Overview

overview

9

Static

static

3

smert.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    31s
  • max time network
    41s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 02:56

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    smert.exe

  • Size

    143KB

  • MD5

    c8be4a8780add1b2d541acadc515f14e

  • SHA1

    7df3c3216403d10317fae70df7dfda8886e31d18

  • SHA256

    2b809e288a8b39018ca5b2592e8e38ce25b49fdceac028c799f4e0f522b92207

  • SHA512

    e4ba73cd5d597edd48ff7a05b410138fa5c65bcce050bf59ee07fedc4da7574804bf4c941b06f0040d943fb919c294c86b08df5b25953a369c6a3199067d6b0b

  • SSDEEP

    3072:jNp8AZVBeARr/BKXVVkCd4xFuSrqzpsrq6L:nbBeAB/BcXuxMg

Score
9/10
ransomware

Malware Config

Signatures

  • Renames multiple (761) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Drivers directory 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\smert.exe
    "C:\Users\Admin\AppData\Local\Temp\smert.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4616
    • C:\Users\Admin\AppData\Local\Temp\smert.exe
      "C:\Users\Admin\AppData\Local\Temp\smert.exe" --food
      2⤵
      • Drops file in Drivers directory
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Drops file in Windows directory
      PID:4040
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
    1⤵
      PID:5328

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Windows Media Player\es-ES\wmlaunch.exe.mui.smert
      Filesize

      2KB

      MD5

      d740501e533de96ce6e9fa50e0b2782a

      SHA1

      c07e4c7007d04d30ba4c1c62a8afef8ed948800f

      SHA256

      2d432ce73f1ca766a700565f31094cc13685a08b39e262e0a4c89e371905f3a1

      SHA512

      363b0b51a9cf3b3d4b0ec74b869044ed6f073755152158323580052c6861b7aa1ae2102ecbe73eccae0dc8fca67ffcfc7dd558392ae90bbe2ca07761088466dd

      Download Submit

    • C:\Users\Admin\Documents\README.txt
      Filesize

      19B

      MD5

      cd0005971dd81c61d5be812f33a2b35e

      SHA1

      01f1ad380bb99d1a80e4fc1800c1b4e5f72e19d9

      SHA256

      e6d506e4376528c4ac030840c4c49d3501b85d1fdd6f367b4c8100c444d528af

      SHA512

      8b6d984ea0c15851f22fd8ea5f8c7925b2d2caacdd81dc5ed301d71feffb08b71dd95d16dee83c2a945e263e3e7b15e6706e2df691c4462f81aa3bae1821ebad

      Download Submit

    • memory/5328-5720-0x000002A94D780000-0x000002A94D790000-memory.dmp

      Filesize

      64KB

      Download

    • memory/5328-5726-0x000002A94D7E0000-0x000002A94D7F0000-memory.dmp

      Filesize

      64KB

      Download