Resubmissions
06-07-2022 08:34
220706-kgpzescfa6 1010-02-2022 17:15
220210-vst3maaehl 1010-02-2022 17:13
220210-vrm8paaehk 1007-02-2022 17:48
220207-wdjh1sfbd2 430-01-2022 12:23
220130-pkf8xabfc3 3Analysis
-
max time kernel
139s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
10-02-2022 17:15
Static task
static1
Behavioral task
behavioral1
Sample
smphost.dll
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
smphost.dll
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
smphost.dll
-
Size
144KB
-
MD5
fc484855692f2a7d1eae090086a1eb72
-
SHA1
2e9103747750b40835f58d9e57c2ab75eeaf25f6
-
SHA256
e58b9bbb7bcdf3e901453b7b9c9e514fed1e53565e3280353dccc77cde26a98e
-
SHA512
2f6b6e8aa82dc4aa61a540bae1d98682ec79e73ccfeaf9c273b053c2162f35207842f7ab2f1bc06e927d706ec88ecf209d2c57e86323c38fb43e9d694e624311
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid Process procid_target PID 3384 created 4268 3384 WerFault.exe 81 -
Drops file in Windows directory 8 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 4432 4268 WerFault.exe 81 -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exedescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
regsvr32.exeWerFault.exepid Process 4268 regsvr32.exe 4268 regsvr32.exe 4432 WerFault.exe 4432 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exeTiWorker.exedescription pid Process Token: SeShutdownPrivilege 2264 svchost.exe Token: SeCreatePagefilePrivilege 2264 svchost.exe Token: SeShutdownPrivilege 2264 svchost.exe Token: SeCreatePagefilePrivilege 2264 svchost.exe Token: SeShutdownPrivilege 2264 svchost.exe Token: SeCreatePagefilePrivilege 2264 svchost.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe Token: SeRestorePrivilege 384 TiWorker.exe Token: SeSecurityPrivilege 384 TiWorker.exe Token: SeBackupPrivilege 384 TiWorker.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
regsvr32.exeWerFault.exedescription pid Process procid_target PID 5036 wrote to memory of 4268 5036 regsvr32.exe 81 PID 5036 wrote to memory of 4268 5036 regsvr32.exe 81 PID 5036 wrote to memory of 4268 5036 regsvr32.exe 81 PID 3384 wrote to memory of 4268 3384 WerFault.exe 81 PID 3384 wrote to memory of 4268 3384 WerFault.exe 81
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\smphost.dll1⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\smphost.dll2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 12523⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
PID:4432
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4268 -ip 42681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:3384