Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2023 14:12
Static task
static1
Behavioral task
behavioral1
Sample
bae2d7a4aa83d9443f46561543c410b4.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
bae2d7a4aa83d9443f46561543c410b4.exe
Resource
win10v2004-20231215-en
General
-
Target
bae2d7a4aa83d9443f46561543c410b4.exe
-
Size
144KB
-
MD5
bae2d7a4aa83d9443f46561543c410b4
-
SHA1
e16573ae071329b1f4203dcdc32e3fcddc9e8018
-
SHA256
ff3c37194588b0ab57806755deda730040c591668356edb8d461ef85e357196b
-
SHA512
0f9159c9209bbe82480806dcebfc3f4e09cdbb4fe70241555e71ca3eb311e990313fbe9368d2737f8cbde3578b6136b600919196cabc072d689d513eaae2cb0f
-
SSDEEP
3072:RZoPg8mxPhquqY+geqKV6i5blkFaEUiS:RiwhYge7VTOaiS
Malware Config
Extracted
smokeloader
2020
http://varmisende.com/upload/
http://fernandomayol.com/upload/
http://nextlytm.com/upload/
http://people4jan.com/upload/
http://asfaltwerk.com/upload/
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
B621.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1wk9111k71ga59.exe B621.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\1wk9111k71ga59.exe\DisableExceptionChainValidation B621.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "uoumkmz.exe" explorer.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Deletes itself 1 IoCs
Processes:
pid process 3604 -
Executes dropped EXE 1 IoCs
Processes:
B621.exepid process 4328 B621.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Java Updater = "C:\\ProgramData\\Java Updater\\1wk9111k71ga59.exe" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java Updater = "\"C:\\ProgramData\\Java Updater\\1wk9111k71ga59.exe\"" explorer.exe -
Processes:
B621.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B621.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
Processes:
B621.exeexplorer.exepid process 4328 B621.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 316 1252 WerFault.exe explorer.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
bae2d7a4aa83d9443f46561543c410b4.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bae2d7a4aa83d9443f46561543c410b4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bae2d7a4aa83d9443f46561543c410b4.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bae2d7a4aa83d9443f46561543c410b4.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
B621.exeexplorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString B621.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 B621.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bae2d7a4aa83d9443f46561543c410b4.exepid process 4896 bae2d7a4aa83d9443f46561543c410b4.exe 4896 bae2d7a4aa83d9443f46561543c410b4.exe 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 3604 -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
bae2d7a4aa83d9443f46561543c410b4.exeB621.exepid process 4896 bae2d7a4aa83d9443f46561543c410b4.exe 4328 B621.exe 4328 B621.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
B621.exeexplorer.exedescription pid process Token: SeDebugPrivilege 4328 B621.exe Token: SeRestorePrivilege 4328 B621.exe Token: SeBackupPrivilege 4328 B621.exe Token: SeLoadDriverPrivilege 4328 B621.exe Token: SeCreatePagefilePrivilege 4328 B621.exe Token: SeShutdownPrivilege 4328 B621.exe Token: SeTakeOwnershipPrivilege 4328 B621.exe Token: SeChangeNotifyPrivilege 4328 B621.exe Token: SeCreateTokenPrivilege 4328 B621.exe Token: SeMachineAccountPrivilege 4328 B621.exe Token: SeSecurityPrivilege 4328 B621.exe Token: SeAssignPrimaryTokenPrivilege 4328 B621.exe Token: SeCreateGlobalPrivilege 4328 B621.exe Token: 33 4328 B621.exe Token: SeDebugPrivilege 1252 explorer.exe Token: SeRestorePrivilege 1252 explorer.exe Token: SeBackupPrivilege 1252 explorer.exe Token: SeLoadDriverPrivilege 1252 explorer.exe Token: SeCreatePagefilePrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeTakeOwnershipPrivilege 1252 explorer.exe Token: SeChangeNotifyPrivilege 1252 explorer.exe Token: SeCreateTokenPrivilege 1252 explorer.exe Token: SeMachineAccountPrivilege 1252 explorer.exe Token: SeSecurityPrivilege 1252 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1252 explorer.exe Token: SeCreateGlobalPrivilege 1252 explorer.exe Token: 33 1252 explorer.exe Token: SeShutdownPrivilege 3604 Token: SeCreatePagefilePrivilege 3604 -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
B621.exedescription pid process target process PID 3604 wrote to memory of 4328 3604 B621.exe PID 3604 wrote to memory of 4328 3604 B621.exe PID 3604 wrote to memory of 4328 3604 B621.exe PID 4328 wrote to memory of 1252 4328 B621.exe explorer.exe PID 4328 wrote to memory of 1252 4328 B621.exe explorer.exe PID 4328 wrote to memory of 1252 4328 B621.exe explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bae2d7a4aa83d9443f46561543c410b4.exe"C:\Users\Admin\AppData\Local\Temp\bae2d7a4aa83d9443f46561543c410b4.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\B621.exeC:\Users\Admin\AppData\Local\Temp\B621.exe1⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1252 -s 11443⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1252 -ip 12521⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\B621.exeFilesize
360KB
MD5e5c190fbfeeaad6ccccd410e006aabf5
SHA14241efe078d15132644015724fa2e1682aa70012
SHA256a20dcba5fd3bf777bc953aa6a248883c1a2a9536d4dc2d1296fc3ce061080509
SHA5123fdf563cef22e7ec81658ab9597c173371f72a2d00dd9126a443b7766a12bcb08b26bf6caed6c14a5a92917c04cf79f323cc6899c07f5b29f4feb4e5f2fc579f
-
memory/1252-25-0x00000000006B0000-0x0000000000AE4000-memory.dmpFilesize
4.2MB
-
memory/1252-38-0x0000000000520000-0x00000000005E4000-memory.dmpFilesize
784KB
-
memory/1252-37-0x00000000006B0000-0x0000000000AE3000-memory.dmpFilesize
4.2MB
-
memory/1252-35-0x0000000004470000-0x0000000004472000-memory.dmpFilesize
8KB
-
memory/1252-28-0x0000000000520000-0x00000000005E4000-memory.dmpFilesize
784KB
-
memory/1252-31-0x0000000000520000-0x00000000005E4000-memory.dmpFilesize
784KB
-
memory/1252-29-0x0000000000520000-0x00000000005E4000-memory.dmpFilesize
784KB
-
memory/1252-27-0x00000000006B0000-0x0000000000AE4000-memory.dmpFilesize
4.2MB
-
memory/3604-4-0x0000000002200000-0x0000000002215000-memory.dmpFilesize
84KB
-
memory/4328-15-0x0000000000010000-0x000000000006D000-memory.dmpFilesize
372KB
-
memory/4328-17-0x00000000022B0000-0x0000000002316000-memory.dmpFilesize
408KB
-
memory/4328-22-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB
-
memory/4328-24-0x00000000022B0000-0x0000000002316000-memory.dmpFilesize
408KB
-
memory/4328-23-0x0000000002830000-0x000000000283C000-memory.dmpFilesize
48KB
-
memory/4328-19-0x0000000077644000-0x0000000077645000-memory.dmpFilesize
4KB
-
memory/4328-18-0x00000000009E0000-0x00000000009ED000-memory.dmpFilesize
52KB
-
memory/4328-20-0x00000000022B0000-0x0000000002316000-memory.dmpFilesize
408KB
-
memory/4328-34-0x00000000022B0000-0x0000000002316000-memory.dmpFilesize
408KB
-
memory/4328-33-0x0000000002820000-0x0000000002821000-memory.dmpFilesize
4KB
-
memory/4896-8-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/4896-1-0x00000000022A0000-0x00000000023A0000-memory.dmpFilesize
1024KB
-
memory/4896-5-0x0000000000400000-0x0000000002142000-memory.dmpFilesize
29.3MB
-
memory/4896-3-0x0000000000400000-0x0000000002142000-memory.dmpFilesize
29.3MB
-
memory/4896-2-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB