Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 23:00
Behavioral task
behavioral1
Sample
3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe
Resource
win7-20240708-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe
-
Size
64KB
-
MD5
ba423cc966ae8f69bd093fc71b8e46ba
-
SHA1
d0087bc748dff59f79432a62619eeae8af2d67d4
-
SHA256
3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395
-
SHA512
ae8d783064d3b84ec390982cbe22e80d5f731f34179b7dd7e663c6ec98e8c627d3f917edbebfbe8f4b70b3ddf59293d55a7f2f164d62c81833bade67872b8e90
-
SSDEEP
1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIy:8g585LpPCrQt7F84IIIIIIIIIIIIIIIU
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolnx.exe" spoolnx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolnx.exe" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolnx.exe" spoolnx.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" spoolnx.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" spoolnx.exe -
resource yara_rule behavioral1/files/0x000b0000000120dc-6.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 3052 spoolnx.exe 2748 spoolnx.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\spoolnx.exe" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Perspective.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Thatch.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Default.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\LOOKUP.DAT spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBlankPage.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsFormTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\OUTFORM.DAT spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPrintTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ENGIDX.DAT spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Traditional.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PROTTPLN.DOC spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPrintTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewFrame.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Modern.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHLEX.DAT spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHSRN.DAT spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsMacroTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OSPP.HTM spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Fancy.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Distinctive.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Elegant.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsImageTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Classic.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplateRTL.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OUTLFLTR.DAT spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsMacroTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsVersion1Warning.htm spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsColorChart.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\JFONT.DAT spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsDoNotTrust.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\AccessWeb\CLNTWRAP.HTM spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Formal.dotx spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsColorChart.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ENGDIC.DAT spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHKEY.DAT spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewFrame.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsImageTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHPHN.DAT spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html spoolnx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html spoolnx.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewTemplate.html spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\OSPP.HTM spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Crack.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplate.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsColorChart.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplate.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsMacroTemplate.html spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\BearShare Pro 4.3.0 Crack.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Dragon NaturallySpeaking 8 ISO Multilanguage Keygen.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsVersion1Warning.htm spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBlankPage.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsImageTemplate.html spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplateRTL.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\BearShare Pro 4.3.0 Crack.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Keygen.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Crack.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Dragon NaturallySpeaking 8 ISO Multilanguage Keygen.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsVersion1Warning.htm spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplate.html spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplateRTL.html spoolnx.exe File opened for modification C:\Windows\spoolnx.exe 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\CLNTWRAP.HTM spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsColorChart.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Dragon NaturallySpeaking 8 ISO Multilanguage Crack.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBlankPage.html spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewTemplate.html spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplate.html spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplate.html spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsImageTemplate.html spoolnx.exe File created C:\Windows\spoolnx.exe spoolnx.exe File opened for modification C:\Windows\svchost.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Crack.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsHomePage.html spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsMacroTemplate.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplate.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Borland C++ BuilderX 1.0 Enterprise Edition Crack.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Crack.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsHomePage.html spoolnx.exe File created C:\Windows\spoolnx.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewFrame.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBrowserUpgrade.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe File created C:\Windows\message.dat spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Crack.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Crack.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewFrame.html spoolnx.exe File created C:\Windows\svchost.exe 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe File opened for modification C:\Windows\svchost.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Keygen.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Crack.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsDoNotTrust.html spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplateRTL.html spoolnx.exe File created C:\Windows\spoolnx.exe 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Borland C++ BuilderX 1.0 Enterprise Edition Crack.exe spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe spoolnx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBrowserUpgrade.html spoolnx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ spoolnx.exe File created C:\Windows\message.htm spoolnx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolnx.exe -
Modifies data under HKEY_USERS 47 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0 spoolnx.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WinXPLanguagePatch = "1" spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WordChangeInstallLanguage = "No" spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\LangTuneUp = "OfficeCompleted" spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common spoolnx.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\HelpFallback = 30003b0031003000330033000000 spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\XLChangeInstallLanguage = "No" spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\OneNoteChangeInstallLanguage = "No" spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office spoolnx.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UISnapshot = 31003000330033000000 spoolnx.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\HelpLanguage = "1033" spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\AccessChangeInstallLanguage = "No" spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\Software spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources spoolnx.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PreviousInstallLanguage = "1033" spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WebDesignerChangeInstallLanguage = "No" spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System spoolnx.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UILanguage = "1033" spoolnx.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\InstallLanguage = "1033" spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PPTChangeInstallLanguage = "No" spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\OutlookChangeInstallLanguage = "No" spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PublisherChangeInstallLanguage = "No" spoolnx.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies spoolnx.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b011fa34693cdb01 spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WordMailChangeInstallLanguage = "No" spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\SharePointDesignerChangeInstallLanguage = "No" spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft spoolnx.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources spoolnx.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UIFallback = 30003b0031003000330033000000 spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\ProjectChangeInstallLanguage = "No" spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages\1033 = "On" spoolnx.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Shared\OfficeUILanguage = "1033" spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem spoolnx.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\InfoPathChangeInstallLanguage = "No" spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles spoolnx.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT spoolnx.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2748 spoolnx.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2732 wrote to memory of 3052 2732 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe 30 PID 2732 wrote to memory of 3052 2732 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe 30 PID 2732 wrote to memory of 3052 2732 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe 30 PID 2732 wrote to memory of 3052 2732 3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe"C:\Users\Admin\AppData\Local\Temp\3d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Windows\spoolnx.exe"C:\Windows\spoolnx.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
PID:3052
-
-
C:\Windows\spoolnx.exeC:\Windows\spoolnx.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2748
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5d7d64fb3f02f8ee12e6b774220218848
SHA159939bce1b282aba1caaed625a3fecd4cd726073
SHA256f23c289bbe02b3d47af6045b1e2090ec57671650a383dc215f417217f63af77f
SHA512d82cda37f72280ea73be4cf68eb801a29e2f61296f97b558fc681607bef0a676579e801d97cbe5e7b6b54c44c157b26e1d41d32d683c74d19b27d4e05a9d7c28
-
Filesize
88KB
MD5cf6f0e29b5601c549dd8938a162d696f
SHA10b244cce6cd89a66816c1754e94c10bb86ee7a0e
SHA256a0b1ed3f48539dcabf47a467fc73c9b0737ffdc0b78adf052e989188f4096d4b
SHA5123f6d720e7139a317dcd61b0b272f07ae16a34dac5b401b2c8ac01c73b2b9ab9c5c1a0c3f3fec7eb5c1336e527ac439b14afec4ad058744dfa75d3f887e3c9cfe
-
Filesize
64KB
MD5ba423cc966ae8f69bd093fc71b8e46ba
SHA1d0087bc748dff59f79432a62619eeae8af2d67d4
SHA2563d4a9735c7f333b3e2018a0894465fc910195ce40253cb667abe42bcabd3d395
SHA512ae8d783064d3b84ec390982cbe22e80d5f731f34179b7dd7e663c6ec98e8c627d3f917edbebfbe8f4b70b3ddf59293d55a7f2f164d62c81833bade67872b8e90
-
Filesize
64KB
MD56860444c4d46015d0db63da7c5a2a91d
SHA1ba9b9933930eae859c0c6f5e02697ad11660c348
SHA2561ac5601c55749414547d88fcb211bb5082ca4e7ed0216e0cd684bc0d438c470c
SHA512c1267aec89715847c074368be7bac1420228e144ab3b4f199b1b129fde3b69f3e9ab7538a40019f38a7adbf1a054bbc1a5a61c598786b442c502f51deed51b4d