:\Program Files\Speccy\Lang\lang-1051.dll

Filesize
73KB

MD5
e9e5e0b4e27a260a0a5ae43bda4a1812

SHA1
c814f9172c24a5ce58374999264af02b99b828f7

SHA256
5858f1ad625b3934cb6bdf1c5a14b4368da94c0cb97d0d1b65b6985d23450b59

SHA512
311093dfa8ec36a98b0f308f8cc752797e0f2e40c6b0fb541510dcd61f33ddc135dcd6a7b0dc3982a813d499d9d685c6e5ef80080547f6f756c2db5f22f8eedd

Download Submit
C:\Program Files\Speccy\Speccy64.exe

Filesize
7.3MB

MD5
d41812a78894d4e47df163db19d354e6

SHA1
580a2d42799843fb213c91d730d850c5db997363

SHA256
5465297f50aa45b3d19c721259f38452b533e4569e85fef7568867303a7bc3ee

SHA512
a5957c9502cf4ba650f204808f37c116aaaec4e26fadff2db3c1e331f73c8cdf76ade248ee8a548196f4083624c2640efd5bdf4f7e85d777973a1bd6fa83f10f

Download Submit
C:\Program Files\Speccy\lang\lang-1036.dll

Filesize
83KB

MD5
b1284354327ef02b49e544ac793f6133

SHA1
19099eac446b960bd15a2585030355bfc1a661e4

SHA256
854c2e3e288ea5197fc84842107c991d081794ea6a72bcb92a0696f1f64b056c

SHA512
f78930cbb75c1ed46ccafef428d664b4e6f248d3e1cf54604e838216795608df58cb250e6e2360d509e1db0ad342a8a234cec3ae19cd140ff055079bd435d97c

Download Submit
C:\Program Files\Speccy\lang\lang-1037.dll

Filesize
66KB

MD5
ebefa147111fde9b5201b44022c6dfaa

SHA1
c7c0a4010fcd09ac9cceb122e468f7e672c946b5

SHA256
01d24790c1aa19b18a58ad491de497e5d97551e4e69f72c4981d551d8ac28fd2

SHA512
549019de74a55553eb39c5cf68b0de87f382abf7fb857c721a20bd7797e35d424838c4fd11328950b6311a8db0a84b9280c28b539c5c93283cbd526fe2584ef9

Download Submit
C:\Program Files\Speccy\lang\lang-1041.dll

Filesize
55KB

MD5
e4ae139f1191415dfa94906870ab28b5

SHA1
83f7f161eef6c09ca8485b5dcba95b898c973b2d

SHA256
4ab959ee29db99f381aa37e4b05fa33cb87a5c31b76e236ab0c29bd9f1d4538d

SHA512
cd002a81a9a139b71bde764820536693bdf1fd763eb23023982a55a754cdde9461b773d3ab590e339f6fd27ac84e17d633f068586e0f9b7e34a5b5887daec6c8

Download Submit
C:\Program Files\Speccy\lang\lang-1052.dll

Filesize
79KB

MD5
c4ed5ea4876722b228d9a189386e2654

SHA1
89dfdc5d45913db12a6b3cc2684ae7ab09c74994

SHA256
68f5a8b4cabf62a0c5eefb02478416240992d08dbb3214765ba341dc4cbd3b0d

SHA512
1a2f07592773b1d55ce9b20b7a67f369cfab29e07cb0ce55ec3b43d8e6dd4d784568b35d24260890c5c368daabfd1d2459bb2030d08a4ce4542af6cac5defdf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log

Filesize
512KB

MD5
58594491b9f38ce4ed5bef3d5008f7a4

SHA1
41680af110d1544836e98fae61f1e3179b5b0814

SHA256
73cee70b00fc0edf1864c9a0d61639ab6f562fff88369e3dc1cc6b4c8469f1dd

SHA512
1ec675f6213a7f2331b595cb8ae801e3d653ef2e384d9b6e27d60bbbe4c8d8f4eb7bd4293468f60f1e64f5f245aca4e9bb8eed86b3ee6599defa0a33ac0bf778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

Filesize
14.0MB

MD5
9d5945cd0fc78995465b7cbe29b20b7f

SHA1
b2700899afaedfeac7b953248c5408496d78e504

SHA256
73179ce0302454dcc546e374c0c61f0814a8922ff18190d3c1864f27a83b9c8f

SHA512
a043fd949ba73819656284cf9d9cbd9b8fac13ac59bd462c213513045931350fc21b4b2eef4d1dc02257f9e77c435de5fb9c209fd6453af71774c5fffa8137b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

Filesize
16KB

MD5
dc74d58c8454757a36d727a89ab22b2d

SHA1
92130b89beb71cde72e538aa6fe0f30aea4b9a70

SHA256
1d9b4cbc7b952f8a1d001f935e82e01daf748d58f108f5ea918544eace404dc0

SHA512
e137aac04b97e39ae2792ee2cb9b68fdc8bca96cea3c2369e853535f091a3feac362c481adef0fab12db9644df025f25ca0d9a1259bafb50d2a02a88bc9c268d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.jfm

Filesize
16KB

MD5
3430f3217978c22899fd244a8ee4bd3d

SHA1
812651c3255cb361ecc0c608fd482902964f6ab6

SHA256
a396cc1c9e1ac9701a15c77c5d956f09d5bc6995cff3eb496269d56cd8c4cd2e

SHA512
64a32fc740c7fc1e3af43d60076e00b6f1e277593f0c8b1796c834e81b0717a66812d4246cd736f7f298e41d1529ec493ef7f78e17c7e7413dc61200dab3fd60

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\ButtonEvent.dll

Filesize
5KB

MD5
c24568a3b0d7c8d7761e684eb77252b5

SHA1
66db7f147cbc2309d8d78fdce54660041acbc60d

SHA256
e2da6d8b73b5954d58baa89a949aacece0527dfb940ca130ac6d3fd992d0909d

SHA512
5d43e4c838fd7f4c6a4ab6cc6d63e0f81d765d9ca33d9278d082c4f75f9416907df10b003e10edc1b5ef39535f722d8dbfab114775ac67da7f9390dcc2b4b443

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\System.dll

Filesize
11KB

MD5
41a3c964232edd2d7d5edea53e8245cd

SHA1
76d7e1fbf15cc3da4dd63a063d6ab2f0868a2206

SHA256
8b65fec615c7b371c23f8f7f344b12dc5085e40a556f96db318ed757494d62d5

SHA512
fa16bd9d020602e3065afd5c0638bc37775b40eb18bfa33b4ca5babcc3e6f112ae7d43457a6e9685ddbe6e94b954a1dc43d1da7af9ca7464019a3f110af549c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\UserInfo.dll

Filesize
4KB

MD5
c1f778a6d65178d34bde4206161a98e0

SHA1
29719fffef1ab6fe2df47e5ed258a5e3b3a11cfc

SHA256
9caf7a78f750713180cf64d18967a2b803b5580e636e59279dcaaf18ba0daa87

SHA512
9c3cf25cf43f85a5f9c9ed555f12f3626ef9daeeedd4d366ada58748ead1f6e279fea977c76ae8bae1dc49bfd852e899cb137c4a006c13e9fcebf6e5e2926a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\g\gcapi_dll.dll

Filesize
348KB

MD5
2973af8515effd0a3bfc7a43b03b3fcc

SHA1
4209cded0caac7c5cb07bcb29f1ee0dc5ac211ee

SHA256
d0e4581210a22135ce5deb47d9df4d636a94b3813e0649aab84822c9f08af2a0

SHA512
b6f9653142ec00b2e0a5045f0f2c7ba5dbbda8ef39edf14c80a24ecab3c41f081eb466994aaf0879ac96b201ba5c02d478275710e4d08b3debc739063d177f7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\inetc.dll

Filesize
23KB

MD5
7760daf1b6a7f13f06b25b5a09137ca1

SHA1
cc5a98ea3aa582de5428c819731e1faeccfcf33a

SHA256
5233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079

SHA512
d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\nsDialogs.dll

Filesize
9KB

MD5
2aba8f16eca82517460013a3de7cbf67

SHA1
3812192fa7b873f426c4b0d0d822b3c9d51aa164

SHA256
60b85fad2477b8c0138067be3697290b280b9334cf408cb57894e3baae615d0d

SHA512
4e059f70ef420c22d69199557ff3eab9e51fcefc75d220b057f1508f9566cd6251f9e06a8fe3695bf7d913ebabd2519ce52f485f2de9a5e4ab3ebc553b877fb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\ui\pfUI.dll

Filesize
13.6MB

MD5
1bfa036321fcb209564549538345a289

SHA1
8ede722a5cc6135847ad5276f30143022fa7bacf

SHA256
547e48f35a1c38362cfa71a3ffe1b81cc8d61eb204157828e2ec58a80f3e4b2e

SHA512
9729cc5ca18dbd58b516169de053d50e0df9288fc2d91cbbbd887573fe006c5f506789f23a09a73dfcf75fa71b9cff88e0f59da550263d877939be8c4f996d92

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\ui\res\Montserrat-Regular.otf

Filesize
44KB

MD5
27e50ffd6a14cbc8221c9dbd3b5208dc

SHA1
713c997ce002a4d8762c2dcc405213061233e4bc

SHA256
40fc1142200a5c1c18f80b6915257083c528c7f7fd2b00a552aeebc42898d428

SHA512
0a602f88cfba906b41719943465edb09917c447d746bfed5c9ce9c75d077f6aed2f8146697acd74557359f1ae267ca2a8e3a2ca40fb1633bde8e6114261abd90

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\ui\res\PF_logo.png

Filesize
3KB

MD5
079cca30760cca3c01863b6b96e87848

SHA1
98c2ca01f248bc61817db7e5faea4a3d8310db50

SHA256
8dd37d3721e25c32c5bf878b6dba9e61d04b7ce8aec45bdf703a41bc41802dfa

SHA512
3e25c10e3a5830584c608b9178ab062e93e0e9009a7d897bb5e3561180b0b0910bd4178063d982eb33806a005c93931ae2ec5be520ec0d0c9a7c452cb78fd6a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\ui\res\SP_computer.png

Filesize
66KB

MD5
873b7c34ced38adaa2d01752099c09df

SHA1
e659d094f6e3fe6f71a3f1b047b75206bab168a0

SHA256
aced6376065f2c71b4b619823f735bbdcac967a5113cd4e6b978298a58c927c9

SHA512
a8d54d52bb5ec4502cd4bb829eef23c1b2edff9daeeca0f4fb7dbaa0cabdcac763a60aedc8393ba12a393a8263a5c06d3555d7b165cf9927dd9cc18d68b9e510

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsz37DB.tmp\ui\res\Speccy_Logo_72px.png

Filesize
8KB

MD5
1787175d95eab213cf5a8bc25e252676

SHA1
1d4bd97b2bcaabd26f2ef7781b91233575e1ba0f

SHA256
65fa6baa9d140251d04069cf538f3262ebbb0e4e62d58d06cc58ad8b22085a83

SHA512
de1df226bb9bf84305aea43c237ea76937a9df0c56ecd9afeee1920c3f4d600fde0cc0c027ca397fb6067ffb1a7fe8c03496d82ed844bb4f47f32b2b30eda52f

Download Submit
C:\Users\Admin\AppData\Local\Temp\sce71834.tmp

Filesize
12KB

MD5
009819c0abc869038a9d184bd7a9b6c7

SHA1
3ce497bc1ce7cb35209fd2a8556dabae7ee3adfe

SHA256
2fd69eb9a60ae80b0168ff8f4656e5981701f1558bf5707997b1ee9ba35c3185

SHA512
3fe0065e16ade01bda35f0c850b6a67cfbd0e3377e7470c67680f2502b76444261f6abc4dbd6ea2822d1a76f3d386c6f7af7aa5bd8f32659d15912428ec7b23d

Download Submit
memory/1892-125-0x00000000071C0000-0x00000000071C8000-memory.dmp

Filesize
32KB

Download
memory/1892-101-0x0000000005FA0000-0x0000000005FB0000-memory.dmp

Filesize
64KB

Download
memory/1892-130-0x0000000006F60000-0x0000000006F68000-memory.dmp

Filesize
32KB

Download
memory/1892-128-0x0000000006F50000-0x0000000006F51000-memory.dmp

Filesize
4KB

Download
memory/1892-127-0x0000000006F60000-0x0000000006F68000-memory.dmp

Filesize
32KB

Download
memory/1892-150-0x0000000007040000-0x0000000007048000-memory.dmp

Filesize
32KB

Download
memory/1892-107-0x0000000006140000-0x0000000006150000-memory.dmp

Filesize
64KB

Download
memory/1892-133-0x0000000006F50000-0x0000000006F58000-memory.dmp

Filesize
32KB

Download
memory/1892-136-0x0000000006F10000-0x0000000006F11000-memory.dmp

Filesize
4KB

Download
memory/1892-158-0x0000000006F10000-0x0000000006F11000-memory.dmp

Filesize
4KB

Download
memory/1892-148-0x0000000007000000-0x0000000007008000-memory.dmp

Filesize
32KB

Download
memory/1892-207-0x00000000071C0000-0x00000000071C8000-memory.dmp

Filesize
32KB

Download
memory/1892-205-0x0000000007140000-0x0000000007148000-memory.dmp

Filesize
32KB

Download
memory/1892-151-0x0000000007040000-0x0000000007048000-memory.dmp

Filesize
32KB

Download
memory/1892-154-0x0000000006F50000-0x0000000006F51000-memory.dmp

Filesize
4KB

Download
memory/1892-208-0x00000000071C0000-0x00000000071C8000-memory.dmp

Filesize
32KB

Download