Analysis
-
max time kernel
150s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07-12-2022 03:20
Behavioral task
behavioral1
Sample
9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe
Resource
win7-20220901-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe
-
Size
43KB
-
MD5
b8e9ef8d6bf4972d608489b534452cfd
-
SHA1
8a5f2646ab7d98ed5137c9edc0e748b930fe1c67
-
SHA256
9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e
-
SHA512
486e8b9956958166dbed170ef7bbe5170c5786588af130c47a9f737151aad7942cceac33dde61e306d295082cc51489261f2c8e58ec4f8379bdd815eb83a174d
-
SSDEEP
768:dBYFvsPzboLlriC1JWOTFkaP4mrDnnD3gRbcixa4i5YtyI++hf:d6tsPzkpri2acFjwRFxlXtyIZd
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\winlogon32.exe" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\winlogon32.exe" smss32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss32.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1552 smss32.exe -
resource yara_rule behavioral1/files/0x0008000000005c51-57.dat upx behavioral1/files/0x0008000000005c51-58.dat upx behavioral1/files/0x0008000000005c51-60.dat upx behavioral1/files/0x0008000000005c51-62.dat upx -
Loads dropped DLL 2 IoCs
pid Process 1708 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe 1708 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss32.exe = "C:\\Windows\\system32\\smss32.exe" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\smss32.exe = "C:\\Windows\\system32\\smss32.exe" smss32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss32.exe = "C:\\Windows\\system32\\smss32.exe" smss32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\smss32.exe = "C:\\Windows\\system32\\smss32.exe" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss32.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\smss32.exe 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe File created C:\Windows\SysWOW64\smss32.exe smss32.exe File opened for modification C:\Windows\SysWOW64\winlogon32.exe smss32.exe File opened for modification C:\Windows\SysWOW64\warnings.html smss32.exe File created C:\Windows\SysWOW64\helpers32.dll smss32.exe File created C:\Windows\SysWOW64\smss32.exe 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe File created C:\Windows\SysWOW64\winlogon32.exe 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe File created C:\Windows\SysWOW64\ES15.exe smss32.exe File created C:\Windows\SysWOW64\41.exe smss32.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter\Enabled = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter smss32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter\Enabled = "0" smss32.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" smss32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PhishingFilter 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" smss32.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\PhishingFilter smss32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe 1552 smss32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1552 smss32.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 1552 smss32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1552 1708 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe 27 PID 1708 wrote to memory of 1552 1708 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe 27 PID 1708 wrote to memory of 1552 1708 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe 27 PID 1708 wrote to memory of 1552 1708 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe 27 PID 1552 wrote to memory of 1684 1552 smss32.exe 30 PID 1552 wrote to memory of 1684 1552 smss32.exe 30 PID 1552 wrote to memory of 1684 1552 smss32.exe 30 PID 1552 wrote to memory of 1684 1552 smss32.exe 30 PID 1552 wrote to memory of 1684 1552 smss32.exe 30 PID 1552 wrote to memory of 1684 1552 smss32.exe 30 PID 1552 wrote to memory of 1684 1552 smss32.exe 30 -
System policy modification 1 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper = "1" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges = "1" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer smss32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges = "1" smss32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop = "1" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop smss32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper = "1" smss32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop = "1" smss32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe"C:\Users\Admin\AppData\Local\Temp\9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1708 -
C:\Windows\SysWOW64\smss32.exeC:\Windows\system32\smss32.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer Phishing Filter
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1552 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\system32\helpers32.dll3⤵PID:1684
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5b8e9ef8d6bf4972d608489b534452cfd
SHA18a5f2646ab7d98ed5137c9edc0e748b930fe1c67
SHA2569b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e
SHA512486e8b9956958166dbed170ef7bbe5170c5786588af130c47a9f737151aad7942cceac33dde61e306d295082cc51489261f2c8e58ec4f8379bdd815eb83a174d
-
Filesize
43KB
MD5b8e9ef8d6bf4972d608489b534452cfd
SHA18a5f2646ab7d98ed5137c9edc0e748b930fe1c67
SHA2569b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e
SHA512486e8b9956958166dbed170ef7bbe5170c5786588af130c47a9f737151aad7942cceac33dde61e306d295082cc51489261f2c8e58ec4f8379bdd815eb83a174d
-
Filesize
43KB
MD578f9a804146e0122f871bc8fda17b5d3
SHA1e17cc71850c38881840d41a23eafe43d208d27e8
SHA2566c78cd987afa58377801fbe4750f19410991d150ed7b75b0686dfe3d87d97a8d
SHA5129e9e17d3f4350cb7733c13ba3a910485c3b32e84385ac1d656cd38c87724165e8ce40b29561af6f965bfbe01f0da4c1123f7f7da65268ca794e535c75d339532
-
Filesize
43KB
MD5b8e9ef8d6bf4972d608489b534452cfd
SHA18a5f2646ab7d98ed5137c9edc0e748b930fe1c67
SHA2569b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e
SHA512486e8b9956958166dbed170ef7bbe5170c5786588af130c47a9f737151aad7942cceac33dde61e306d295082cc51489261f2c8e58ec4f8379bdd815eb83a174d
-
Filesize
43KB
MD5b8e9ef8d6bf4972d608489b534452cfd
SHA18a5f2646ab7d98ed5137c9edc0e748b930fe1c67
SHA2569b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e
SHA512486e8b9956958166dbed170ef7bbe5170c5786588af130c47a9f737151aad7942cceac33dde61e306d295082cc51489261f2c8e58ec4f8379bdd815eb83a174d