Resubmissions
06/07/2022, 08:34 UTC
220706-kgpzescfa6 1010/02/2022, 17:15 UTC
220210-vst3maaehl 1010/02/2022, 17:13 UTC
220210-vrm8paaehk 1007/02/2022, 17:48 UTC
220207-wdjh1sfbd2 430/01/2022, 12:23 UTC
220130-pkf8xabfc3 3Analysis
-
max time kernel
139s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
10/02/2022, 17:15 UTC
General
-
Target
smphost.dll
-
Size
144KB
-
MD5
fc484855692f2a7d1eae090086a1eb72
-
SHA1
2e9103747750b40835f58d9e57c2ab75eeaf25f6
-
SHA256
e58b9bbb7bcdf3e901453b7b9c9e514fed1e53565e3280353dccc77cde26a98e
-
SHA512
2f6b6e8aa82dc4aa61a540bae1d98682ec79e73ccfeaf9c273b053c2162f35207842f7ab2f1bc06e927d706ec88ecf209d2c57e86323c38fb43e9d694e624311
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
Drops file in Windows directory 8 IoCs
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\smphost.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\smphost.dll2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 12523⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4268 -ip 42681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
Network
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse -
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
DNSmanageintel.comRemote address:8.8.8.8:53Requestmanageintel.comIN AResponse
-
72.21.81.240:80
-
72.21.81.240:80
-
8.8.8.8:53manageintel.comdns
DNS Request
manageintel.com
DNS Request
manageintel.com
DNS Request
manageintel.com
DNS Request
manageintel.com
-
8.8.8.8:53manageintel.comdns
DNS Request
manageintel.com
DNS Request
manageintel.com
DNS Request
manageintel.com
DNS Request
manageintel.com
-
8.8.8.8:53manageintel.comdns
DNS Request
manageintel.com
DNS Request
manageintel.com
DNS Request
manageintel.com
DNS Request
manageintel.com
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
16KB