smokeloader | 53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450

Analysis

max time kernel
150s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2022, 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450.exe
Size

261KB
MD5

01b3d33e9177f7a2f1af3dcd270a654d
SHA1

318383633fa45e04700a17589ffde04cd5efcd9f
SHA256

53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450
SHA512

fd38b87d00898680ee9ef08e2e3444bc9cb3d6a41d7a6b6c558df887adac66fb89e75859ff76501ecdfa0a5712d39b6aa67ab102f9e57697895dcdffb2a22184
SSDEEP

3072:Hkcgt81YA4sHL/46TG14x1RQxHUsHLgug1zJVJ7ykkKVlmqEXz27hZY:HU6vBLgB1o09nsuuVVAaYiZY

Score

10^/10

smokeloader backdoor trojan

Malware Config

Signatures

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral1/memory/4680-133-0x00000000005E0000-0x00000000005E9000-memory.dmp	family_smokeloader

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
4828	CD57.exe
224	Otfhfhweptay.exe
4344	fcgftjc

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	CD57.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2696	Process not Found
1528	chrome.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4828 set thread context of 3852	4828	CD57.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1160	224	WerFault.exe	89
4692	1528	WerFault.exe	93

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fcgftjc
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fcgftjc
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fcgftjc

Checks processor information in registry 2 TTPs 44 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	CD57.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CD57.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	CD57.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status	CD57.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Configuration Data	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	rundll32.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CD57.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	CD57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet	CD57.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status	rundll32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Toolbar	Process not Found

Modifies registry class 19 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Process not Found
Set value (data)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	Process not Found

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2696	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4680	53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450.exe
4680	53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450.exe
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found
2696	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4680	53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450.exe
4344	fcgftjc

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	224	Otfhfhweptay.exe
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeDebugPrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found
Token: SeShutdownPrivilege	2696	Process not Found
Token: SeCreatePagefilePrivilege	2696	Process not Found

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3852	rundll32.exe
224	Otfhfhweptay.exe
1528	chrome.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
224	Otfhfhweptay.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2696	Process not Found
2696	Process not Found
1528	chrome.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2696	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 4828	2696	Process not Found	87
PID 2696 wrote to memory of 4828	2696	Process not Found	87
PID 2696 wrote to memory of 4828	2696	Process not Found	87
PID 4828 wrote to memory of 224	4828	CD57.exe	89
PID 4828 wrote to memory of 224	4828	CD57.exe	89
PID 4828 wrote to memory of 224	4828	CD57.exe	89
PID 4828 wrote to memory of 3852	4828	CD57.exe	90
PID 4828 wrote to memory of 3852	4828	CD57.exe	90
PID 4828 wrote to memory of 3852	4828	CD57.exe	90
PID 4828 wrote to memory of 3852	4828	CD57.exe	90
PID 2696 wrote to memory of 1528	2696	Process not Found	93
PID 2696 wrote to memory of 1528	2696	Process not Found	93
PID 1528 wrote to memory of 2668	1528	chrome.exe	94
PID 1528 wrote to memory of 2668	1528	chrome.exe	94
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4708	1528	chrome.exe	97
PID 1528 wrote to memory of 4688	1528	chrome.exe	98
PID 1528 wrote to memory of 4688	1528	chrome.exe	98
PID 1528 wrote to memory of 3796	1528	chrome.exe	99
PID 1528 wrote to memory of 3796	1528	chrome.exe	99
PID 1528 wrote to memory of 3796	1528	chrome.exe	99
PID 1528 wrote to memory of 3796	1528	chrome.exe	99
PID 1528 wrote to memory of 3796	1528	chrome.exe	99
PID 1528 wrote to memory of 3796	1528	chrome.exe	99
PID 1528 wrote to memory of 3796	1528	chrome.exe	99
PID 1528 wrote to memory of 3796	1528	chrome.exe	99

C:\Users\Admin\AppData\Local\Temp\53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450.exe
"C:\Users\Admin\AppData\Local\Temp\53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4680

C:\Users\Admin\AppData\Local\Temp\CD57.exe
C:\Users\Admin\AppData\Local\Temp\CD57.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\Otfhfhweptay.exe
  "C:\Users\Admin\AppData\Local\Temp\Otfhfhweptay.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 440
    3⤵
    - Program crash
    PID:1160
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#61
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 224 -ip 224
1⤵
PID:4844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --no-default-browser-check --silent-launch --disable-backgrounding-occluded-windows --disable-background-timer-throttling --ran-launcher --profile-directory="Default"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa964b4f50,0x7ffa964b4f60,0x7ffa964b4f70
  2⤵
  PID:2668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1636,13120549766351163054,6915382361169284011,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1700 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1636,13120549766351163054,6915382361169284011,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2028 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1636,13120549766351163054,6915382361169284011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2316 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1636,13120549766351163054,6915382361169284011,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3532 /prefetch:8
  2⤵
  PID:1624
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1528 -s 3676
  2⤵
  - Program crash
  PID:4692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 1528 -ip 1528
1⤵
PID:3088

C:\Users\Admin\AppData\Roaming\fcgftjc
C:\Users\Admin\AppData\Roaming\fcgftjc
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CD57.exe

Filesize
6.6MB

MD5
b46628b510b1a2f21a0b4bb7e26a921f

SHA1
1be3f9c97e40c9c2f154b8eaf0db982cf22220c3

SHA256
de28fe0d91d0d349047a1b4af4d7c90c37782d186458058e238d0f5db671a381

SHA512
8726403b655652aa9c9d4ee9a58985f2f2a7bf1df9dd282f3d7ea9b755b63799c30bc43e069e5163ab56e7c0746eaffef0a8dacf5f0eaa7fde77a2b488a14f9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CD57.exe

Filesize
6.6MB

MD5
b46628b510b1a2f21a0b4bb7e26a921f

SHA1
1be3f9c97e40c9c2f154b8eaf0db982cf22220c3

SHA256
de28fe0d91d0d349047a1b4af4d7c90c37782d186458058e238d0f5db671a381

SHA512
8726403b655652aa9c9d4ee9a58985f2f2a7bf1df9dd282f3d7ea9b755b63799c30bc43e069e5163ab56e7c0746eaffef0a8dacf5f0eaa7fde77a2b488a14f9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20221111_134339008.html

Filesize
94KB

MD5
5cc804e51cce62250e82e08986b0f74c

SHA1
681d9bb803b543155ca1e8743516cf6bc6a77545

SHA256
375ee0fb3377c299b07667d9050c77fa2591ef117c4c06e62ec4e6ca9cc28f4c

SHA512
848bf4a0ea4ef2545c6dfef476f4773b6ecd6fa69f7a58708c7d6bf76b79e46da414eb7217e0cee933a2a23b17eef3a684a433e927720210bf396f6156bb0674

Download Submit
C:\Users\Admin\AppData\Local\Temp\Otfhfhweptay.exe

Filesize
1.5MB

MD5
4be03ece98dae87458118dcac2d98528

SHA1
08c65c05c85ef3c0781e24a8aebe26e1426b2ac0

SHA256
61cd01c9b49f419fc7735413f0bc75ce9f49472517d11a272d2de5a746d866ec

SHA512
972f1c71d184e7983978f332ebfd4e4b0145e5a5fda3962bb5c1b931f2269bbab6ebf5108a7661a61717f5543a101dc0851e341a7a5e35778eb3e6f6d66b573e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Otfhfhweptay.exe

Filesize
1.5MB

MD5
4be03ece98dae87458118dcac2d98528

SHA1
08c65c05c85ef3c0781e24a8aebe26e1426b2ac0

SHA256
61cd01c9b49f419fc7735413f0bc75ce9f49472517d11a272d2de5a746d866ec

SHA512
972f1c71d184e7983978f332ebfd4e4b0145e5a5fda3962bb5c1b931f2269bbab6ebf5108a7661a61717f5543a101dc0851e341a7a5e35778eb3e6f6d66b573e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Otfhfhweptay.tmp

Filesize
3.5MB

MD5
e9ff74c50c5a8c95e20cd1f03c727235

SHA1
435270cb5a26e92c06a79be4c10e58fbe9fe6641

SHA256
917a6e23940d62c55398fe59f1d39093fbb916465b84e7588f90a12013f4b49e

SHA512
6895b206a27b5988304afd392bcf3674a3812b012fb7cf5db4b30825d22d8cb5fd63bf1e7a2dafa7f17ae19484e23754254beaf7cb620f49881268dde5b2163d

Download Submit
C:\Users\Admin\AppData\Local\Temp\SOCAAGDT-20221111-1349.log

Filesize
58KB

MD5
719d297e33fa282f08cddba60f474436

SHA1
8fe90799cf05da29e8b5123c27f2e120af4179ca

SHA256
72785a70de3b2ec9f265eccb81575c7a01d81b7d996d123709830303ab3cf7fd

SHA512
5945e4665c583422bf8dd2cd4fe7185e7597598461342943bcfdef717a19727bded230f0cef7a66d7eab66ac2ff081cade381b78e350cc7ce9da4f09d054b3a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\SOCAAGDT-20221111-1349a.log

Filesize
147KB

MD5
7c179047bc230eaa018c21e5da4858c1

SHA1
af5c738e924081765171ec7b23d6f264f6e3a10f

SHA256
1e35e8e0907ad88f980f3dcf49a3e02429328e4b50725860a5ea76a7ce0c0584

SHA512
532e016f8cadfd885c0c1b873724e2ce1161824a39ab3e9680d11fdecee7b03392c0bfe72f9880e45006881b1a6f7b690fa4afb3764af2e6d68914007b929e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\aria-debug-1404.log

Filesize
470B

MD5
5126d5802fd8535e0032839d68aa7bf7

SHA1
2e409bde69509836d983d4946f46d4cf2ecfe338

SHA256
7b75157b98e3d80b33ed1e38f7b57dad8588137af9063332a9b7f37c4fc0c816

SHA512
d108d334faff1e16f7e727220288282fb5b42efe3597d3759d876faad44717bf0ff44ea3ddc34edd99d31600ca2b482afa3de39d8c602bfd33d1d7e37f91a342

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt

Filesize
1KB

MD5
fa4b52a52c0158ea53754b0ec1061455

SHA1
f9c1ea9a96b50883cc211f678c0980a83b46a21e

SHA256
e2eb3d980177fc77f5feb7dac10becffc32e0e492d8403781d4ffbecd11ea764

SHA512
226c895c1613a7b39550750b87d62590a126812f0a20d08692f690f618fbf1c1a5cf666f174e06dfd87bcab96300d80cf6925fbd8b242b3cefc481ddbbfcf346

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI16EC.txt

Filesize
426KB

MD5
8df35a67a3fe81e2c83f723095d5cc69

SHA1
f3b903c20d84704bde055d92afec0b4f9400bdf9

SHA256
8c678ff5d4a43cbb813b3074659ef6bccb0bb34f53e67c0eb0382b3f08569200

SHA512
49494d66ee21de2a1e5714fb58d21dc705b03fa2711032c04741a2571dbc8987726d9a7080170bbb722edc76892d26f8fc9eb208b2631713898a20b6ddc12899

Download Submit
C:\Users\Admin\AppData\Local\Temp\wctE53.tmp

Filesize
63KB

MD5
e516a60bc980095e8d156b1a99ab5eee

SHA1
238e243ffc12d4e012fd020c9822703109b987f6

SHA256
543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

SHA512
9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\wmsetup.log

Filesize
697B

MD5
f248ae61185ec6a116f1fa1d14e0a153

SHA1
b611a493ffddcd5a7e56aebd4db99e4b06fab3f9

SHA256
d97d956c8e92bafcc28ff8e4997921f04ce21f5ae5e1d9eff430dd3d4125f512

SHA512
5e5f568cacc306346d9da19ee0782937a962130457c97fefb3fbf9e2c80e78650f4656cb3ecc4c99b8a2e0049c1a76cb1b491044342f0ccbb6ab507cd58cf0f6

Download Submit
C:\Users\Admin\AppData\Roaming\fcgftjc

Filesize
261KB

MD5
01b3d33e9177f7a2f1af3dcd270a654d

SHA1
318383633fa45e04700a17589ffde04cd5efcd9f

SHA256
53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450

SHA512
fd38b87d00898680ee9ef08e2e3444bc9cb3d6a41d7a6b6c558df887adac66fb89e75859ff76501ecdfa0a5712d39b6aa67ab102f9e57697895dcdffb2a22184

Download Submit
C:\Users\Admin\AppData\Roaming\fcgftjc

Filesize
261KB

MD5
01b3d33e9177f7a2f1af3dcd270a654d

SHA1
318383633fa45e04700a17589ffde04cd5efcd9f

SHA256
53290d7a62ef29e1448c29184065ed50df67f7be372753706e20409804e09450

SHA512
fd38b87d00898680ee9ef08e2e3444bc9cb3d6a41d7a6b6c558df887adac66fb89e75859ff76501ecdfa0a5712d39b6aa67ab102f9e57697895dcdffb2a22184

Download Submit
memory/224-184-0x00000000027B0000-0x00000000028E4000-memory.dmp

Filesize
1.2MB

Download
memory/224-171-0x00000000027B0000-0x00000000028E4000-memory.dmp

Filesize
1.2MB

Download
memory/224-179-0x00000000027B0000-0x00000000028E4000-memory.dmp

Filesize
1.2MB

Download
memory/224-191-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download
memory/224-182-0x00000000027B0000-0x00000000028E4000-memory.dmp

Filesize
1.2MB

Download
memory/224-188-0x0000000000400000-0x0000000000595000-memory.dmp

Filesize
1.6MB

Download
memory/224-187-0x0000000002287000-0x00000000023C7000-memory.dmp

Filesize
1.2MB

Download
memory/224-183-0x00000000027B0000-0x00000000028E4000-memory.dmp

Filesize
1.2MB

Download
memory/224-181-0x00000000027B0000-0x00000000028E4000-memory.dmp

Filesize
1.2MB

Download
memory/224-185-0x00000000027B0000-0x00000000028E4000-memory.dmp

Filesize
1.2MB

Download
memory/224-180-0x00000000023D0000-0x0000000002525000-memory.dmp

Filesize
1.3MB

Download
memory/2696-186-0x0000000008920000-0x0000000008A48000-memory.dmp

Filesize
1.2MB

Download
memory/2696-190-0x0000000008920000-0x0000000008A48000-memory.dmp

Filesize
1.2MB

Download
memory/2696-195-0x0000000008920000-0x0000000008A48000-memory.dmp

Filesize
1.2MB

Download
memory/3852-160-0x0000000004380000-0x00000000044C0000-memory.dmp

Filesize
1.2MB

Download
memory/3852-161-0x0000000004380000-0x00000000044C0000-memory.dmp

Filesize
1.2MB

Download
memory/3852-189-0x0000000003650000-0x00000000041A0000-memory.dmp

Filesize
11.3MB

Download
memory/3852-173-0x0000000001200000-0x0000000001C30000-memory.dmp

Filesize
10.2MB

Download
memory/3852-174-0x0000000004380000-0x00000000044C0000-memory.dmp

Filesize
1.2MB

Download
memory/3852-176-0x0000000004380000-0x00000000044C0000-memory.dmp

Filesize
1.2MB

Download
memory/3852-178-0x0000000003650000-0x00000000041A0000-memory.dmp

Filesize
11.3MB

Download
memory/3852-159-0x0000000003650000-0x00000000041A0000-memory.dmp

Filesize
11.3MB

Download
memory/4344-200-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4344-198-0x00000000006FD000-0x000000000070D000-memory.dmp

Filesize
64KB

Download
memory/4344-199-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4680-132-0x00000000007EE000-0x00000000007FE000-memory.dmp

Filesize
64KB

Download
memory/4680-135-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4680-133-0x00000000005E0000-0x00000000005E9000-memory.dmp

Filesize
36KB

Download
memory/4680-134-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/4828-140-0x0000000003110000-0x00000000039D8000-memory.dmp

Filesize
8.8MB

Download
memory/4828-151-0x0000000005740000-0x0000000005880000-memory.dmp

Filesize
1.2MB

Download
memory/4828-139-0x0000000002A8E000-0x0000000003108000-memory.dmp

Filesize
6.5MB

Download
memory/4828-156-0x0000000005740000-0x0000000005880000-memory.dmp

Filesize
1.2MB

Download
memory/4828-155-0x0000000005740000-0x0000000005880000-memory.dmp

Filesize
1.2MB

Download
memory/4828-154-0x0000000005740000-0x0000000005880000-memory.dmp

Filesize
1.2MB

Download
memory/4828-153-0x0000000005740000-0x0000000005880000-memory.dmp

Filesize
1.2MB

Download
memory/4828-149-0x0000000005740000-0x0000000005880000-memory.dmp

Filesize
1.2MB

Download
memory/4828-152-0x0000000005740000-0x0000000005880000-memory.dmp

Filesize
1.2MB

Download
memory/4828-146-0x0000000000400000-0x0000000000CD4000-memory.dmp

Filesize
8.8MB

Download
memory/4828-193-0x0000000000400000-0x0000000000CD4000-memory.dmp

Filesize
8.8MB

Download
memory/4828-194-0x0000000004B10000-0x0000000005660000-memory.dmp

Filesize
11.3MB

Download
memory/4828-150-0x0000000005740000-0x0000000005880000-memory.dmp

Filesize
1.2MB

Download
memory/4828-158-0x0000000004B10000-0x0000000005660000-memory.dmp

Filesize
11.3MB

Download
memory/4828-148-0x0000000004B10000-0x0000000005660000-memory.dmp

Filesize
11.3MB

Download
memory/4828-142-0x0000000000400000-0x0000000000CD4000-memory.dmp

Filesize
8.8MB

Download
memory/4828-141-0x0000000000400000-0x0000000000CD4000-memory.dmp

Filesize
8.8MB

Download
memory/4828-147-0x0000000004B10000-0x0000000005660000-memory.dmp

Filesize
11.3MB

Download