Analysis
- user interaction
yes - max time kernel
150s - max time network
123s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/10/2026, 22:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
spoolsv.exe
Resource
win11-20260911-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target spoolsv.exe
- Size 135KB
- Sample261022-2lnetsav6n
- SHA256 819a563e1f8ff45db39351bcbde8974c2d7275854a351189e50c4968236eee06
- MD5 c4e86419bb4561b72a644c16e05d634c
- SHA1 71b1fbd911583780b71f455f07adbe096337c946
- SHA512 33131633a16ac1d939f96cb229825254889278dfc3cad4ff700e7913a74d216c6fc793cfc83d96c808265ab4bd5fd096ef9087cdc25f28121efd9ea993606041
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVL+HN:UVqoCl/YgjxEufVU0TbTyDDal+N
- TLSH T1DFD30823BE10603EEA21C5F068E9E67DB9625E361BD0AD076757B74429B620776F030F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1570888168-524493533-3242721904-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" svchost.exe - Executes a file named after a Windows system binary 1 TTPs 2 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
description ioc Process File opened (read-only) C:\Users\Admin\AppData\Local\Temp\spoolsv.exe spoolsv.exe File opened (read-only) \??\c:\users\admin\appdata\local\temp\spoolsv.exe spoolsv.exe - Executes dropped EXE 4 IoCs
pid Process 1756 explorer.exe 3324 spoolsv.exe 4960 svchost.exe 6108 spoolsv.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO" svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\windows\resources\svchost.exe spoolsv.exe File opened for modification C:\Windows\Resources\tjud.exe explorer.exe File opened for modification \??\c:\windows\resources\themes\explorer.exe spoolsv.exe File opened for modification \??\c:\windows\resources\spoolsv.exe explorer.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 4928 spoolsv.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe 1756 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1756 explorer.exe 4960 svchost.exe - Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4928 spoolsv.exe 4928 spoolsv.exe 1756 explorer.exe 1756 explorer.exe 3324 spoolsv.exe 3324 spoolsv.exe 4960 svchost.exe 4960 svchost.exe 6108 spoolsv.exe 6108 spoolsv.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4928 wrote to memory of 1756 4928 spoolsv.exe 81 PID 1756 wrote to memory of 3324 1756 explorer.exe 82 PID 3324 wrote to memory of 4960 3324 spoolsv.exe 83 PID 4960 wrote to memory of 6108 4960 svchost.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\spoolsv.exe"C:\Users\Admin\AppData\Local\Temp\spoolsv.exe"1⤵
- Executes a file named after a Windows system binary
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visibility of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6108
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\Resources\Themes\explorer.exe
- Size 135KB
- SHA256 86d914f6a5da142d66a08a41551868537b219e1119d588e64fd48b2a3b8c9899
- MD5 43cd3e6a12a01655f95b6f7f301b9ef8
- SHA1 939ecc946acd25a4dd7e0364c74376527825c64a
- SHA512 8a8d88fccc7d7c1b5f834f38f7ab8ced8b439666dc92283276dad794be6d5a3873bc9445cf01f741242410fe320b6d50bf10397750d7e869fd2007ae8acdb70a
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVL+HQ:UVqoCl/YgjxEufVU0TbTyDDal+Q
- TLSH T11CD32A23BE1124BFC5118AF168E4E66F7A111E6A2BE1AD073262BF20757254775F230F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\spoolsv.exe
- Size 135KB
- SHA256 98055ea61c72f8b23a69edfc61d870138f2c11314beb7ff4cc417de06250f2e2
- MD5 2a36807ce1f02780242a1c93375ef1ea
- SHA1 ce71f91a1a24356da65a1126a2cfb52c9aaa0cf3
- SHA512 765b51e50ef2ec59b762a07dabe9427a3220572efd3074d33c5c7b2dd00cd179adcd9e5264be0b246f0b419c619c9549b741bfb1e2ae593225055d55412ee517
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVL+Hd:UVqoCl/YgjxEufVU0TbTyDDal+d
- TLSH T1CFD30923BE10542FDD1189F128A9D67EF9256E3A1BF1AC5773A2B70022B1203B5F465F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Resources\svchost.exe
- Size 135KB
- SHA256 4106281ea174fd70fc1ae4854c6cecfcbe4f4cbc6bd8f54e578099f4cf04fc4e
- MD5 3a5d7e42ef7959a25c2f2bac280d296c
- SHA1 78e259bb5174c0e8ceab1e2a6701668c50ac8361
- SHA512 5e78af3097bd73a0b8f9a283f332d9113b5ffbc3b6f9f15c4b9c908d11c154b948d2060bd84b64a560cd34af960df63038109d80a5abbd7f002b01ac9c1fb53d
- SSDEEP 1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVL+Ht:UVqoCl/YgjxEufVU0TbTyDDal+t
- TLSH T1D4D31933BF00542EE82186F218A5DE6EBA185E3657A1ED177777BB142A7210372F121F
- MD5 SHA1 SHA512 SSDEEP TLSH