smokeloader | 1d3c27912c2e71fe2c9c353abdbe8a4a9c76711f775dd7e5ff8e3badc2710247

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2022, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 288KB
Sample221230-v65fhsbc8y
SHA256 1d3c27912c2e71fe2c9c353abdbe8a4a9c76711f775dd7e5ff8e3badc2710247
MD5 8f97d0ee1866300ee0be19f77e43e042
SHA1 0964c2f37a1288ab02901fd5c24be4cbc106f5f7
SHA512 6ea49a24e6b7b2836719f22c21154641b0fd6c9e75e2948c60f59ba6637e515b39b8ca28ed77c3f1be7e5ac2c5638447b6cec6707f204f0efc9bae1584a2a5bd
SSDEEP 3072:ByzKEmL0T1LG7s3YM2RjaHkCvDffGzUg3E2szLU8y5/LU8y5sUv+si5HB6xuqqbZ:f/yLTYMHDDfuggU2szo5oGUvHiqx3E5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smokeloader backdoor discovery trojan

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/4264-133-0x00000000005E0000-0x00000000005E9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
4216	D9F9.exe
220	Sppyteaet.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	D9F9.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2764	Process not Found
3616	chrome.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4216 set thread context of 3640	4216	D9F9.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3212	3640	WerFault.exe	92
3096	3616	WerFault.exe	90
1084	4216	WerFault.exe	83

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Checks processor information in registry 2 TTPs 43 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	D9F9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	D9F9.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	D9F9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	D9F9.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	D9F9.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4264	file.exe
4264	file.exe
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found
2764	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4264	file.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeDebugPrivilege	220	Sppyteaet.exe
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeDebugPrivilege	3640	rundll32.exe
Token: SeDebugPrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found
Token: SeShutdownPrivilege	2764	Process not Found
Token: SeCreatePagefilePrivilege	2764	Process not Found

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
220	Sppyteaet.exe
3616	chrome.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
220	Sppyteaet.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3616	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 4216	2764	Process not Found	83
PID 2764 wrote to memory of 4216	2764	Process not Found	83
PID 2764 wrote to memory of 4216	2764	Process not Found	83
PID 4216 wrote to memory of 220	4216	D9F9.exe	88
PID 4216 wrote to memory of 220	4216	D9F9.exe	88
PID 4216 wrote to memory of 220	4216	D9F9.exe	88
PID 2764 wrote to memory of 3616	2764	Process not Found	90
PID 2764 wrote to memory of 3616	2764	Process not Found	90
PID 3616 wrote to memory of 3688	3616	chrome.exe	89
PID 3616 wrote to memory of 3688	3616	chrome.exe	89
PID 4216 wrote to memory of 3640	4216	D9F9.exe	92
PID 4216 wrote to memory of 3640	4216	D9F9.exe	92
PID 4216 wrote to memory of 3640	4216	D9F9.exe	92
PID 4216 wrote to memory of 3640	4216	D9F9.exe	92
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 4940	3616	chrome.exe	96
PID 3616 wrote to memory of 3172	3616	chrome.exe	98
PID 3616 wrote to memory of 3172	3616	chrome.exe	98
PID 3616 wrote to memory of 4816	3616	chrome.exe	101
PID 3616 wrote to memory of 4816	3616	chrome.exe	101
PID 3616 wrote to memory of 4816	3616	chrome.exe	101
PID 3616 wrote to memory of 4816	3616	chrome.exe	101
PID 3616 wrote to memory of 4816	3616	chrome.exe	101
PID 3616 wrote to memory of 4816	3616	chrome.exe	101
PID 3616 wrote to memory of 4816	3616	chrome.exe	101
PID 3616 wrote to memory of 4816	3616	chrome.exe	101

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4264

C:\Users\Admin\AppData\Local\Temp\D9F9.exe
C:\Users\Admin\AppData\Local\Temp\D9F9.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\Sppyteaet.exe
  "C:\Users\Admin\AppData\Local\Temp\Sppyteaet.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:220
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3640
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3640 -s 1324
    3⤵
    - Program crash
    PID:3212
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4216 -s 1444
  2⤵
  - Program crash
  PID:1084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9d5b4f50,0x7ffd9d5b4f60,0x7ffd9d5b4f70
1⤵
PID:3688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,11407513532528346108,8227552092810883122,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1676 /prefetch:2
  2⤵
  PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,11407513532528346108,8227552092810883122,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2016 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1668,11407513532528346108,8227552092810883122,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,11407513532528346108,8227552092810883122,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3552 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,11407513532528346108,8227552092810883122,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3852 /prefetch:8
  2⤵
  PID:5028
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3616 -s 3944
  2⤵
  - Program crash
  PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3640 -ip 3640
1⤵
PID:876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 3616 -ip 3616
1⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4216 -ip 4216
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D9F9.exe

Path C:\Users\Admin\AppData\Local\Temp\D9F9.exe
Size 5.6MB
SHA256 4b732278b4b10b0c63641a767966c0e9e869283a8336bf5007b666065b2cf9a4
MD5 064fd078738a8460f7cfd8ef945d35fb
SHA1 bb865ba1f58353d78613ce633fafcfed10089b0e
SHA512 818202020c50d84085969ed71edb08be1ff767b665ea4a2e6315e1fcb4c49c6c4f78fd97c0c93a74d6ae0d7ba8be15c85c8f7fdca78f5edcc374ef98c30b5035
SSDEEP 98304:ZE8YyYYnk+Qb+hlpz7qxYUf30l4LBA5lGlT9EOlPqdpD+r38MH2WpdNh9hBqS:ZJYukx6rzOxYU0wBA8USpppQS
MD5 SHA1 SHA512 SSDEEP

Submit Download

D9F9.exe

Path C:\Users\Admin\AppData\Local\Temp\D9F9.exe
Size 5.6MB
SHA256 4b732278b4b10b0c63641a767966c0e9e869283a8336bf5007b666065b2cf9a4
MD5 064fd078738a8460f7cfd8ef945d35fb
SHA1 bb865ba1f58353d78613ce633fafcfed10089b0e
SHA512 818202020c50d84085969ed71edb08be1ff767b665ea4a2e6315e1fcb4c49c6c4f78fd97c0c93a74d6ae0d7ba8be15c85c8f7fdca78f5edcc374ef98c30b5035
SSDEEP 98304:ZE8YyYYnk+Qb+hlpz7qxYUf30l4LBA5lGlT9EOlPqdpD+r38MH2WpdNh9hBqS:ZJYukx6rzOxYU0wBA8USpppQS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sppyteaet.exe

Path C:\Users\Admin\AppData\Local\Temp\Sppyteaet.exe
Size 1.3MB
SHA256 366ee3319c995b995fcfcc3f2228a18a09d0461a94964b4b4ad9a89dcbf669f4
MD5 ff6a5732355485b459248f586c2b6945
SHA1 07da3f03ef18e2eaddfceb050b68e93fd533f7a3
SHA512 379fd03ebec85a9b15caf0aa8ba5a43c76199391ba3a2b29d20426501294e66d8f07c219e05355b47702e5a836d1a89015533f72da6bbe2ded57ee5d24056749
SSDEEP 24576:RJ2vEI4CY0WaFG9rI7fp9lfTOZgF9fWwSNHgdCsmqpmRJvx1:REb4MWaIsj9f6K9ewkQCJ4Iv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Sppyteaet.exe

Path C:\Users\Admin\AppData\Local\Temp\Sppyteaet.exe
Size 1.3MB
SHA256 366ee3319c995b995fcfcc3f2228a18a09d0461a94964b4b4ad9a89dcbf669f4
MD5 ff6a5732355485b459248f586c2b6945
SHA1 07da3f03ef18e2eaddfceb050b68e93fd533f7a3
SHA512 379fd03ebec85a9b15caf0aa8ba5a43c76199391ba3a2b29d20426501294e66d8f07c219e05355b47702e5a836d1a89015533f72da6bbe2ded57ee5d24056749
SSDEEP 24576:RJ2vEI4CY0WaFG9rI7fp9lfTOZgF9fWwSNHgdCsmqpmRJvx1:REb4MWaIsj9f6K9ewkQCJ4Iv
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-177-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/220-174-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/220-173-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/220-169-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/220-175-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/220-176-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/220-178-0x0000000000400000-0x0000000000534000-memory.dmp

Download

memory/2764-217-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-214-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-147-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-148-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-149-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-150-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-151-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-152-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-153-0x00000000029B0000-0x00000000029C0000-memory.dmp

Download

memory/2764-154-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/2764-155-0x00000000008C0000-0x00000000008D0000-memory.dmp

Download

memory/2764-156-0x00000000008C0000-0x00000000008D0000-memory.dmp

Download

memory/2764-247-0x00000000029D0000-0x00000000029E0000-memory.dmp

Download

memory/2764-145-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-144-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-160-0x0000000007380000-0x0000000007390000-memory.dmp

Download

memory/2764-161-0x00000000008C0000-0x00000000008D0000-memory.dmp

Download

memory/2764-162-0x00000000008C0000-0x00000000008D0000-memory.dmp

Download

memory/2764-246-0x0000000000950000-0x0000000000960000-memory.dmp

Download

memory/2764-245-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-239-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-143-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-142-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-141-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-140-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-139-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-138-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-137-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-136-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-238-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-237-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-179-0x0000000008720000-0x0000000008848000-memory.dmp

Download

memory/2764-236-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-235-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-234-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-233-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-232-0x0000000007480000-0x0000000007490000-memory.dmp

Download

memory/2764-231-0x00000000029D0000-0x00000000029E0000-memory.dmp

Download

memory/2764-230-0x0000000007480000-0x0000000007490000-memory.dmp

Download

memory/2764-229-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-188-0x0000000008720000-0x0000000008848000-memory.dmp

Download

memory/2764-228-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-227-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-226-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-225-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-224-0x0000000007480000-0x0000000007490000-memory.dmp

Download

memory/2764-223-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-222-0x0000000007480000-0x0000000007490000-memory.dmp

Download

memory/2764-221-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-220-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-213-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-146-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-219-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-215-0x00000000029D0000-0x00000000029E0000-memory.dmp

Download

memory/2764-203-0x0000000008720000-0x0000000008848000-memory.dmp

Download

memory/2764-212-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-205-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-206-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-207-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-208-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-209-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-210-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/2764-211-0x00000000029A0000-0x00000000029B0000-memory.dmp

Download

memory/3640-196-0x0000000004100000-0x0000000004240000-memory.dmp

Download

memory/3640-192-0x0000000001200000-0x0000000001C25000-memory.dmp

Download

memory/3640-195-0x0000000004100000-0x0000000004240000-memory.dmp

Download

memory/3640-200-0x00000000034F0000-0x0000000004034000-memory.dmp

Download

memory/3640-194-0x00000000034F0000-0x0000000004034000-memory.dmp

Download

memory/3640-198-0x0000000004100000-0x0000000004240000-memory.dmp

Download

memory/3640-197-0x0000000004100000-0x0000000004240000-memory.dmp

Download

memory/4216-189-0x0000000007EE0000-0x0000000008020000-memory.dmp

Download

memory/4216-183-0x0000000007EE0000-0x0000000008020000-memory.dmp

Download

memory/4216-201-0x0000000000400000-0x00000000009B4000-memory.dmp

Download

memory/4216-202-0x0000000007000000-0x0000000007B44000-memory.dmp

Download

memory/4216-190-0x0000000007EE0000-0x0000000008020000-memory.dmp

Download

memory/4216-204-0x0000000000400000-0x00000000009B4000-memory.dmp

Download

memory/4216-186-0x0000000007000000-0x0000000007B44000-memory.dmp

Download

memory/4216-187-0x0000000007EE0000-0x0000000008020000-memory.dmp

Download

memory/4216-185-0x0000000007EE0000-0x0000000008020000-memory.dmp

Download

memory/4216-184-0x0000000007EE0000-0x0000000008020000-memory.dmp

Download

memory/4216-163-0x00000000026C4000-0x0000000002C25000-memory.dmp

Download

memory/4216-182-0x0000000007EE0000-0x0000000008020000-memory.dmp

Download

memory/4216-181-0x0000000007EE0000-0x0000000008020000-memory.dmp

Download

memory/4216-180-0x0000000007000000-0x0000000007B44000-memory.dmp

Download

memory/4216-164-0x0000000002C30000-0x00000000031E3000-memory.dmp

Download

memory/4216-165-0x0000000000400000-0x00000000009B4000-memory.dmp

Download

memory/4264-135-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/4264-134-0x0000000000400000-0x0000000000465000-memory.dmp

Download

memory/4264-133-0x00000000005E0000-0x00000000005E9000-memory.dmp

Download

memory/4264-132-0x00000000004E9000-0x00000000004FA000-memory.dmp

Download