Analysis
-
max time kernel
35s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-02-2021 23:08
Static task
static1
Behavioral task
behavioral1
Sample
sm_dm.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
sm_dm.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
sm_dm.exe
-
Size
1.1MB
-
MD5
c6d7d65481b1679c236e240a3fe80403
-
SHA1
2baa37f6abd060642811f6c822cfcc9e0f8d6d14
-
SHA256
8053bd1a5c42eb7e76bc047d6cfd649b22fb5ea51fbfac5f1b4ed8714853148c
-
SHA512
90fca329eda51194a80d2f51929937d8da3663e76cf5abac9ef4dcd25f033b3e9aa366b9b176025a5475c3dde295d5bbf375a5c88e1bb585606084abb80d3605
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
sm_dm.exedescription ioc process File created C:\Windows\SysWOW64\mfc45.dat sm_dm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
sm_dm.exepid process 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
sm_dm.exepid process 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
sm_dm.exepid process 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
sm_dm.exepid process 3812 sm_dm.exe 3812 sm_dm.exe 3812 sm_dm.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3812-2-0x0000000000940000-0x0000000000941000-memory.dmpFilesize
4KB