smokeloader | cc0f6fa48f1bc9ffae208185fd4e568385a67c40a92a12c4a1bd00ad7adbb4b4

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

5cc21139c643e1d2299cf569e4d0ff98.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5cc21139c643e1d2299cf569e4d0ff98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5cc21139c643e1d2299cf569e4d0ff98.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5cc21139c643e1d2299cf569e4d0ff98.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

800 timeout.exe

pid	process
800	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5cc21139c643e1d2299cf569e4d0ff98.exe

pid	process
3840	5cc21139c643e1d2299cf569e4d0ff98.exe
3840	5cc21139c643e1d2299cf569e4d0ff98.exe
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3052
Suspicious behavior: MapViewOfSection 17 IoCs

Processes:

5cc21139c643e1d2299cf569e4d0ff98.exe

pid process

3840 5cc21139c643e1d2299cf569e4d0ff98.exe
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052
3052

pid	process
3052

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

D650.exeInstallUtil.exe

description	pid	process
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeDebugPrivilege	3204	D650.exe
Token: SeDebugPrivilege	1536	InstallUtil.exe
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052
Token: SeShutdownPrivilege	3052
Token: SeCreatePagefilePrivilege	3052

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

pid process

3052
3052
3052
3052
3052
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

pid process

3052
3052
3052

pid	process
3052
3052
3052
3052
3052

pid	process
3052
3052
3052

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

D650.execmd.exe

description	pid	process	target process
PID 3052 wrote to memory of 3204	3052		D650.exe
PID 3052 wrote to memory of 3204	3052		D650.exe
PID 3052 wrote to memory of 3204	3052		D650.exe
PID 3052 wrote to memory of 4180	3052		explorer.exe
PID 3052 wrote to memory of 4180	3052		explorer.exe
PID 3052 wrote to memory of 4180	3052		explorer.exe
PID 3052 wrote to memory of 4180	3052		explorer.exe
PID 3052 wrote to memory of 1676	3052		explorer.exe
PID 3052 wrote to memory of 1676	3052		explorer.exe
PID 3052 wrote to memory of 1676	3052		explorer.exe
PID 3052 wrote to memory of 2212	3052		explorer.exe
PID 3052 wrote to memory of 2212	3052		explorer.exe
PID 3052 wrote to memory of 2212	3052		explorer.exe
PID 3052 wrote to memory of 2212	3052		explorer.exe
PID 3052 wrote to memory of 4848	3052		explorer.exe
PID 3052 wrote to memory of 4848	3052		explorer.exe
PID 3052 wrote to memory of 4848	3052		explorer.exe
PID 3052 wrote to memory of 1988	3052		explorer.exe
PID 3052 wrote to memory of 1988	3052		explorer.exe
PID 3052 wrote to memory of 1988	3052		explorer.exe
PID 3052 wrote to memory of 1988	3052		explorer.exe
PID 3052 wrote to memory of 5052	3052		explorer.exe
PID 3052 wrote to memory of 5052	3052		explorer.exe
PID 3052 wrote to memory of 5052	3052		explorer.exe
PID 3052 wrote to memory of 5052	3052		explorer.exe
PID 3052 wrote to memory of 1944	3052		explorer.exe
PID 3052 wrote to memory of 1944	3052		explorer.exe
PID 3052 wrote to memory of 1944	3052		explorer.exe
PID 3052 wrote to memory of 5096	3052		explorer.exe
PID 3052 wrote to memory of 5096	3052		explorer.exe
PID 3052 wrote to memory of 5096	3052		explorer.exe
PID 3052 wrote to memory of 5096	3052		explorer.exe
PID 3204 wrote to memory of 4728	3204	D650.exe	cmd.exe
PID 3204 wrote to memory of 4728	3204	D650.exe	cmd.exe
PID 3204 wrote to memory of 4728	3204	D650.exe	cmd.exe
PID 4728 wrote to memory of 800	4728	cmd.exe	timeout.exe
PID 4728 wrote to memory of 800	4728	cmd.exe	timeout.exe
PID 4728 wrote to memory of 800	4728	cmd.exe	timeout.exe
PID 3204 wrote to memory of 1536	3204	D650.exe	InstallUtil.exe
PID 3204 wrote to memory of 1536	3204	D650.exe	InstallUtil.exe
PID 3204 wrote to memory of 1536	3204	D650.exe	InstallUtil.exe
PID 3204 wrote to memory of 1536	3204	D650.exe	InstallUtil.exe
PID 3204 wrote to memory of 1536	3204	D650.exe	InstallUtil.exe
PID 3204 wrote to memory of 1536	3204	D650.exe	InstallUtil.exe
PID 3204 wrote to memory of 1536	3204	D650.exe	InstallUtil.exe
PID 3204 wrote to memory of 1536	3204	D650.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\5cc21139c643e1d2299cf569e4d0ff98.exe
"C:\Users\Admin\AppData\Local\Temp\5cc21139c643e1d2299cf569e4d0ff98.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4844

C:\Users\Admin\AppData\Local\Temp\D650.exe
C:\Users\Admin\AppData\Local\Temp\D650.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3204

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 20
2⤵
- Suspicious use of WriteProcessMemory
PID:4728

C:\Windows\SysWOW64\timeout.exe
timeout 20
3⤵
- Delays execution with timeout.exe
PID:800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 876
2⤵
- Program crash
PID:4268

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1676

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4180 -ip 4180
1⤵
PID:4372

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4848

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1988

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5052

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1944

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:5096

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

4

System Information Discovery

5

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System