Analysis
-
max time kernel
85s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
19-06-2023 11:33
General
-
Target
e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe
-
Size
281KB
-
MD5
9769c181ecef69544bbb2f974b8c0e10
-
SHA1
5d0f447f4ccc89d7d79c0565372195240cdfa25f
-
SHA256
e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0
-
SHA512
b3da8fea6ee5d6b67f55a4043f18d7325f1700c9f3dcb0e7cbf21f49ebdbb56b5a10a2d03153d0dfb1e8dc34db20cdea0236c448f2c361fadbabf9a6f59b4c7a
-
SSDEEP
3072:Z5SXIMALRKEttgCWAbi1D1fJmxIV0BN3omE9MA5yXsztcJe9:GIMpEtCCWAbiBRmE9o6
Malware Config
Extracted
smokeloader
2022
http://serverlogs37.xyz/statweb255/
http://servblog757.xyz/statweb255/
http://dexblog45.xyz/statweb255/
http://admlogs.online/statweb255/
http://blogstat355.xyz/statweb255/
http://blogstatserv25.xyz/statweb255/
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Renames multiple (136) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Blocklisted process makes network request 2 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 2 IoCs
-
Drops startup file 1 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Drops desktop.ini file(s) 3 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 7 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 31 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe"C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe"C:\Users\Admin\AppData\Local\Temp\e142f4e8eb3fb4323fb377138f53db66e3e6ec9e82930f4b23dd91a5f7bd45d0.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\46EC.exeC:\Users\Admin\AppData\Local\Temp\46EC.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\497D.exeC:\Users\Admin\AppData\Local\Temp\497D.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\4BE0.exeC:\Users\Admin\AppData\Local\Temp\4BE0.exe1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4BE0.exe"C:\Users\Admin\AppData\Local\Temp\4BE0.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 2523⤵
- Program crash
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD581c50c607aee227fb6c2340b8660833d
SHA14da8afd7b340840e5ea409672b75e0c53828e30e
SHA2561d9d588ac814c60e4ad5fe9cb89e3fa135a1dd1e5d55b87cea51f48623e4cbb0
SHA5124d8558e5c3cf00f70e814633171b1338f20fca9bca36e32434c2cb2c01827229ba73faa1597998ee4b38b79d5c8205c3e4d13c7dac08206c0c56c943747e68b5
-
Filesize
281KB
MD52809e15a3a54484e042fe65fffd17409
SHA14a8f0331abaf8f629b3c8220f0d55339cfa30223
SHA256518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
SHA512698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3
-
Filesize
2.6MB
MD5e7ac55d61ab9cfcf180c92c1381a2fa1
SHA1f79fe555c492a9effe26ead87ec7eb3c53899083
SHA256afddec37cdc1d196a1136e2252e925c0dcfe587963069d78775e0f174ae9cfe3
SHA512e3fa85d3af3625384ecea090a7c205325825a1b91ad43e1f86f56a719ad733d71b4be9c34edd03d8ff774e28b3feb605dc073f66f4a01359f8e4bad5b8bcfae2
-
Filesize
2.6MB
MD5e7ac55d61ab9cfcf180c92c1381a2fa1
SHA1f79fe555c492a9effe26ead87ec7eb3c53899083
SHA256afddec37cdc1d196a1136e2252e925c0dcfe587963069d78775e0f174ae9cfe3
SHA512e3fa85d3af3625384ecea090a7c205325825a1b91ad43e1f86f56a719ad733d71b4be9c34edd03d8ff774e28b3feb605dc073f66f4a01359f8e4bad5b8bcfae2
-
Filesize
228KB
MD5d1f12c03b8ce33b36d8423b057c7d6c5
SHA1d6d0631a1f95e3972a803ed1c57b120815b2b5cf
SHA256c6bd5b8e14551eb899bbe4decb6942581d28b2a42b159146bbc28316e6e14a64
SHA51243b51f630d631d4f5cac97242595b25d07306280e183c22821f351af1fc2fc118b836df8bd8e06984f5e0cb21b25954dbd335666bd2cd2c5b98b22948bedbf41
-
Filesize
228KB
MD5d1f12c03b8ce33b36d8423b057c7d6c5
SHA1d6d0631a1f95e3972a803ed1c57b120815b2b5cf
SHA256c6bd5b8e14551eb899bbe4decb6942581d28b2a42b159146bbc28316e6e14a64
SHA51243b51f630d631d4f5cac97242595b25d07306280e183c22821f351af1fc2fc118b836df8bd8e06984f5e0cb21b25954dbd335666bd2cd2c5b98b22948bedbf41
-
Filesize
281KB
MD52809e15a3a54484e042fe65fffd17409
SHA14a8f0331abaf8f629b3c8220f0d55339cfa30223
SHA256518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
SHA512698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3
-
Filesize
281KB
MD52809e15a3a54484e042fe65fffd17409
SHA14a8f0331abaf8f629b3c8220f0d55339cfa30223
SHA256518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
SHA512698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3
-
Filesize
281KB
MD52809e15a3a54484e042fe65fffd17409
SHA14a8f0331abaf8f629b3c8220f0d55339cfa30223
SHA256518544e56e8ccee401ffa1b0a01a10ce23e49ec21ec441c6c7c3951b01c1b19c
SHA512698e16fd67861377e2ccaace4d0e1a619a8b7c68e8aefc4090e9d1cbbcdfb8d8aede76f9e63f81479f5a035e8008699a4d7175da6248e6e49eb7c81b3dba30c3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
2.6MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
36KB
-
Filesize
16KB
-
Filesize
16KB
-
Filesize
44KB
-
Filesize
32KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
48KB
-
Filesize
84KB
-
Filesize
36KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
468KB
-
Filesize
428KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
6.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
6.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
104KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
272KB
-
Filesize
216KB
-
Filesize
120KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
44KB
-
Filesize
60KB
-
Filesize
36KB
-
Filesize
16KB
-
Filesize
36KB
-
Filesize
16KB
-
Filesize
36KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
20KB
-
Filesize
36KB
-
Filesize
5.6MB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
248KB
-
Filesize
132KB
-
Filesize
156KB
-
Filesize
28KB
-
Filesize
52KB