Overview
overview
10Static
static
3Serial Checker.bat
windows7-x64
1Serial Checker.bat
windows10-2004-x64
1Sp00f(NEW)...64.dll
windows7-x64
1Sp00f(NEW)...64.dll
windows10-2004-x64
1Sp00f(NEW)...rs.dll
windows7-x64
1Sp00f(NEW)...rs.dll
windows10-2004-x64
1Sp00f(NEW)...64.dll
windows7-x64
5Sp00f(NEW)...64.dll
windows10-2004-x64
5Sp00f(NEW)...up.exe
windows7-x64
6Sp00f(NEW)...up.exe
windows10-2004-x64
10Sp00f(OLD)...ID.exe
windows7-x64
1Sp00f(OLD)...ID.exe
windows10-2004-x64
1Sp00f(OLD)...ld.exe
windows7-x64
1Sp00f(OLD)...ld.exe
windows10-2004-x64
1Sp00f(OLD)...47.dll
windows7-x64
3Sp00f(OLD)...47.dll
windows10-2004-x64
3Sp00f(OLD)...rs.dll
windows7-x64
1Sp00f(OLD)...rs.dll
windows10-2004-x64
1Sp00f(OLD)...64.dll
windows7-x64
5Sp00f(OLD)...64.dll
windows10-2004-x64
5Sp00f(OLD)..._1.dll
windows7-x64
1Sp00f(OLD)..._1.dll
windows10-2004-x64
3Sp00f(OLD)...es.dll
windows7-x64
1Sp00f(OLD)...es.dll
windows10-2004-x64
1Sp00f(OLD)...og.dll
windows7-x64
1Sp00f(OLD)...og.dll
windows10-2004-x64
1Sp00f(OLD)...er.dll
windows7-x64
1Sp00f(OLD)...er.dll
windows10-2004-x64
1Sp00f(OLD)...ml.dll
windows7-x64
1Sp00f(OLD)...ml.dll
windows10-2004-x64
1Sp00f(OLD)...me.dll
windows7-x64
1Sp00f(OLD)...me.dll
windows10-2004-x64
1Analysis
- max time kernel
119s - max time network
125s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
12/07/2024, 14:21
Static task
static1
Behavioral task
behavioral1
Sample
Serial Checker.bat
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
Serial Checker.bat
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Sp00f(NEW)/Add/CiWinCng64.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
Sp00f(NEW)/Add/CiWinCng64.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Sp00f(NEW)/Add/bdfilters.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
Sp00f(NEW)/Add/bdfilters.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Sp00f(NEW)/Add/bdfilters64.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral8
Sample
Sp00f(NEW)/Add/bdfilters64.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Sp00f(NEW)/Software_Setup.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral10
Sample
Sp00f(NEW)/Software_Setup.exe
Resource
win10v2004-20240704-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Sp00f(OLD)/SPOOFER HWID.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
Sp00f(OLD)/SPOOFER HWID.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Sp00f(OLD)/Spoofer_Old.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral14
Sample
Sp00f(OLD)/Spoofer_Old.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Sp00f(OLD)/runtimes/D3Dcompiler_47.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral16
Sample
Sp00f(OLD)/runtimes/D3Dcompiler_47.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Sp00f(OLD)/runtimes/bdfilters.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral18
Sample
Sp00f(OLD)/runtimes/bdfilters.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Sp00f(OLD)/runtimes/bdfilters64.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
Sp00f(OLD)/runtimes/bdfilters64.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Sp00f(OLD)/runtimes/libcrypto-1_1.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
Sp00f(OLD)/runtimes/libcrypto-1_1.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
Sp00f(OLD)/runtimes/win/lib/net6.0/System.Diagnostics.EventLog.Messages.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
Sp00f(OLD)/runtimes/win/lib/net6.0/System.Diagnostics.EventLog.Messages.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
Sp00f(OLD)/runtimes/win/lib/net6.0/System.Diagnostics.EventLog.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral26
Sample
Sp00f(OLD)/runtimes/win/lib/net6.0/System.Diagnostics.EventLog.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Sp00f(OLD)/runtimes/win/lib/net6.0/System.ServiceProcess.ServiceController.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral28
Sample
Sp00f(OLD)/runtimes/win/lib/net6.0/System.ServiceProcess.ServiceController.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Sp00f(OLD)/runtimes/win/lib/netcoreapp3.0/System.Runtime.WindowsRuntime.UI.Xaml.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral30
Sample
Sp00f(OLD)/runtimes/win/lib/netcoreapp3.0/System.Runtime.WindowsRuntime.UI.Xaml.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Sp00f(OLD)/runtimes/win/lib/netcoreapp3.0/System.Runtime.WindowsRuntime.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral32
Sample
Sp00f(OLD)/runtimes/win/lib/netcoreapp3.0/System.Runtime.WindowsRuntime.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
General
- Target Sp00f(NEW)/Add/bdfilters.dll
- Size 4.1MB
- Sample240712-rn77xaxcpm
- SHA256 9cbc29696ad2d582e251bf9c4be5cce618753fa43551d2474e1ae5cc5e1245e5
- MD5 ed730387fdcd684b756601b863c47417
- SHA1 c49ed6d0d46facf4ceaeb21f5d6bfdf9e3587fde
- SHA512 e32df727799d33922c6e92f94a7bdb0bc2772d6a6636d15e285d94d3ae4661062e5bc89ec3546b76ec853398f88d972f461327ef687f89093acf1096560d5c3f
- SSDEEP 98304:Xl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KChvvvveo:XuqYuQxqYfHYosUiJoviVKvvvvJ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies registry class 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\ = "Bandicam MPEG-1 Video Property" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\ = "Bandicam MPEG-1 Audio Decoder" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\FilterData = 02000000010080ff02000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000007669647300001000800000aa00389b714d50454700001000800000aa00389b714d50473100001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\CLSID = "{E2E7539A-CECF-4A6A-B187-939943ECEF05}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\FriendlyName = "Bandicam MPEG-1 Audio Decoder" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sp00f(NEW)\\Add\\bdfilters.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\ = "Bandicam MPEG-1 Audio Property" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\FriendlyName = "Bandicam MPEG-1 Video Decoder" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\FilterData = 02000000010080ff020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b715000000000001000800000aa00389b710100000000001000800000aa00389b71 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sp00f(NEW)\\Add\\bdfilters.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sp00f(NEW)\\Add\\bdfilters.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\ = "Bandicam MPEG-1 Video Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Sp00f(NEW)\\Add\\bdfilters.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\CLSID = "{89C4B786-A490-4A3E-AA70-E6A8C61D3689}" regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 456 wrote to memory of 3096 456 regsvr32.exe 83 PID 456 wrote to memory of 3096 456 regsvr32.exe 83 PID 456 wrote to memory of 3096 456 regsvr32.exe 83