Analysis
- max time kernel
151s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
16/02/2023, 23:50
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
21 signatures
150 seconds
General
- Target file.exe
- Size 253KB
- Sample230216-3vmqbscf82
- SHA256 f3023985d6f2ad22cfb6cb0635aef04b002a38e6da8b83ba970c9e34bcd8fdfe
- MD5 a75c04cbe8a7bd50077ac3a012776cf9
- SHA1 87a9d27689c1ff748043712d973ff19335b000ed
- SHA512 7ff073c4e8a9ed7fe507d974f2e9ad462c214084c967918b0fad745fac05420eba3d201511f6de4b801d1fbfd5429519108572b92a23dfaf4e9ad9b699695ae6
- SSDEEP 3072:tTFF2Lc5U7KmPfApndhk0wm2qsrAGJ17RkJZ5gw0lHFaY6HPVZRNkYE:BF8LZKFNdi0wmrSv4JZ5gTaY6HRlE
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/5036-133-0x0000000002310000-0x0000000002319000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
flow pid Process 69 3456 rundll32.exe 70 3456 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 5024 10C9.exe - Loads dropped DLL 1 IoCs
pid Process 3456 rundll32.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3456 set thread context of 3548 3456 rundll32.exe 93 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4704 5024 WerFault.exe 87 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 23 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e0031000000000050566abe100054656d7000003a0009000400efbe21550a58505670be2e00000000000000000000000000000000000000000000000000e942ce00540065006d007000000014000000 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3092 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5036 file.exe 5036 file.exe 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3092 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 5036 file.exe - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3548 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3092 Process not Found 3092 Process not Found - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3092 wrote to memory of 5024 3092 Process not Found 87 PID 3092 wrote to memory of 5024 3092 Process not Found 87 PID 3092 wrote to memory of 5024 3092 Process not Found 87 PID 5024 wrote to memory of 3456 5024 10C9.exe 89 PID 5024 wrote to memory of 3456 5024 10C9.exe 89 PID 5024 wrote to memory of 3456 5024 10C9.exe 89 PID 3456 wrote to memory of 3548 3456 rundll32.exe 93 PID 3456 wrote to memory of 3548 3456 rundll32.exe 93 PID 3456 wrote to memory of 3548 3456 rundll32.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:5036
-
C:\Users\Admin\AppData\Local\Temp\10C9.exeC:\Users\Admin\AppData\Local\Temp\10C9.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll,start2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 141903⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3548
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 4882⤵
- Program crash
PID:4704
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5024 -ip 50241⤵PID:2588
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1656
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\10C9.exe
- Size 3.7MB
- SHA256 3c5d0d9054c1dce7374a7bfbeb43ba4661086204d4d2fa5d838a29f8bf05f7e3
- MD5 38c70ce0444c12e6de4c65d1f9dc9a14
- SHA1 f7a686764939cabb4330466168509ceab8932f41
- SHA512 f992f08cb6b7854260eba1c0ace8ed6554fde0c43e4d282ac157cd3a7eac4c7e5a6b4c92c37c10af52abab45f4df589c98e20d149a8ab8cdb985fe2d98c3c1c4
- SSDEEP 98304:iqIem8p8p9wuwQGnRVt/FfkTGqM+eUqbpFXqOcjTI:f3pQ5GnTt/FMTGz+ePb7aZjT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\10C9.exe
- Size 3.7MB
- SHA256 3c5d0d9054c1dce7374a7bfbeb43ba4661086204d4d2fa5d838a29f8bf05f7e3
- MD5 38c70ce0444c12e6de4c65d1f9dc9a14
- SHA1 f7a686764939cabb4330466168509ceab8932f41
- SHA512 f992f08cb6b7854260eba1c0ace8ed6554fde0c43e4d282ac157cd3a7eac4c7e5a6b4c92c37c10af52abab45f4df589c98e20d149a8ab8cdb985fe2d98c3c1c4
- SSDEEP 98304:iqIem8p8p9wuwQGnRVt/FfkTGqM+eUqbpFXqOcjTI:f3pQ5GnTt/FMTGz+ePb7aZjT
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll
- Size 4.3MB
- SHA256 494991bfe9036f391bce58bc8b1c577333bfcd3af0fd6e3c0bc37d0264ad0d3b
- MD5 3006d30e500e92f5b1836c90f25acee4
- SHA1 8c36fa4262a79d64137213ea8d4a519e36f32cd8
- SHA512 0df2830013f9b7a7064b506713771ee3d301a2e3f9053ad0b1b432c819923c176c57c1ed3615fb004597ba4c690eb05449d23ebdc8663b8bea821e996e8db371
- SSDEEP 98304:XJIkmx5C4J/FM844K9g15wwRZwVVvg5U1yuXVdjcC0qyL:Skmm4J/m844Ft/1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Ruifriwreh.dll
- Size 4.3MB
- SHA256 494991bfe9036f391bce58bc8b1c577333bfcd3af0fd6e3c0bc37d0264ad0d3b
- MD5 3006d30e500e92f5b1836c90f25acee4
- SHA1 8c36fa4262a79d64137213ea8d4a519e36f32cd8
- SHA512 0df2830013f9b7a7064b506713771ee3d301a2e3f9053ad0b1b432c819923c176c57c1ed3615fb004597ba4c690eb05449d23ebdc8663b8bea821e996e8db371
- SSDEEP 98304:XJIkmx5C4J/FM844K9g15wwRZwVVvg5U1yuXVdjcC0qyL:Skmm4J/m844Ft/1
- MD5 SHA1 SHA512 SSDEEP