05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811

General

Target

05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe
Size

7KB
MD5

d9bfd1caca84f02354f09c2ad79bedbb
SHA1

03d7b1d70bb1082a458f1ffef79352aa5d3df91f
SHA256

05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811
SHA512

b248958d1cc54f9072d15d7c22b14444f13002182d09ad54906c3d55ee3bf9b104d3401a89872994fe845e2a0fc8a0c97ea9887b6396134644638e6ecaabaa84
SSDEEP

192:5SnF94LYGs/Gr5L/r/iGuUJbAIMwyS5krn:5SHssW5L/GGuUJbAsmrn

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1972	smss.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1944-54-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-55.dat	upx
behavioral1/files/0x0007000000005c50-58.dat	upx
behavioral1/files/0x0007000000005c50-56.dat	upx
behavioral1/files/0x0007000000005c50-59.dat	upx
behavioral1/memory/1944-60-0x0000000000280000-0x000000000028A000-memory.dmp	upx
behavioral1/memory/1972-62-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1944-65-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/1972-66-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1340	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe
1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\system\smss.exe	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe
File opened for modification	C:\WINDOWS\system\smss.exe	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe
File opened for modification	C:\WINDOWS\system\windows.log	smss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1972	1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	26
PID 1944 wrote to memory of 1972	1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	26
PID 1944 wrote to memory of 1972	1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	26
PID 1944 wrote to memory of 1972	1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	26
PID 1944 wrote to memory of 1340	1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	28
PID 1944 wrote to memory of 1340	1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	28
PID 1944 wrote to memory of 1340	1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	28
PID 1944 wrote to memory of 1340	1944	05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe	28

C:\Users\Admin\AppData\Local\Temp\05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe
"C:\Users\Admin\AppData\Local\Temp\05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1944
- C:\WINDOWS\system\smss.exe
  C:\WINDOWS\system\smss.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\05D054~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1340

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\system\smss.exe

Filesize
7KB

MD5
d9bfd1caca84f02354f09c2ad79bedbb

SHA1
03d7b1d70bb1082a458f1ffef79352aa5d3df91f

SHA256
05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811

SHA512
b248958d1cc54f9072d15d7c22b14444f13002182d09ad54906c3d55ee3bf9b104d3401a89872994fe845e2a0fc8a0c97ea9887b6396134644638e6ecaabaa84

Download Submit
C:\Windows\system\smss.exe

Filesize
7KB

MD5
d9bfd1caca84f02354f09c2ad79bedbb

SHA1
03d7b1d70bb1082a458f1ffef79352aa5d3df91f

SHA256
05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811

SHA512
b248958d1cc54f9072d15d7c22b14444f13002182d09ad54906c3d55ee3bf9b104d3401a89872994fe845e2a0fc8a0c97ea9887b6396134644638e6ecaabaa84

Download Submit
\Windows\system\smss.exe

Filesize
7KB

MD5
d9bfd1caca84f02354f09c2ad79bedbb

SHA1
03d7b1d70bb1082a458f1ffef79352aa5d3df91f

SHA256
05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811

SHA512
b248958d1cc54f9072d15d7c22b14444f13002182d09ad54906c3d55ee3bf9b104d3401a89872994fe845e2a0fc8a0c97ea9887b6396134644638e6ecaabaa84

Download Submit
\Windows\system\smss.exe

Filesize
7KB

MD5
d9bfd1caca84f02354f09c2ad79bedbb

SHA1
03d7b1d70bb1082a458f1ffef79352aa5d3df91f

SHA256
05d054dcc9cd7eeabaebedcedba9c4f6bdee96c4b5d96f987e6f7f2dc2bcc811

SHA512
b248958d1cc54f9072d15d7c22b14444f13002182d09ad54906c3d55ee3bf9b104d3401a89872994fe845e2a0fc8a0c97ea9887b6396134644638e6ecaabaa84

Download Submit
memory/1944-54-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1944-60-0x0000000000280000-0x000000000028A000-memory.dmp

Filesize
40KB

Download
memory/1944-61-0x0000000000280000-0x000000000028A000-memory.dmp

Filesize
40KB

Download
memory/1944-65-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1972-63-0x0000000076141000-0x0000000076143000-memory.dmp

Filesize
8KB

Download
memory/1972-62-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1972-66-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing