Analysis Overview
SHA256
6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27
Threat Level: Known bad
The file 6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27 was found to be: Known bad.
Malicious Activity Summary
SmokeLoader
Suspicious use of SetThreadContext
Unsigned PE
Uses Task Scheduler COM API
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Suspicious use of SendNotifyMessage
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2023-06-26 05:00
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-06-26 05:00
Reported
2023-06-26 05:06
Platform
win7-20230621-en
Max time kernel
300s
Max time network
29s
Command Line
Signatures
SmokeLoader
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1632 set thread context of 1464 | N/A | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe
"C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe"
C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe
"C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe"
Network
Files
memory/1464-55-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1464-56-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1632-57-0x0000000000220000-0x0000000000229000-memory.dmp
memory/1464-58-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1372-59-0x00000000021B0000-0x00000000021C6000-memory.dmp
memory/1464-60-0x0000000000400000-0x0000000000409000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-06-26 05:00
Reported
2023-06-26 05:06
Platform
win10v2004-20230621-en
Max time kernel
300s
Max time network
286s
Command Line
Signatures
SmokeLoader
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 4660 set thread context of 4212 | N/A | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe |
Checks SCSI registry key(s)
| Description | Indicator | Process | Target |
| Key queried | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
| Key enumerated | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Suspicious behavior: MapViewOfSection
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeShutdownPrivilege | N/A | N/A | N/A |
| Token: SeCreatePagefilePrivilege | N/A | N/A | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of SendNotifyMessage
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Processes
C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe
"C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe"
C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe
"C:\Users\Admin\AppData\Local\Temp\6fe7ba44d70927fd40d24aeb610d01888609122c75d35be1f4a0dbadbc6c0c27.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 40.126.32.138:443 | tcp | |
| NL | 40.126.32.74:443 | tcp | |
| US | 8.8.8.8:53 | serverlogs37.xyz | udp |
| IE | 40.127.169.103:443 | tcp | |
| NL | 40.126.32.140:443 | tcp | |
| IE | 40.127.169.103:443 | tcp | |
| US | 192.229.221.95:80 | tcp | |
| US | 93.184.221.240:80 | tcp | |
| NL | 20.190.160.17:443 | tcp | |
| IE | 40.127.169.103:443 | tcp | |
| NL | 40.126.32.134:443 | tcp | |
| IE | 40.127.169.103:443 | tcp | |
| NL | 20.190.160.14:443 | tcp | |
| IE | 40.127.169.103:443 | tcp | |
| IE | 40.127.169.103:443 | tcp | |
| IE | 40.127.169.103:443 | tcp | |
| IE | 40.127.169.103:443 | tcp | |
| US | 8.8.8.8:53 | 2.36.159.162.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| IE | 40.127.169.103:443 | tcp | |
| IE | 40.127.169.103:443 | tcp |
Files
memory/4212-134-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4660-135-0x0000000001C00000-0x0000000001C09000-memory.dmp
memory/4212-136-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4212-138-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3220-137-0x0000000000DA0000-0x0000000000DB6000-memory.dmp