3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e

General

Target

3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
Size

135KB
MD5

15e9a069a20498412c490944960bda7f
SHA1

c766dea2e1ef3781d135a16ed78cc1674aaf3e50
SHA256

3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e
SHA512

211d5d0f32a7d98cdc6df8783534dc09f2946d2e1e84647ef0a20c04eaed1d5cbe0bb227ac97aa249a26dd9f03e37a4e0e9079a51a9f88f660b413fa7cb3edc4
SSDEEP

1536:VXUq5TXHN9l0jZZ8zjQqBbI2SbyGTJnUpgGDBOfII:VXx5TZ/bxGTJnUpgGFOfII

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\smss.exe"	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\smss = "C:\\Users\\Admin\\AppData\\Roaming\\smss.exe"	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\smss = "C:\\Users\\Admin\\AppData\\Roaming\\smss.exe"	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe

Executes dropped EXE 1 IoCs

Processes:

smss.exe

pid process

580 smss.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1920 netsh.exe

pid	process
580	smss.exe

pid	process
1920	netsh.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/588-54-0x0000000000400000-0x0000000000424000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\smss.exe	upx
\Users\Admin\AppData\Roaming\smss.exe	upx
\Users\Admin\AppData\Roaming\smss.exe	upx
behavioral1/memory/580-69-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/588-70-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/580-71-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/580-72-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe

pid	process
588	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
588	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "C:\\Users\\Admin\\AppData\\Roaming\\smss.exe"	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "C:\\Users\\Admin\\AppData\\Roaming\\smss.exe"	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

smss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	smss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	smss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec529030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	smss.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exesmss.exe

pid process

588 3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
580 smss.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe

description	pid	process	target process
PID 588 wrote to memory of 1920	588	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe	netsh.exe
PID 588 wrote to memory of 1920	588	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe	netsh.exe
PID 588 wrote to memory of 1920	588	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe	netsh.exe
PID 588 wrote to memory of 1920	588	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe	netsh.exe
PID 588 wrote to memory of 580	588	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe	smss.exe
PID 588 wrote to memory of 580	588	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe	smss.exe
PID 588 wrote to memory of 580	588	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe	smss.exe
PID 588 wrote to memory of 580	588	3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe	smss.exe

C:\Users\Admin\AppData\Local\Temp\3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
"C:\Users\Admin\AppData\Local\Temp\3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\smss.exe" CityScape Enable
2⤵
- Modifies Windows Firewall
PID:1920

C:\Users\Admin\AppData\Roaming\smss.exe
C:\Users\Admin\AppData\Local\Temp\3adf2f233271b62f5d2986eca2586f873ae02dffe376ee9e710ba5fafa366d3e.exe
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\smss.exe

Filesize
135KB

MD5
a8443b6c73b1abd35b899d7bf5737196

SHA1
65e5f831390fdcbbe49c11938dd68c21bcaa3304

SHA256
28b18ce5c338e5c23ea38719e42c7df4536017c64a554b3693ddbfa1a34db78f

SHA512
5debf3589285e6983b2ccfc5c025566cf6f5d3ee3b935b54415f007649ded15cef7c6e0eee974901a36f79e38f415d7ea32c12bad02729d1989e27ae4083e092

Download Submit
\Users\Admin\AppData\Roaming\smss.exe

Filesize
135KB

MD5
a8443b6c73b1abd35b899d7bf5737196

SHA1
65e5f831390fdcbbe49c11938dd68c21bcaa3304

SHA256
28b18ce5c338e5c23ea38719e42c7df4536017c64a554b3693ddbfa1a34db78f

SHA512
5debf3589285e6983b2ccfc5c025566cf6f5d3ee3b935b54415f007649ded15cef7c6e0eee974901a36f79e38f415d7ea32c12bad02729d1989e27ae4083e092

Download Submit
\Users\Admin\AppData\Roaming\smss.exe

Filesize
135KB

MD5
a8443b6c73b1abd35b899d7bf5737196

SHA1
65e5f831390fdcbbe49c11938dd68c21bcaa3304

SHA256
28b18ce5c338e5c23ea38719e42c7df4536017c64a554b3693ddbfa1a34db78f

SHA512
5debf3589285e6983b2ccfc5c025566cf6f5d3ee3b935b54415f007649ded15cef7c6e0eee974901a36f79e38f415d7ea32c12bad02729d1989e27ae4083e092

Download Submit
memory/580-61-0x0000000000000000-mapping.dmp

Download
memory/580-69-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/580-71-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/580-72-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/588-54-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/588-57-0x0000000076381000-0x0000000076383000-memory.dmp

Filesize
8KB

Download
memory/588-67-0x00000000003C0000-0x00000000003E4000-memory.dmp

Filesize
144KB

Download
memory/588-68-0x00000000003C0000-0x00000000003E4000-memory.dmp

Filesize
144KB

Download
memory/588-70-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1920-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads