ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400

Analysis

max time kernel
123s
max time network
126s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe
Size

724KB
MD5

43ae74d2f4f9c509c2a6f998a939bdd9
SHA1

e264a6199ea5cb590cd5f42f61cad36ce432cbeb
SHA256

ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400
SHA512

a6978fbc98aeeb405ac3573a62bb507a8f75cd4c59fe07e1762529cbcb0b07941ae22b61568b0274229dc0f98ffdb6a42d3f7a6e59045f707e0156ee14a6f60e
SSDEEP

12288:M3jrH/k8yJnIy/yJW5A+L2S03Ve+mlwI4+/kz/zc7Ab1id5QFJdvQz5h4tkbD:M33fk8fMyJW5A+vIUOInkz/zc7Abhdve

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
852	smss.exe

Deletes itself 1 IoCs

pid	Process
1260	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	smss.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\smss.exe	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe
File opened for modification	C:\Windows\smss.exe	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe
File created	C:\Windows\Delete.bat	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe

Modifies data under HKEY_USERS 37 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\WpadDecisionTime = e036e7236f07d901	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	smss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-b3-7d-48-0d-81\WpadDecisionReason = "1"	smss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	smss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\WpadDecisionReason = "1"	smss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-b3-7d-48-0d-81\WpadDetectedUrl	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	smss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\WpadNetworkName = "Network 2"	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-b3-7d-48-0d-81\WpadDecision = "0"	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-b3-7d-48-0d-81\WpadDecisionTime = e036e7236f07d901	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\WpadDecision = "0"	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\1e-b3-7d-48-0d-81	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\System	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CB1AA606-1E40-4F1E-AD52-3B08366C56A9}\WpadDecisionTime = a0c91ff36e07d901	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-b3-7d-48-0d-81	smss.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-b3-7d-48-0d-81\WpadDecisionTime = a0c91ff36e07d901	smss.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
852	smss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 1260	1324	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe	28
PID 1324 wrote to memory of 1260	1324	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe	28
PID 1324 wrote to memory of 1260	1324	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe	28
PID 1324 wrote to memory of 1260	1324	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe	28
PID 852 wrote to memory of 276	852	smss.exe	30
PID 852 wrote to memory of 276	852	smss.exe	30
PID 852 wrote to memory of 276	852	smss.exe	30
PID 852 wrote to memory of 276	852	smss.exe	30

C:\Users\Admin\AppData\Local\Temp\ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe
"C:\Users\Admin\AppData\Local\Temp\ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1324
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\Delete.bat
  2⤵
  - Deletes itself
  PID:1260

C:\Windows\smss.exe
C:\Windows\smss.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:276

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2e4
1⤵
PID:468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Delete.bat

Filesize
250B

MD5
5f672437065dee887c5c44ff0865b8e1

SHA1
4d443865c8c902921b8b483cb2439c76746e3cfe

SHA256
254aae03fff78942608d5fa5701607fdfdd754e840af033ff0659b4782647fd2

SHA512
ef706bf85174ca7b7e6d0dc7bd92e9c0d5efdc046a756b607813085397f7157b7e64bd7fd87d55ed20b4c8b6c437da50de68eaffb8a2d35f753ddf0cc9bf2b2f

Download Submit
C:\Windows\smss.exe

Filesize
724KB

MD5
43ae74d2f4f9c509c2a6f998a939bdd9

SHA1
e264a6199ea5cb590cd5f42f61cad36ce432cbeb

SHA256
ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400

SHA512
a6978fbc98aeeb405ac3573a62bb507a8f75cd4c59fe07e1762529cbcb0b07941ae22b61568b0274229dc0f98ffdb6a42d3f7a6e59045f707e0156ee14a6f60e

Download Submit
C:\Windows\smss.exe

Filesize
724KB

MD5
43ae74d2f4f9c509c2a6f998a939bdd9

SHA1
e264a6199ea5cb590cd5f42f61cad36ce432cbeb

SHA256
ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400

SHA512
a6978fbc98aeeb405ac3573a62bb507a8f75cd4c59fe07e1762529cbcb0b07941ae22b61568b0274229dc0f98ffdb6a42d3f7a6e59045f707e0156ee14a6f60e

Download Submit
memory/1324-54-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download