Analysis
-
max time kernel
154s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
07-12-2022 03:20
Behavioral task
behavioral1
Sample
9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe
Resource
win7-20220901-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe
-
Size
43KB
-
MD5
b8e9ef8d6bf4972d608489b534452cfd
-
SHA1
8a5f2646ab7d98ed5137c9edc0e748b930fe1c67
-
SHA256
9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e
-
SHA512
486e8b9956958166dbed170ef7bbe5170c5786588af130c47a9f737151aad7942cceac33dde61e306d295082cc51489261f2c8e58ec4f8379bdd815eb83a174d
-
SSDEEP
768:dBYFvsPzboLlriC1JWOTFkaP4mrDnnD3gRbcixa4i5YtyI++hf:d6tsPzkpri2acFjwRFxlXtyIZd
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\winlogon32.exe" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\winlogon32.exe" smss32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss32.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 3572 smss32.exe -
resource yara_rule behavioral2/memory/344-132-0x0000000000400000-0x000000000041D000-memory.dmp upx behavioral2/files/0x000200000001e704-136.dat upx behavioral2/files/0x000200000001e704-137.dat upx behavioral2/files/0x000200000001e705-138.dat upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss32.exe = "C:\\Windows\\system32\\smss32.exe" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe = "C:\\Windows\\system32\\smss32.exe" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss32.exe = "C:\\Windows\\system32\\smss32.exe" smss32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss32.exe = "C:\\Windows\\system32\\smss32.exe" smss32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss32.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\smss32.exe 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe File created C:\Windows\SysWOW64\smss32.exe smss32.exe File opened for modification C:\Windows\SysWOW64\winlogon32.exe smss32.exe File created C:\Windows\SysWOW64\helpers32.dll smss32.exe File created C:\Windows\SysWOW64\ES15.exe smss32.exe File created C:\Windows\SysWOW64\41.exe smss32.exe File created C:\Windows\SysWOW64\smss32.exe 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe File created C:\Windows\SysWOW64\winlogon32.exe 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe File opened for modification C:\Windows\SysWOW64\warnings.html smss32.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" smss32.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\PhishingFilter smss32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\PhishingFilter 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\Enabled = "0" smss32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\PhishingFilter smss32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" smss32.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\Enabled = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV8 = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\PhishingFilter 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe 3572 smss32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3572 smss32.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3572 smss32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 344 wrote to memory of 3572 344 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe 83 PID 344 wrote to memory of 3572 344 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe 83 PID 344 wrote to memory of 3572 344 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe 83 PID 3572 wrote to memory of 2464 3572 smss32.exe 86 PID 3572 wrote to memory of 2464 3572 smss32.exe 86 PID 3572 wrote to memory of 2464 3572 smss32.exe 86 -
System policy modification 1 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges = "1" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System smss32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" smss32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop smss32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer smss32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop = "1" smss32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop = "1" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper = "1" 9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper = "1" smss32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges = "1" smss32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe"C:\Users\Admin\AppData\Local\Temp\9b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer Phishing Filter
- Suspicious use of WriteProcessMemory
- System policy modification
PID:344 -
C:\Windows\SysWOW64\smss32.exeC:\Windows\system32\smss32.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Modifies Internet Explorer Phishing Filter
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3572 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\system32\helpers32.dll3⤵PID:2464
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD5b8e9ef8d6bf4972d608489b534452cfd
SHA18a5f2646ab7d98ed5137c9edc0e748b930fe1c67
SHA2569b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e
SHA512486e8b9956958166dbed170ef7bbe5170c5786588af130c47a9f737151aad7942cceac33dde61e306d295082cc51489261f2c8e58ec4f8379bdd815eb83a174d
-
Filesize
43KB
MD5b8e9ef8d6bf4972d608489b534452cfd
SHA18a5f2646ab7d98ed5137c9edc0e748b930fe1c67
SHA2569b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e
SHA512486e8b9956958166dbed170ef7bbe5170c5786588af130c47a9f737151aad7942cceac33dde61e306d295082cc51489261f2c8e58ec4f8379bdd815eb83a174d
-
Filesize
43KB
MD5b8e9ef8d6bf4972d608489b534452cfd
SHA18a5f2646ab7d98ed5137c9edc0e748b930fe1c67
SHA2569b932af0c798ea2b64c86bb9fbaf4f669658a97a61b45756402dbb03f274402e
SHA512486e8b9956958166dbed170ef7bbe5170c5786588af130c47a9f737151aad7942cceac33dde61e306d295082cc51489261f2c8e58ec4f8379bdd815eb83a174d