Malware Analysis Report

2025-06-16 00:48

Sample ID 241107-2ynlcssneq
Target ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN
SHA256 ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99b
Tags
discovery evasion execution
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99b

Threat Level: Likely malicious

The file ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN was found to be: Likely malicious.

Malicious Activity Summary

discovery evasion execution

Stops running service(s)

Loads dropped DLL

Executes dropped EXE

Drops file in System32 directory

Launches sc.exe

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-07 22:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-07 22:59

Reported

2024-11-07 23:01

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe"

Signatures

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe N/A
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\1230\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\Service.exe C:\Windows\SysWOW64\1230\smss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\1230\smss.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe N/A
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2004 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2004 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2004 wrote to memory of 1624 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2004 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2004 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2004 wrote to memory of 4648 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2004 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2004 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2004 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\1230\smss.exe
PID 3964 wrote to memory of 3112 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 3964 wrote to memory of 3112 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 3964 wrote to memory of 3112 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 3964 wrote to memory of 2972 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 3964 wrote to memory of 2972 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 3964 wrote to memory of 2972 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe

"C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe"

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop SharedAccess

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

C:\Windows\SysWOW64\1230\smss.exe

C:\Windows\system32\1230\smss.exe -d

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop SharedAccess

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 98.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

C:\Windows\SysWOW64\1230\smss.exe

MD5 fb5db98f18a508f68a640174ac549319
SHA1 2209a54c21af3150f468e51a4f7c93b8ba8ee167
SHA256 097b33faba2c4d87f346a99d21e0232fd737dedebfe5691500b620962dfa8d63
SHA512 caf5814caa9c92b116bf0c5da7409375e69e2ccd3ff09029cae98cb3a50760167fbd1d9c35c222b9b4b733c2da9acfb92713ee41f508189dc3bddd4b02646df6

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-07 22:59

Reported

2024-11-07 23:01

Platform

win7-20240903-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe"

Signatures

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\Service.exe C:\Windows\SysWOW64\1230\smss.exe N/A
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe N/A
File opened for modification C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\1230\smss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\1230\smss.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe N/A
N/A N/A C:\Windows\SysWOW64\1230\smss.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2168 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2168 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2168 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2168 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2168 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2168 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2168 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2168 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\sc.exe
PID 2168 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2168 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2168 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2168 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe C:\Windows\SysWOW64\1230\smss.exe
PID 2220 wrote to memory of 2900 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2220 wrote to memory of 2900 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2220 wrote to memory of 2900 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2220 wrote to memory of 2900 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2220 wrote to memory of 2696 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2220 wrote to memory of 2696 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2220 wrote to memory of 2696 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe
PID 2220 wrote to memory of 2696 N/A C:\Windows\SysWOW64\1230\smss.exe C:\Windows\SysWOW64\sc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe

"C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe"

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop SharedAccess

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

C:\Windows\SysWOW64\1230\smss.exe

C:\Windows\system32\1230\smss.exe -d

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop SharedAccess

C:\Windows\SysWOW64\sc.exe

C:\Windows\system32\sc.exe stop wscsvc

Network

N/A

Files

\Windows\SysWOW64\1230\smss.exe

MD5 e27ad002701b1e6283b6bb434940f7b2
SHA1 5a18385185b89838c041a6df8a7264bfaed0f292
SHA256 2e6ea3ea6538a5a19b70f8a19962f316a77952336989287ab826b462a6062681
SHA512 a7c50e4488e59b1f4c3edbc73114ce557d21bccfdd1762914cbe855d7714e906ede2f7854dd90a6b55f298b4ba02bba5d67ae1c7f0ba29aa915f77ac705486e4