2de55f60d3815a84a49ca77e377539cb2c13d23be6a873b5d3897f60c5e81e5b

General

Target

f61a96c699b217ecd4f8aad6fec54e10N.exe
Size

139KB
MD5

f61a96c699b217ecd4f8aad6fec54e10
SHA1

0978f4becfdc96fa331fbe04ecf851f3bdb5f85a
SHA256

2de55f60d3815a84a49ca77e377539cb2c13d23be6a873b5d3897f60c5e81e5b
SHA512

6de0a1ddac15591dadc2b1c2ea1d7240ea9709244d4951004916697aeb32ca49db9a47b14447c39afa1444c23d0032b5d64efcb90dc819fdb9be60455a0c90f5
SSDEEP

1536:rC2/fYuPfbESFYXRWhpKRycRd57JkIqFHhzm4hWru/BzihhMN45MF5FvHP132xPT:r7YubEwYXRWhpAJUHhzm4hUukS6Kmecl

Score

8^/10

discovery evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2536	smss.exe

Loads dropped DLL 2 IoCs

pid	Process
2360	f61a96c699b217ecd4f8aad6fec54e10N.exe
2360	f61a96c699b217ecd4f8aad6fec54e10N.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\1230\smss.exe	f61a96c699b217ecd4f8aad6fec54e10N.exe
File opened for modification	C:\Windows\SysWOW64\1230\smss.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\Service.exe	smss.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2088	sc.exe
2112	sc.exe
3032	sc.exe
3028	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f61a96c699b217ecd4f8aad6fec54e10N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2360	f61a96c699b217ecd4f8aad6fec54e10N.exe
2536	smss.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2088	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	30
PID 2360 wrote to memory of 2088	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	30
PID 2360 wrote to memory of 2088	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	30
PID 2360 wrote to memory of 2088	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	30
PID 2360 wrote to memory of 2112	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	32
PID 2360 wrote to memory of 2112	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	32
PID 2360 wrote to memory of 2112	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	32
PID 2360 wrote to memory of 2112	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	32
PID 2360 wrote to memory of 2536	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	34
PID 2360 wrote to memory of 2536	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	34
PID 2360 wrote to memory of 2536	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	34
PID 2360 wrote to memory of 2536	2360	f61a96c699b217ecd4f8aad6fec54e10N.exe	34
PID 2536 wrote to memory of 3032	2536	smss.exe	35
PID 2536 wrote to memory of 3032	2536	smss.exe	35
PID 2536 wrote to memory of 3032	2536	smss.exe	35
PID 2536 wrote to memory of 3032	2536	smss.exe	35
PID 2536 wrote to memory of 3028	2536	smss.exe	37
PID 2536 wrote to memory of 3028	2536	smss.exe	37
PID 2536 wrote to memory of 3028	2536	smss.exe	37
PID 2536 wrote to memory of 3028	2536	smss.exe	37

C:\Users\Admin\AppData\Local\Temp\f61a96c699b217ecd4f8aad6fec54e10N.exe
"C:\Users\Admin\AppData\Local\Temp\f61a96c699b217ecd4f8aad6fec54e10N.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe stop SharedAccess
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2088
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe stop wscsvc
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2112
- C:\Windows\SysWOW64\1230\smss.exe
  C:\Windows\system32\1230\smss.exe -d
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe stop SharedAccess
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3032
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe stop wscsvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\1230\smss.exe

Filesize
139KB

MD5
887fcc4dfddd020bdf4904253c740649

SHA1
90e9c4f964b84ba2c01c2028571edeeabba1a677

SHA256
8358ee5501863b6170322adcb8dbb034261751331beda2fc9e83619bab44e3fd

SHA512
c69cb76d2f051645e1a2639cc786b3efa62f1ca159432dc171422fbfb8e2f91b35f8f5a841014b486d27935b97dc9d55ed155982a9a24efa7b155ea2ffc52004

Download Submit

Analysis

Sharing