Overview

overview

9

Static

static

3

SpineSetup.exe

windows11-21h2-x64

9

SpineSetup.exe

windows11-ltsc_2024-x64

4

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...LL.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...fo.dll

windows11-21h2-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    SpineSetup.exe
  • Size 81.5MB
  • Sample260907-zn2n5avhrf
  • SHA256 025738ecd55dc804aa96099d0664e9d8f40ef36a6a368e98cb9a6fab70833a36
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryupx

Malware Config

Targets

    • Target
      SpineSetup.exe
    • Size 81.5MB
    • SHA256 025738ecd55dc804aa96099d0664e9d8f40ef36a6a368e98cb9a6fab70833a36
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoveryupx

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/LangDLL.dll
    • Size 5KB
    • SHA256 20e642707ef82852bcf153254cb94b629b93ee89a8e8a03f838eef6cbb493319
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/UserInfo.dll
    • Size 4KB
    • SHA256 afc939ebfd66a6c972d2d6bbcb978559ab3427d1582935e45392f9912ef186ad
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks