Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
12/01/2023, 19:18
Static task
static1
Behavioral task
behavioral1
Sample
e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe
-
Size
268KB
-
MD5
8a589feb0a2b8e03e39272f963183619
-
SHA1
629a3b45d8b922d24e85ed5b1cd221fc0dfb4321
-
SHA256
e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37
-
SHA512
771eaa1f931290766121a8030c570c675cd0d2797fe39b575167144895356795bd7d488c45efccda87436baaf3a784843b58b0cfa1db3131a866db947fb64b7e
-
SSDEEP
6144:Br7fILCKf0GxYvNZAzFQRd2FNGpMskFQH2Yp:xLI2KfpxmgCR4FURkFo2Y
Score
10/10
Malware Config
Signatures
-
Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4864-133-0x0000000002D40000-0x0000000002D49000-memory.dmp family_smokeloader -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blocklisted process makes network request 3 IoCs
flow pid Process 50 1272 rundll32.exe 52 1272 rundll32.exe 63 1272 rundll32.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 3360 5FC3.exe 1264 brievsf -
Loads dropped DLL 1 IoCs
pid Process 1272 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1272 set thread context of 3440 1272 rundll32.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3040 3360 WerFault.exe 86 -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI brievsf Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI brievsf Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI brievsf Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe -
Checks processor information in registry 2 TTPs 18 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found -
Modifies registry class 30 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000002c56699a100054656d7000003a0009000400efbe21550a582c566d9a2e00000000000000000000000000000000000000000000000000daed0800540065006d007000000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3024 Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4864 e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe 4864 e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4864 e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe 1264 brievsf -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3440 rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3024 Process not Found 3024 Process not Found -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3024 wrote to memory of 3360 3024 Process not Found 86 PID 3024 wrote to memory of 3360 3024 Process not Found 86 PID 3024 wrote to memory of 3360 3024 Process not Found 86 PID 3360 wrote to memory of 1272 3360 5FC3.exe 88 PID 3360 wrote to memory of 1272 3360 5FC3.exe 88 PID 3360 wrote to memory of 1272 3360 5FC3.exe 88 PID 1272 wrote to memory of 3440 1272 rundll32.exe 92 PID 1272 wrote to memory of 3440 1272 rundll32.exe 92 PID 1272 wrote to memory of 3440 1272 rundll32.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe"C:\Users\Admin\AppData\Local\Temp\e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4864
-
C:\Users\Admin\AppData\Local\Temp\5FC3.exeC:\Users\Admin\AppData\Local\Temp\5FC3.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Rruwtqrefy.tmp",Uuhpdwiyer2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 172293⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 5322⤵
- Program crash
PID:3040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3360 -ip 33601⤵PID:4868
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1516
-
C:\Users\Admin\AppData\Roaming\brievsfC:\Users\Admin\AppData\Roaming\brievsf1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1264
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD50dcf30297b84f0b92ce574252bbf581a
SHA1e5a143543efc1c6f8a2eddab2bd6962bcd3323f2
SHA25617a7b2bcecfe6a6e95c0ce174459117ad1f3510212af673789692b2f2cbe0ddf
SHA51270c18d30a12f829a68fb8a06faf01aeaa41905ebb058530b2cd91acf8ec88100205d1554effa2429b6849a6204944a058d72d9b555f05828504811a73518c504
-
Filesize
1.1MB
MD50dcf30297b84f0b92ce574252bbf581a
SHA1e5a143543efc1c6f8a2eddab2bd6962bcd3323f2
SHA25617a7b2bcecfe6a6e95c0ce174459117ad1f3510212af673789692b2f2cbe0ddf
SHA51270c18d30a12f829a68fb8a06faf01aeaa41905ebb058530b2cd91acf8ec88100205d1554effa2429b6849a6204944a058d72d9b555f05828504811a73518c504
-
Filesize
805KB
MD544d724c9ad9ae3149d4997852eea3e96
SHA1dcd92e1b704b3f25ba455e079004c5a5aaf903f9
SHA256c5cd7d52ba95127c18556a2ddca64e4ef80a2945e6579545c0067abdab3a0ad0
SHA512791c3b62685a475799a991b2f0f9535781c888d48d1dd47b5b2cd407ff46e15231247f07ceb63c012bd923bf88fffaecf29030186e3d569b9886048881012e44
-
Filesize
805KB
MD544d724c9ad9ae3149d4997852eea3e96
SHA1dcd92e1b704b3f25ba455e079004c5a5aaf903f9
SHA256c5cd7d52ba95127c18556a2ddca64e4ef80a2945e6579545c0067abdab3a0ad0
SHA512791c3b62685a475799a991b2f0f9535781c888d48d1dd47b5b2cd407ff46e15231247f07ceb63c012bd923bf88fffaecf29030186e3d569b9886048881012e44
-
Filesize
268KB
MD58a589feb0a2b8e03e39272f963183619
SHA1629a3b45d8b922d24e85ed5b1cd221fc0dfb4321
SHA256e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37
SHA512771eaa1f931290766121a8030c570c675cd0d2797fe39b575167144895356795bd7d488c45efccda87436baaf3a784843b58b0cfa1db3131a866db947fb64b7e
-
Filesize
268KB
MD58a589feb0a2b8e03e39272f963183619
SHA1629a3b45d8b922d24e85ed5b1cd221fc0dfb4321
SHA256e30d968d97545bd477dcba4b4ddb5e1f720724a8f744e68a73d3115f25e30f37
SHA512771eaa1f931290766121a8030c570c675cd0d2797fe39b575167144895356795bd7d488c45efccda87436baaf3a784843b58b0cfa1db3131a866db947fb64b7e