Overview
overview
3Static
static
3SESmartIDC...tion.h
windows7-x64
3SESmartIDC...tion.h
windows10-2004-x64
3SESmartIDC...defs.h
windows7-x64
3SESmartIDC...defs.h
windows10-2004-x64
3SESmartIDC...etry.h
windows7-x64
3SESmartIDC...etry.h
windows10-2004-x64
3SESmartIDC...mage.h
windows7-x64
3SESmartIDC...mage.h
windows10-2004-x64
3SESmartIDC...etry.h
windows7-x64
3SESmartIDC...etry.h
windows10-2004-x64
3SESmartIDC...oly.js
windows7-x64
1SESmartIDC...oly.js
windows10-2004-x64
1SESmartIDC...uad.js
windows7-x64
1SESmartIDC...uad.js
windows10-2004-x64
1Analysis
-
max time kernel
166s -
max time network
201s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20/05/2023, 14:44
Behavioral task
behavioral1
Sample
SESmartIDCore/include/secommon/se_exception.h
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral2
Sample
SESmartIDCore/include/secommon/se_exception.h
Resource
win10v2004-20230221-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
SESmartIDCore/include/secommon/se_export_defs.h
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral4
Sample
SESmartIDCore/include/secommon/se_export_defs.h
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
SESmartIDCore/include/secommon/se_geometry.h
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral6
Sample
SESmartIDCore/include/secommon/se_geometry.h
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
SESmartIDCore/include/secommon/se_image.h
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral8
Sample
SESmartIDCore/include/secommon/se_image.h
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
SESmartIDCore/wrap/objcsecommon/include/objcsecommon/se_geometry.h
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral10
Sample
SESmartIDCore/wrap/objcsecommon/include/objcsecommon/se_geometry.h
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SESmartIDCore/wrap/objcsecommon/src/se_geometry/poly.js
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral12
Sample
SESmartIDCore/wrap/objcsecommon/src/se_geometry/poly.js
Resource
win10v2004-20230220-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
SESmartIDCore/wrap/objcsecommon/src/se_geometry/quad.js
Resource
win7-20230220-en
windows7-x64
Behavioral task
behavioral14
Sample
SESmartIDCore/wrap/objcsecommon/src/se_geometry/quad.js
Resource
win10v2004-20230220-en
windows10-2004-x64
General
-
Target
SESmartIDCore/include/secommon/se_geometry.h
-
Size
9KB
-
MD5
76430fcd993c25f49df60113731b52e5
-
SHA1
eab2ede1a0fad2aa5e54dc055cf40b19b0efed0d
-
SHA256
60e0ecbc7bfa9e7d5638eacc2ce89c4d7d55cf71ac8c7d568938b884a8640853
-
SHA512
92e104027c6dce4189b04191162de32e0da5d0ccea2ad4268e1c6d11d2ccbbf31874d629b8a2339189eebbbf759fcfddb1ec2df2d486b19d58fbf456e899765b
-
SSDEEP
192:UKU3fJ21OJAGRwbLKgAXK/HU5IWpYD3fxcRKi6XKH4YUawzZ7/7ZL4BYTQOViGh0:LUBuO2GRwbOgA6/dWpYD3fxcYi66HKW5
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies registry class 13 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\h_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\h_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.h rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\.h\ = "h_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\h_auto_file\shell\edit\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\h_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\h_auto_file\shell\open\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\h_auto_file\shell\open rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\h_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\h_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\h_auto_file\shell\edit rundll32.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 844 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 824 chrome.exe 824 chrome.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe Token: SeShutdownPrivilege 824 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe 824 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 936 wrote to memory of 1748 936 cmd.exe 29 PID 936 wrote to memory of 1748 936 cmd.exe 29 PID 936 wrote to memory of 1748 936 cmd.exe 29 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 1748 wrote to memory of 844 1748 rundll32.exe 30 PID 824 wrote to memory of 1604 824 chrome.exe 33 PID 824 wrote to memory of 1604 824 chrome.exe 33 PID 824 wrote to memory of 1604 824 chrome.exe 33 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1856 824 chrome.exe 35 PID 824 wrote to memory of 1148 824 chrome.exe 36 PID 824 wrote to memory of 1148 824 chrome.exe 36 PID 824 wrote to memory of 1148 824 chrome.exe 36 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37 PID 824 wrote to memory of 544 824 chrome.exe 37
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\SESmartIDCore\include\secommon\se_geometry.h1⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SESmartIDCore\include\secommon\se_geometry.h2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\SESmartIDCore\include\secommon\se_geometry.h3⤵
- Opens file in notepad (likely ransom note)
PID:844
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6849758,0x7fef6849768,0x7fef68497782⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:22⤵PID:1856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1552 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:82⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1676 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:82⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2204 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:12⤵PID:2012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:12⤵PID:316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1444 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:22⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1428 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:12⤵PID:2320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4160 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:82⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4304 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:82⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4284 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:82⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4512 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:82⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4184 --field-trial-handle=1212,i,6328390335170490124,2166138487916369238,131072 /prefetch:12⤵PID:2616
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1124
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3ccb28d6-d8f4-4aac-a971-2dfe2540cb97.tmp
Filesize4KB
MD50531ddbfd2c5a61548379bbb04a6d559
SHA1b4773dbf80823ebeb7945666e79a4c68684a99a8
SHA2560291492a77fd713ad97a7e5a02d8e780f9beebcd2a9c3f2823b6cd409e9b44a6
SHA512d8ce91ba052746de4e89cb7926fdf47057edf23f9866efe910e8365e7c28ac953cc87354956698bf59788075f6b540a191df6b477473f7aa0e39c070f292370b
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp
Filesize16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389