Resubmissions
13-01-2025 01:41
250113-b4f6csskhq 1012-01-2025 23:10
250112-254wxswpen 1012-01-2025 22:49
250112-2rs79stjbv 1012-01-2025 21:15
250112-z39y2szkaz 1012-01-2025 20:53
250112-zn9dzayndw 1012-01-2025 20:52
250112-zn8sfayndt 1012-01-2025 20:50
250112-zmy7lsymht 10Analysis
-
max time kernel
845s -
max time network
863s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
12-01-2025 21:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
13 signatures
900 seconds
General
-
Target
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
-
Size
136KB
-
MD5
bfb932c0c15243704cf27cb8c7eff520
-
SHA1
8c9e5e096e0f5855e435978b932d8ab63e859a29
-
SHA256
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214
-
SHA512
b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5
-
SSDEEP
3072:3LVoDvPd+A4WhkhXDl+i1lApwH08TdpIIIIIIIIIIIIIIIII/IIIIIIIIIIIIII/:ZopGGgbiwU8JY
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolev.exe" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolev.exe" spoolev.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolev.exe" spoolev.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (int) \REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" spoolev.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (int) \REGISTRY\USER\S-1-5-21-2366345620-3342093254-3461191856-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" spoolev.exe -
Executes dropped EXE 2 IoCs
pid Process 1960 spoolev.exe 3608 spoolev.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\spoolev.exe" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe -
Drops file in Windows directory 41 IoCs
description ioc Process File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Studio MX 2004 AllApps Crack.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Dragon NaturallySpeaking 8 ISO Multilanguage Crack.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 beta patch2 Crack.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe spoolev.exe File opened for modification C:\Windows\svchost.exe spoolev.exe File created C:\Windows\message.dat spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Keygen.exe spoolev.exe File created C:\Windows\spoolev.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe spoolev.exe File created C:\Windows\spoolev.exe spoolev.exe File created C:\Windows\message.htm spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Keygen.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 beta patch2 Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\iMesh 4.2 Ad Remover Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Studio MX 2004 AllApps Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Crack.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Keygen.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NetObjects Fusion v7.5 Crack.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe File opened for modification C:\Windows\svchost.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Dragon NaturallySpeaking 8 ISO Multilanguage Crack.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Crack.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Keygen.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NetObjects Fusion v7.5 Crack.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\iMesh 4.2 Ad Remover Crack.exe spoolev.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Crack.exe spoolev.exe File created C:\Windows\spoolev.exe f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe File created C:\Windows\svchost.exe f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Crack.exe spoolev.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Crack.exe spoolev.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolev.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolev.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced spoolev.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System spoolev.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" spoolev.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows spoolev.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion spoolev.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" spoolev.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer spoolev.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" spoolev.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" spoolev.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning" spoolev.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached spoolev.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000206dcb283965db01 spoolev.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" spoolev.exe Key created \REGISTRY\USER\.DEFAULT\Software spoolev.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft spoolev.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies spoolev.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" spoolev.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0" spoolev.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3608 spoolev.exe 3608 spoolev.exe 3608 spoolev.exe 3608 spoolev.exe 3608 spoolev.exe 3608 spoolev.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3536 wrote to memory of 1960 3536 f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe 83 PID 3536 wrote to memory of 1960 3536 f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe 83 PID 3536 wrote to memory of 1960 3536 f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe"C:\Users\Admin\AppData\Local\Temp\f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\spoolev.exe"C:\Windows\spoolev.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1960
-
-
C:\Windows\spoolev.exeC:\Windows\spoolev.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3608
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD577d165c0e88e9530805f67b34af8e0fc
SHA124abaa46043df0574282f82881714b71325ee019
SHA2564c3011efa8a9256e95252784c638c7ce5276584b150cbd05abacc0e571d5211b
SHA51244c4454660d44d6032cc80b197f101ae31dee672e8593d1edd8440cc5405e9407464c35aa91c8ddc2d890a5ae2650203704695f35e7d78ab49837249d9a24d0e
-
Filesize
136KB
MD5bfb932c0c15243704cf27cb8c7eff520
SHA18c9e5e096e0f5855e435978b932d8ab63e859a29
SHA256f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214
SHA512b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5