e58b9bbb7bcdf3e901453b7b9c9e514fed1e53565e3280353dccc77cde26a98e

Target

smphost.dll
Size

144KB
MD5

fc484855692f2a7d1eae090086a1eb72
SHA1

2e9103747750b40835f58d9e57c2ab75eeaf25f6
SHA256

e58b9bbb7bcdf3e901453b7b9c9e514fed1e53565e3280353dccc77cde26a98e
SHA512

2f6b6e8aa82dc4aa61a540bae1d98682ec79e73ccfeaf9c273b053c2162f35207842f7ab2f1bc06e927d706ec88ecf209d2c57e86323c38fb43e9d694e624311

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 8 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

regsvr32.exe

pid process

1572 regsvr32.exe
1572 regsvr32.exe

pid	process
1572	regsvr32.exe
1572	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exeTiWorker.exe

description	pid	process
Token: SeShutdownPrivilege	1616	svchost.exe
Token: SeCreatePagefilePrivilege	1616	svchost.exe
Token: SeShutdownPrivilege	1616	svchost.exe
Token: SeCreatePagefilePrivilege	1616	svchost.exe
Token: SeShutdownPrivilege	1616	svchost.exe
Token: SeCreatePagefilePrivilege	1616	svchost.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe
Token: SeRestorePrivilege	4580	TiWorker.exe
Token: SeSecurityPrivilege	4580	TiWorker.exe
Token: SeBackupPrivilege	4580	TiWorker.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

regsvr32.exe

description	pid	process	target process
PID 2284 wrote to memory of 1572	2284	regsvr32.exe	regsvr32.exe
PID 2284 wrote to memory of 1572	2284	regsvr32.exe	regsvr32.exe
PID 2284 wrote to memory of 1572	2284	regsvr32.exe	regsvr32.exe

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\smphost.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\smphost.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4580

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1616-131-0x00000200C2790000-0x00000200C27A0000-memory.dmp

Filesize
64KB

Download
memory/1616-130-0x00000200C2730000-0x00000200C2740000-memory.dmp

Filesize
64KB

Download
memory/1616-132-0x00000200C5470000-0x00000200C5474000-memory.dmp

Filesize
16KB

Download