370abddcc90e3fe150dc4e57dcfc237a906cd328d209c9657fdd2db662285e28

Resubmissions

11/12/2024, 00:30

241211-at1ata1pdm 10

25/09/2024, 08:51

25/09/2024, 08:42

25/09/2024, 08:37

25/09/2024, 08:29

Analysis

max time kernel
48s
max time network
59s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
11/12/2024, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

spf.exe
Size

74.3MB
MD5

080f818c1eee78a599b8402962ee5593
SHA1

e929908842d65b784a2b98041fd563447e085c94
SHA256

370abddcc90e3fe150dc4e57dcfc237a906cd328d209c9657fdd2db662285e28
SHA512

f6e2acdc25824381e4108ce5cf30360020f16f2d2810bc9d47bc83e02d80b090e0f5b1d3f5f0fbbf318bccf0850e967e98a1755b5a467b44c97d4bdbe7a8cc0a
SSDEEP

1572864:UCF/QoAcEwBtXTjLnyn7PmhM2QbnzdLaXqVa:s/uD/Ia0JLat

Score

10^/10

evasion execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	spf.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	spf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\ImagePath	spf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	spf.exe

Power Settings 1 TTPs 14 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4440	cmd.exe
1352	cmd.exe
5184	powercfg.exe
3328	cmd.exe
3908	powercfg.exe
1680	powercfg.exe
1800	powercfg.exe
5160	powercfg.exe
5684	cmd.exe
5476	cmd.exe
4904	powercfg.exe
5616	cmd.exe
1568	powercfg.exe
4800	cmd.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5108	sc.exe
5364	sc.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
4464	taskkill.exe
4632	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3829776853-2076861744-2973657197-1000\SOFTWARE\Microsoft\Internet Explorer\Document Windows\z = 090000000000000000000000010000003f00000000000000ffffffff0000000000000000	spf.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1800	powercfg.exe
Token: SeCreatePagefilePrivilege	1800	powercfg.exe
Token: SeShutdownPrivilege	1800	powercfg.exe
Token: SeCreatePagefilePrivilege	1800	powercfg.exe
Token: SeShutdownPrivilege	4904	powercfg.exe
Token: SeCreatePagefilePrivilege	4904	powercfg.exe
Token: SeShutdownPrivilege	1568	powercfg.exe
Token: SeCreatePagefilePrivilege	1568	powercfg.exe
Token: SeShutdownPrivilege	5160	powercfg.exe
Token: SeCreatePagefilePrivilege	5160	powercfg.exe
Token: SeShutdownPrivilege	5184	powercfg.exe
Token: SeCreatePagefilePrivilege	5184	powercfg.exe
Token: SeShutdownPrivilege	3908	powercfg.exe
Token: SeCreatePagefilePrivilege	3908	powercfg.exe
Token: SeShutdownPrivilege	1680	powercfg.exe
Token: SeCreatePagefilePrivilege	1680	powercfg.exe
Token: SeDebugPrivilege	4632	taskkill.exe
Token: SeDebugPrivilege	4464	taskkill.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe
5352	spf.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5352 wrote to memory of 6104	5352	spf.exe	81
PID 5352 wrote to memory of 6104	5352	spf.exe	81
PID 6104 wrote to memory of 5364	6104	cmd.exe	83
PID 6104 wrote to memory of 5364	6104	cmd.exe	83
PID 5352 wrote to memory of 5188	5352	spf.exe	84
PID 5352 wrote to memory of 5188	5352	spf.exe	84
PID 5188 wrote to memory of 5108	5188	cmd.exe	86
PID 5188 wrote to memory of 5108	5188	cmd.exe	86
PID 5352 wrote to memory of 2004	5352	spf.exe	87
PID 5352 wrote to memory of 2004	5352	spf.exe	87
PID 2004 wrote to memory of 3120	2004	cmd.exe	89
PID 2004 wrote to memory of 3120	2004	cmd.exe	89
PID 5352 wrote to memory of 4800	5352	spf.exe	90
PID 5352 wrote to memory of 4800	5352	spf.exe	90
PID 4800 wrote to memory of 1800	4800	cmd.exe	92
PID 4800 wrote to memory of 1800	4800	cmd.exe	92
PID 5352 wrote to memory of 4440	5352	spf.exe	93
PID 5352 wrote to memory of 4440	5352	spf.exe	93
PID 4440 wrote to memory of 4904	4440	cmd.exe	95
PID 4440 wrote to memory of 4904	4440	cmd.exe	95
PID 5352 wrote to memory of 1352	5352	spf.exe	96
PID 5352 wrote to memory of 1352	5352	spf.exe	96
PID 1352 wrote to memory of 1568	1352	cmd.exe	98
PID 1352 wrote to memory of 1568	1352	cmd.exe	98
PID 5352 wrote to memory of 5616	5352	spf.exe	99
PID 5352 wrote to memory of 5616	5352	spf.exe	99
PID 5616 wrote to memory of 5160	5616	cmd.exe	101
PID 5616 wrote to memory of 5160	5616	cmd.exe	101
PID 5352 wrote to memory of 5684	5352	spf.exe	102
PID 5352 wrote to memory of 5684	5352	spf.exe	102
PID 5684 wrote to memory of 5184	5684	cmd.exe	104
PID 5684 wrote to memory of 5184	5684	cmd.exe	104
PID 5352 wrote to memory of 3328	5352	spf.exe	105
PID 5352 wrote to memory of 3328	5352	spf.exe	105
PID 3328 wrote to memory of 3908	3328	cmd.exe	107
PID 3328 wrote to memory of 3908	3328	cmd.exe	107
PID 5352 wrote to memory of 5476	5352	spf.exe	108
PID 5352 wrote to memory of 5476	5352	spf.exe	108
PID 5476 wrote to memory of 1680	5476	cmd.exe	110
PID 5476 wrote to memory of 1680	5476	cmd.exe	110
PID 5352 wrote to memory of 4668	5352	spf.exe	111
PID 5352 wrote to memory of 4668	5352	spf.exe	111
PID 5352 wrote to memory of 4632	5352	spf.exe	112
PID 5352 wrote to memory of 4632	5352	spf.exe	112
PID 5352 wrote to memory of 4464	5352	spf.exe	113
PID 5352 wrote to memory of 4464	5352	spf.exe	113

C:\Users\Admin\AppData\Local\Temp\spf.exe
"C:\Users\Admin\AppData\Local\Temp\spf.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C sc stop bam
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\system32\sc.exe
    sc stop bam
    3⤵
    - Launches sc.exe
    PID:5364
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C SC CONFIG "bam" START= DISABLED
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Windows\system32\sc.exe
    SC CONFIG "bam" START= DISABLED
    3⤵
    - Launches sc.exe
    PID:5108
- C:\Windows\SYSTEM32\cmd.exe
  cmd /C fsutil behavior set DisableLastAccess 3
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2004
- - C:\Windows\system32\fsutil.exe
    fsutil behavior set DisableLastAccess 3
    3⤵
    PID:3120
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /hibernate off
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\powercfg.exe
    powercfg /hibernate off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\system32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -disk-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\system32\powercfg.exe
    powercfg /x -disk-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -disk-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\Windows\system32\powercfg.exe
    powercfg /x -disk-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Windows\system32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /C powercfg /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\system32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1680
- C:\Windows\SYSTEM32\w32tm.exe
  w32tm /resync
  2⤵
  PID:4668
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM agent.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4632
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /F /IM battle.net.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5352-0-0x00007FFB16AF0000-0x00007FFB16AF2000-memory.dmp

Filesize
8KB

Download
memory/5352-3-0x00007FF6901D0000-0x00007FF6911D0000-memory.dmp

Filesize
16.0MB

Download
memory/5352-5-0x00007FFAD69A0000-0x00007FFAD69B0000-memory.dmp

Filesize
64KB

Download
memory/5352-6-0x00007FFAD69A0000-0x00007FFAD69B0000-memory.dmp

Filesize
64KB

Download
memory/5352-7-0x00007FFAD69A0000-0x00007FFAD69B0000-memory.dmp

Filesize
64KB

Download