ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400

Analysis

max time kernel
138s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 17:26

Target

ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe
Size

724KB
MD5

43ae74d2f4f9c509c2a6f998a939bdd9
SHA1

e264a6199ea5cb590cd5f42f61cad36ce432cbeb
SHA256

ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400
SHA512

a6978fbc98aeeb405ac3573a62bb507a8f75cd4c59fe07e1762529cbcb0b07941ae22b61568b0274229dc0f98ffdb6a42d3f7a6e59045f707e0156ee14a6f60e
SSDEEP

12288:M3jrH/k8yJnIy/yJW5A+L2S03Ve+mlwI4+/kz/zc7Ab1id5QFJdvQz5h4tkbD:M33fk8fMyJW5A+vIUOInkz/zc7Abhdve

Score

8^/10

Executes dropped EXE 1 IoCs

pid	Process
3472	smss.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\smss.exe	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe
File opened for modification	C:\Windows\smss.exe	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe
File created	C:\Windows\Delete.bat	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	smss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	smss.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	smss.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3472	smss.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 756	3472	smss.exe	80
PID 3472 wrote to memory of 756	3472	smss.exe	80
PID 1060 wrote to memory of 2368	1060	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe	81
PID 1060 wrote to memory of 2368	1060	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe	81
PID 1060 wrote to memory of 2368	1060	ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe	81

C:\Users\Admin\AppData\Local\Temp\ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe
"C:\Users\Admin\AppData\Local\Temp\ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\Delete.bat
  2⤵
  PID:2368

C:\Windows\smss.exe
C:\Windows\smss.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:756

C:\Windows\Delete.bat

Filesize
250B

MD5
5f672437065dee887c5c44ff0865b8e1

SHA1
4d443865c8c902921b8b483cb2439c76746e3cfe

SHA256
254aae03fff78942608d5fa5701607fdfdd754e840af033ff0659b4782647fd2

SHA512
ef706bf85174ca7b7e6d0dc7bd92e9c0d5efdc046a756b607813085397f7157b7e64bd7fd87d55ed20b4c8b6c437da50de68eaffb8a2d35f753ddf0cc9bf2b2f

Download Submit
C:\Windows\smss.exe

Filesize
724KB

MD5
43ae74d2f4f9c509c2a6f998a939bdd9

SHA1
e264a6199ea5cb590cd5f42f61cad36ce432cbeb

SHA256
ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400

SHA512
a6978fbc98aeeb405ac3573a62bb507a8f75cd4c59fe07e1762529cbcb0b07941ae22b61568b0274229dc0f98ffdb6a42d3f7a6e59045f707e0156ee14a6f60e

Download Submit
C:\Windows\smss.exe

Filesize
724KB

MD5
43ae74d2f4f9c509c2a6f998a939bdd9

SHA1
e264a6199ea5cb590cd5f42f61cad36ce432cbeb

SHA256
ce28bf0a884fb23e5a5db018a758301b458d4ce28e57e565aa53ca7b6526c400

SHA512
a6978fbc98aeeb405ac3573a62bb507a8f75cd4c59fe07e1762529cbcb0b07941ae22b61568b0274229dc0f98ffdb6a42d3f7a6e59045f707e0156ee14a6f60e

Download Submit