67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35

General

Target

67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35.exe
Size

139KB
MD5

d1953176c75554cde4565d5a41650c61
SHA1

982a321d3f4ab6c8ca657719bcd265e6761e1cd3
SHA256

67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35
SHA512

85922ba0f4001f3cebd9f35ee2ad0548c5f5fd0ee2a6d0b07a8420c6adbeed71b5745faf5127232a17c936fea7863046b633477272d74bf8a2e3ec28137248f2
SSDEEP

3072:4KYHzAuzeCeW51ThnftcwaSOfepQo8whnOKexYy6zgF2:hC0CeWTZeMOO8w1OazgF2

Score

8^/10

evasion

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

smncs.exe

pid process

1388 smncs.exe

pid	process
1388	smncs.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35.exesmncs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	smncs.exe

Deletes itself 1 IoCs

Processes:

smncs.exe

pid process

1388 smncs.exe

pid	process
1388	smncs.exe

Drops file in System32 directory 1 IoCs

Processes:

smncs.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	smncs.exe

Drops file in Windows directory 2 IoCs

Processes:

67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35.exe

description	ioc	process
File created	C:\Windows\smncs.exe	67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35.exe
File opened for modification	C:\Windows\smncs.exe	67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

smncs.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FD67A828-E0A6-4111-9C7E-8B88EFA57FE6}\WpadDecisionTime = c0778e3a66ffd801	smncs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-a2-31-e8-59-73\WpadDecisionReason = "1"	smncs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	smncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	smncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	smncs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FD67A828-E0A6-4111-9C7E-8B88EFA57FE6}\WpadDecisionReason = "1"	smncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	smncs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0094000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smncs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FD67A828-E0A6-4111-9C7E-8B88EFA57FE6}\WpadNetworkName = "Network 3"	smncs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-a2-31-e8-59-73	smncs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	smncs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smncs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	smncs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	smncs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-a2-31-e8-59-73\WpadDecisionTime = c0778e3a66ffd801	smncs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FD67A828-E0A6-4111-9C7E-8B88EFA57FE6}\WpadDecision = "0"	smncs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\c2-a2-31-e8-59-73\WpadDecision = "0"	smncs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	smncs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	smncs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	smncs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FD67A828-E0A6-4111-9C7E-8B88EFA57FE6}	smncs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	smncs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smncs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FD67A828-E0A6-4111-9C7E-8B88EFA57FE6}\c2-a2-31-e8-59-73	smncs.exe

C:\Users\Admin\AppData\Local\Temp\67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35.exe
"C:\Users\Admin\AppData\Local\Temp\67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35.exe"
1⤵
- Looks for VMWare Tools registry key
- Drops file in Windows directory
PID:1360

C:\Windows\smncs.exe
"C:\Windows\smncs.exe"
1⤵
- Executes dropped EXE
- Looks for VMWare Tools registry key
- Deletes itself
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1388

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

1

T1012

Virtualization/Sandbox Evasion

1

T1497

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\smncs.exe
Filesize
139KB

MD5
d1953176c75554cde4565d5a41650c61

SHA1
982a321d3f4ab6c8ca657719bcd265e6761e1cd3

SHA256
67f022d2e02a41e685aef6d1ab4abfcb91286fb157c47de85f9dc973d9cf5c35

SHA512
85922ba0f4001f3cebd9f35ee2ad0548c5f5fd0ee2a6d0b07a8420c6adbeed71b5745faf5127232a17c936fea7863046b633477272d74bf8a2e3ec28137248f2

Download Submit
memory/1360-54-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1360-55-0x0000000000400000-0x000000000047F001-memory.dmp

Filesize
508KB

Download
memory/1388-58-0x0000000000400000-0x000000000047F001-memory.dmp

Filesize
508KB

Download
memory/1388-59-0x0000000000400000-0x000000000047F001-memory.dmp

Filesize
508KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads