Resubmissions
13-01-2025 01:41
250113-b4f6csskhq 1012-01-2025 23:10
250112-254wxswpen 1012-01-2025 22:49
250112-2rs79stjbv 1012-01-2025 21:15
250112-z39y2szkaz 1012-01-2025 20:53
250112-zn9dzayndw 1012-01-2025 20:52
250112-zn8sfayndt 1012-01-2025 20:50
250112-zmy7lsymht 10Analysis
-
max time kernel
875s -
max time network
871s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
13-01-2025 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
14 signatures
900 seconds
General
-
Target
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
-
Size
136KB
-
MD5
bfb932c0c15243704cf27cb8c7eff520
-
SHA1
8c9e5e096e0f5855e435978b932d8ab63e859a29
-
SHA256
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214
-
SHA512
b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5
-
SSDEEP
3072:3LVoDvPd+A4WhkhXDl+i1lApwH08TdpIIIIIIIIIIIIIIIII/IIIIIIIIIIIIII/:ZopGGgbiwU8JY
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolvi.exe" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolvi.exe" spoolvi.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe spoolvi.exe" spoolvi.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (int) \REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" spoolvi.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (int) \REGISTRY\USER\S-1-5-21-3226857575-536881564-1522996248-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" spoolvi.exe -
Executes dropped EXE 2 IoCs
pid Process 3976 spoolvi.exe 3456 spoolvi.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\spoolvi.exe" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrdeush.dat spoolvi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\bwcapitalized.dotx spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHPHN.DAT spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.tree.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.tree.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\office32mui.msi.16.en-us.vreg.dat spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Beta.msix.DATA spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\hr.pak.DATA spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\kn.pak.DATA spoolvi.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\officemui.msi.16.en-us.tree.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.tree.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\az.pak.DATA spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\es-419.pak.DATA spoolvi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwritalm.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\powerpoint.x-none.msi.16.x-none.vreg.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\powerview.x-none.msi.16.x-none.vreg.dat spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\resources.pri.DATA spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\ca-Es-VALENCIA.pak.DATA spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\eu.pak.DATA spoolvi.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html spoolvi.exe File opened for modification C:\Program Files\SuspendBlock.docx spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\gu.pak.DATA spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.boot.tree.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx spoolvi.exe File opened for modification C:\Program Files\RestoreCompare.ods spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\kok.pak.DATA spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat spoolvi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat spoolvi.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\currency.data spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\OriginLetter.Dotx spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessReport.dotx spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\shaded.dotx spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\officemui.msi.16.en-us.vreg.dat spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\lo.pak.DATA spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.tree.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.boot.tree.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.boot.tree.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\office32ww.msi.16.x-none.vreg.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHKEY.DAT spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\osm.x-none.msi.16.x-none.vreg.dat spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\msedge_7z.data spoolvi.exe File opened for modification C:\Program Files\ConfirmStop.mhtml spoolvi.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\tzdb.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLFLTR.DAT spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessResume.dotx spoolvi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrdeusymnn.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Stable.msix.DATA spoolvi.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\cs.pak.DATA spoolvi.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\public_suffix_list.dat spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC spoolvi.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\minimalist.dotx spoolvi.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryResume.dotx spoolvi.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\MCABOUT.HTM spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\browse_window.html spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\stream_window.html spoolvi.exe File created C:\Windows\spoolvi.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Crack.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\stream_config_window.html spoolvi.exe File created C:\Windows\groups.dat spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 beta patch2 Keygen.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\create_stream.html spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\vlm.html spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ConvertToDisable.rar.pif spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Keygen.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile_equalizer.html spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Welcome.html spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.zip.pif spoolvi.exe File created C:\Windows\spoolvi.exe spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Crack.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Crack.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ConvertToDisable.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.exe spoolvi.exe File created C:\Windows\spoolvi.exe f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\index.html spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NetObjects Fusion v7.5 Crack.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mosaic_window.html spoolvi.exe File created C:\Windows\message.htm spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Studio MX 2004 AllApps Crack.exe spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\index.html spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Crack.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\batch_window.html spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\error_window.html spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Crack.exe spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Keygen.exe spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ReadMe.htm spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Keygen.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NetObjects Fusion v7.5 Crack.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Keygen.exe spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Welcome.html spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\vlm_export.html spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.zip.exe spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ spoolvi.exe File created C:\Windows\message.dat spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ConfirmStop.mhtml spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ConvertToDisable.rar.pif spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.zip.exe spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\equalizer_window.html spoolvi.exe File opened for modification C:\Windows\svchost.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\OSPP.HTM spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile.html spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile_browse.html spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile_view.html spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\view.html spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ConvertToDisable.exe spoolvi.exe File opened for modification C:\Windows\svchost.exe spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Crack.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.zip.pif spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\license.html spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\README.HTM spoolvi.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 beta patch2 Keygen.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe spoolvi.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\README.html spoolvi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolvi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolvi.exe -
Modifies data under HKEY_USERS 18 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced spoolvi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" spoolvi.exe Key created \REGISTRY\USER\.DEFAULT\Software spoolvi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies spoolvi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" spoolvi.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@%SystemRoot%\System32\urlmon.dll,-4200 = "Open File - Security Warning" spoolvi.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000f0ccc3d15c65db01 spoolvi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer spoolvi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows spoolvi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion spoolvi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" spoolvi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" spoolvi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" spoolvi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System spoolvi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft spoolvi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" spoolvi.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached spoolvi.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "4" spoolvi.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3456 spoolvi.exe 3456 spoolvi.exe 3456 spoolvi.exe 3456 spoolvi.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3600 wrote to memory of 3976 3600 f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe 80 PID 3600 wrote to memory of 3976 3600 f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe 80 PID 3600 wrote to memory of 3976 3600 f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe"C:\Users\Admin\AppData\Local\Temp\f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\spoolvi.exe"C:\Windows\spoolvi.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3976
-
-
C:\Windows\spoolvi.exeC:\Windows\spoolvi.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3456
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5d425c0d81ed1d64ff6cdaeab6135d13b
SHA104c157bbad16ade87434cd47240f4cd58e2573bf
SHA25625930361a7b344115158dafca7bc78c9f44439e63c334270a4e308c74cdd8093
SHA5128387c95e4f07963ce69e4525928d743bf198f00bb4bd7f65314beb5ecf0511574d714bb46ae27d28da3b38c5017410423408e1c04259c42838aa71d41de67d85
-
Filesize
187KB
MD531bb87b5c3ff0040a09b92560c7fc415
SHA16ec27b05f97685e4b85071889fbd7baba349d382
SHA25604fb229c9ad4ae166e9973ecd7b2f09e5c8d997b14930582988810250274bdd2
SHA5127fe2f98a32ad391fe2e0c7076d542c4e49db4f6a90b1a2f8d0ddf13f5f401e05849e90664f3a5cd3a264730110de1fb283295d624595d02b5fb90657a1c6c6b1
-
Filesize
187KB
MD577e498263723ecdebc74ea1027910e40
SHA1dd34b3abe5d91890f3999a6570cf429bd3719b70
SHA256d45bbbe3394170258848b1fed788e0bca84224e36f78d0f5442869bf0dbac56d
SHA512195a05f75134b9826d4771055547065773849cd21dfa09afcbebcbeb27093e20d6b7a4047e5f03d9f47bea6a08709bcdba01e7f38d53be1ddc86bd7207a53396
-
Filesize
136KB
MD5bfb932c0c15243704cf27cb8c7eff520
SHA18c9e5e096e0f5855e435978b932d8ab63e859a29
SHA256f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214
SHA512b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5