Analysis
-
max time kernel
98s -
max time network
152s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
06-01-2025 16:38
Behavioral task
behavioral1
Sample
SpyNote_v6.4/SpyNote.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
SpyNote_v6.4/SpyNote.exe
Resource
win11-20241007-en
windows11-21h2-x64
9 signatures
150 seconds
General
-
Target
SpyNote_v6.4/SpyNote.exe
-
Size
6.7MB
-
MD5
d9265f1d01fe8cfde1b241886e834a8c
-
SHA1
a5f29b1c2a6f981c246976de1ba7e053841aa562
-
SHA256
53f32f6ed5e1fbd5f5a29f83ab0eebc385f693824544fa4664242c91c7d9f1bf
-
SHA512
59fc93e2ba15e8c901216dd2108ddfc3f1b7fa954ba0cc903d684aa4a2353b295c7e5c9f8f20e744de743cff436fee5fd0e96ba1f156a0a681a275f20af85e6b
-
SSDEEP
196608:2dHPY7vsZ+oa4DuuyrMi8VKe+PMfw7k2c4PAVv1sUpr:+vfZ+IaLM9we+P2myds
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SpyNote.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SpyNote.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SpyNote.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000\Software\Microsoft\Internet Explorer\TypedURLs SpyNote.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe 2880 SpyNote.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1496 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2880 SpyNote.exe Token: SeDebugPrivilege 1496 taskmgr.exe Token: SeSystemProfilePrivilege 1496 taskmgr.exe Token: SeCreateGlobalPrivilege 1496 taskmgr.exe Token: 33 1496 taskmgr.exe Token: SeIncBasePriorityPrivilege 1496 taskmgr.exe -
Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe -
Suspicious use of SendNotifyMessage 46 IoCs
pid Process 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe 1496 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2880 SpyNote.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\SpyNote.exe"C:\Users\Admin\AppData\Local\Temp\SpyNote_v6.4\SpyNote.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2880
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1280
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1496