Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-04-2021 12:22
Static task
static1
Behavioral task
behavioral1
Sample
pax. ü 00163-2021.js
Resource
win7v20210408
Behavioral task
behavioral2
Sample
pax. ü 00163-2021.js
Resource
win10v20210410
General
-
Target
pax. ü 00163-2021.js
-
Size
66KB
-
MD5
0819eda4c8a833cb2ffd5c4f2a297fdc
-
SHA1
8b64c307ac3ae0e55ebc879528188257f16d2c80
-
SHA256
caabe0aa3bf3d3ffb2e90fde81869aeed004bf6f9f5182e43069e648f44df4a0
-
SHA512
270c3dec904d5f8eb1bbaeb9b5c497076953f39e154adf24daf18f36095bd3d59056717ee7e5dab2d0b10dbe67ddcec6db7a0e6357720ce3f1100652e3db5866
Malware Config
Extracted
smokeloader
2020
http://smbproperty.ru/
http://gmbshop.ru/
http://baksproperty.gov.ug/
http://magistralpsw.ru/
http://mpmanagertzz.ru/
http://powerglasspot.ru/
http://autopartswarehouses.ru/
http://memoloves.ru/
http://alfavanilin.ru/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3948 created 4068 3948 WerFault.exe vdshvar -
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 8 1824 wscript.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
601490.datvdshvarpid process 2168 601490.dat 4068 vdshvar -
Loads dropped DLL 1 IoCs
Processes:
601490.datpid process 2168 601490.dat -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3948 4068 WerFault.exe vdshvar -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
601490.datdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 601490.dat Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 601490.dat Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 601490.dat -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
601490.datpid process 2168 601490.dat 2168 601490.dat 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 1392 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1392 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
601490.datpid process 2168 601490.dat -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
WerFault.exedescription pid process Token: SeRestorePrivilege 3948 WerFault.exe Token: SeBackupPrivilege 3948 WerFault.exe Token: SeDebugPrivilege 3948 WerFault.exe Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 Token: SeShutdownPrivilege 1392 Token: SeCreatePagefilePrivilege 1392 -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 1392 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
wscript.exedescription pid process target process PID 1824 wrote to memory of 2168 1824 wscript.exe 601490.dat PID 1824 wrote to memory of 2168 1824 wscript.exe 601490.dat PID 1824 wrote to memory of 2168 1824 wscript.exe 601490.dat
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\pax. ü 00163-2021.js"1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\601490.datC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\601490.dat2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\vdshvarC:\Users\Admin\AppData\Roaming\vdshvar1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 2482⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\9419.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\601490.datMD5
c78d424eba64076d3af57b29b7602d25
SHA1c0a75b1e6c61f81f57d810b2cf74599038b51350
SHA2565d82b4f16469d125e3615431b1ccdbbf2decc388e1e3b417d2c0e12e0cca78f6
SHA512281fe544504c2f90c7938c2fd21c4ddfd95046f287e36cc5070a0504bd926ac04b728490317ddca93ebef705499efacda3c79b1e9873215a177238aeda2f2bdc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\601490.datMD5
c78d424eba64076d3af57b29b7602d25
SHA1c0a75b1e6c61f81f57d810b2cf74599038b51350
SHA2565d82b4f16469d125e3615431b1ccdbbf2decc388e1e3b417d2c0e12e0cca78f6
SHA512281fe544504c2f90c7938c2fd21c4ddfd95046f287e36cc5070a0504bd926ac04b728490317ddca93ebef705499efacda3c79b1e9873215a177238aeda2f2bdc
-
C:\Users\Admin\AppData\Roaming\vdshvarMD5
c78d424eba64076d3af57b29b7602d25
SHA1c0a75b1e6c61f81f57d810b2cf74599038b51350
SHA2565d82b4f16469d125e3615431b1ccdbbf2decc388e1e3b417d2c0e12e0cca78f6
SHA512281fe544504c2f90c7938c2fd21c4ddfd95046f287e36cc5070a0504bd926ac04b728490317ddca93ebef705499efacda3c79b1e9873215a177238aeda2f2bdc
-
C:\Users\Admin\AppData\Roaming\vdshvarMD5
c78d424eba64076d3af57b29b7602d25
SHA1c0a75b1e6c61f81f57d810b2cf74599038b51350
SHA2565d82b4f16469d125e3615431b1ccdbbf2decc388e1e3b417d2c0e12e0cca78f6
SHA512281fe544504c2f90c7938c2fd21c4ddfd95046f287e36cc5070a0504bd926ac04b728490317ddca93ebef705499efacda3c79b1e9873215a177238aeda2f2bdc
-
\Users\Admin\AppData\Local\Temp\9419.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
memory/1392-120-0x0000000000B30000-0x0000000000B46000-memory.dmpFilesize
88KB
-
memory/2168-114-0x0000000000000000-mapping.dmp
-
memory/2168-119-0x0000000000400000-0x0000000000835000-memory.dmpFilesize
4.2MB
-
memory/2168-118-0x00000000009A0000-0x00000000009AA000-memory.dmpFilesize
40KB
-
memory/4068-124-0x0000000000840000-0x00000000008EE000-memory.dmpFilesize
696KB
-
memory/4068-125-0x0000000000400000-0x0000000000835000-memory.dmpFilesize
4.2MB