Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2024, 15:12
Behavioral task
behavioral1
Sample
ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe
Resource
win10v2004-20241007-en
General
-
Target
ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe
-
Size
64KB
-
MD5
4a76a4e930bec401bea9deb37512c9e0
-
SHA1
ddd938da715326a366b97d800698edac2fae4749
-
SHA256
ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017
-
SHA512
db6d5d9408eedc99f796173a6e4fc938810746b15e6176af780041fd74b39f119c127a21b4631230e59a695ccdfddca3aa57392bb1af9383b22716b8ac0c6200
-
SSDEEP
1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIII0:8g585LpPCrQt7F84IIIIIIIIIIIIIIIW
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolug.exe" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolug.exe" spoolug.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolug.exe" spoolug.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" spoolug.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" spoolug.exe -
resource yara_rule behavioral2/files/0x000c000000023b10-3.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 3216 spoolug.exe 4168 spoolug.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\spoolug.exe" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe -
Drops file in Windows directory 20 IoCs
description ioc Process File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe File created C:\Windows\spoolug.exe spoolug.exe File opened for modification C:\Windows\svchost.exe spoolug.exe File created C:\Windows\message.dat spoolug.exe File opened for modification C:\Windows\svchost.exe spoolug.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe spoolug.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe spoolug.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Crack.exe spoolug.exe File created C:\Windows\svchost.exe ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ spoolug.exe File created C:\Windows\spoolug.exe spoolug.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ spoolug.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe spoolug.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe spoolug.exe File created C:\Windows\spoolug.exe ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe File opened for modification C:\Windows\spoolug.exe ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe File created C:\Windows\message.htm spoolug.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Crack.exe spoolug.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NetObjects Fusion v7.5 Keygen.exe spoolug.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NetObjects Fusion v7.5 Keygen.exe spoolug.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolug.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolug.exe -
Modifies data under HKEY_USERS 13 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion spoolug.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 010000000000000069568a3f0339db01 spoolug.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" spoolug.exe Key created \REGISTRY\USER\.DEFAULT\Software spoolug.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft spoolug.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows spoolug.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached spoolug.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer spoolug.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "4" spoolug.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced spoolug.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System spoolug.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies spoolug.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" spoolug.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4168 spoolug.exe 4168 spoolug.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4504 wrote to memory of 3216 4504 ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe 83 PID 4504 wrote to memory of 3216 4504 ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe 83 PID 4504 wrote to memory of 3216 4504 ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe"C:\Users\Admin\AppData\Local\Temp\ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\spoolug.exe"C:\Windows\spoolug.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3216
-
-
C:\Windows\spoolug.exeC:\Windows\spoolug.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4168
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD54a76a4e930bec401bea9deb37512c9e0
SHA1ddd938da715326a366b97d800698edac2fae4749
SHA256ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017
SHA512db6d5d9408eedc99f796173a6e4fc938810746b15e6176af780041fd74b39f119c127a21b4631230e59a695ccdfddca3aa57392bb1af9383b22716b8ac0c6200