Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
16/12/2022, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target file.exe
- Size 213KB
- Sample221216-ttnfssfa58
- SHA256 79d6c51b91cd1d72bbb8ef7e196c7a9ee91aa571ee4e0b0676e3b7a5fe09af4d
- MD5 7ae57dcf9fbeb4090f1f1ab2b9a36a7a
- SHA1 944ccce3438f17e1423a0c462b1f77be3dd21706
- SHA512 e0dbc192b3b0b6b1d1208879c08f02e159612be56fe1a3584b0b21581896edaba2c382669f8cddb30012dc7e01fddc7d417c92bc71260b1a73fdf1787264a9b5
- SSDEEP 3072:AGdwXLbj4At0Rx1QfZiHD20fUrnapxTLszq/MaH6mw40zwUzQRKF+:hWLgAYwYHdUr4Tgzq/7H6H40M2b
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/3476-133-0x00000000004A0000-0x00000000004A9000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 4152 CDD4.exe 3992 FF93.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2596 Process not Found 3372 chrome.exe - Program crash 3 IoCs
pid pid_target Process procid_target 2900 4152 WerFault.exe 86 3648 3372 WerFault.exe 89 1900 3992 WerFault.exe 99 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3476 file.exe 3476 file.exe 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found 2596 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2596 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3476 file.exe - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeDebugPrivilege 4152 CDD4.exe Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeDebugPrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found Token: SeShutdownPrivilege 2596 Process not Found Token: SeCreatePagefilePrivilege 2596 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4152 CDD4.exe 3372 chrome.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 4152 CDD4.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3372 chrome.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 4152 2596 Process not Found 86 PID 2596 wrote to memory of 4152 2596 Process not Found 86 PID 2596 wrote to memory of 4152 2596 Process not Found 86 PID 2596 wrote to memory of 3372 2596 Process not Found 89 PID 2596 wrote to memory of 3372 2596 Process not Found 89 PID 3372 wrote to memory of 216 3372 chrome.exe 90 PID 3372 wrote to memory of 216 3372 chrome.exe 90 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 2000 3372 chrome.exe 93 PID 3372 wrote to memory of 4572 3372 chrome.exe 94 PID 3372 wrote to memory of 4572 3372 chrome.exe 94 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95 PID 3372 wrote to memory of 1904 3372 chrome.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3476
-
C:\Users\Admin\AppData\Local\Temp\CDD4.exeC:\Users\Admin\AppData\Local\Temp\CDD4.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 3962⤵
- Program crash
PID:2900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4152 -ip 41521⤵PID:4768
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff896a34f50,0x7ff896a34f60,0x7ff896a34f702⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,14149236099343244836,5281982620211631668,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1644 /prefetch:22⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,14149236099343244836,5281982620211631668,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1992 /prefetch:82⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,14149236099343244836,5281982620211631668,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2296 /prefetch:82⤵PID:1904
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3372 -s 36642⤵
- Program crash
PID:3648
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2288
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 536 -p 3372 -ip 33721⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\FF93.exeC:\Users\Admin\AppData\Local\Temp\FF93.exe1⤵
- Executes dropped EXE
PID:3992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 2722⤵
- Program crash
PID:1900
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3992 -ip 39921⤵PID:4432
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\CDD4.exe
- Size 1.3MB
- SHA256 9b0573de9df070ae7b0c06122f95e8e9dbffb0f1d0661f08a16c75e3d40a4a7c
- MD5 aa01c7e522aabb437a87d19078f3101a
- SHA1 cb4aab2788adb98cf4c02bdd5e4352aa6abf7f52
- SHA512 ffa3e264459612c4bae7e9ef070aed720137d38eb093420a8c721a8c8fd5e005e17b15fa8eb4568a686d6eadd7c0edf1596279355e2d7fe991eb3b325c653343
- SSDEEP 24576:8byF0FcnRdoKAUjlNNSGwmxQK2qJ+Vt6NHJbWaCt6fwfSZdLobk2:EyFCERdoKAU74G32kY6nbGEwQP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\CDD4.exe
- Size 1.3MB
- SHA256 9b0573de9df070ae7b0c06122f95e8e9dbffb0f1d0661f08a16c75e3d40a4a7c
- MD5 aa01c7e522aabb437a87d19078f3101a
- SHA1 cb4aab2788adb98cf4c02bdd5e4352aa6abf7f52
- SHA512 ffa3e264459612c4bae7e9ef070aed720137d38eb093420a8c721a8c8fd5e005e17b15fa8eb4568a686d6eadd7c0edf1596279355e2d7fe991eb3b325c653343
- SSDEEP 24576:8byF0FcnRdoKAUjlNNSGwmxQK2qJ+Vt6NHJbWaCt6fwfSZdLobk2:EyFCERdoKAU74G32kY6nbGEwQP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\FF93.exe
- Size 1.4MB
- SHA256 2679de83bfd7bb3fe7ccaa6c9ae2182fc377d369275f876b89bef5b3f9d64132
- MD5 4566733b02591e87c4cddbb99fb11f06
- SHA1 5e2a1c14f6973d1ec3d02ce1db356caf9007b1fb
- SHA512 904dd0375cb9a2c8469a77118233288699d599806ded673e3594197adcc90182aa385c91b4b1de58a2d6232fbf82079b04283ba37f713eb3cb47cd851b8af039
- SSDEEP 24576:scVRPNcyrywo5r622FWDB0aqVjuWh5aV4/+W3KDGFuewWKYmzgOV2sIbGIqFMeVf:h7PkbTHEQB4PN+bD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\FF93.exe
- Size 1.4MB
- SHA256 2679de83bfd7bb3fe7ccaa6c9ae2182fc377d369275f876b89bef5b3f9d64132
- MD5 4566733b02591e87c4cddbb99fb11f06
- SHA1 5e2a1c14f6973d1ec3d02ce1db356caf9007b1fb
- SHA512 904dd0375cb9a2c8469a77118233288699d599806ded673e3594197adcc90182aa385c91b4b1de58a2d6232fbf82079b04283ba37f713eb3cb47cd851b8af039
- SSDEEP 24576:scVRPNcyrywo5r622FWDB0aqVjuWh5aV4/+W3KDGFuewWKYmzgOV2sIbGIqFMeVf:h7PkbTHEQB4PN+bD
- MD5 SHA1 SHA512 SSDEEP