Analysis Overview
SHA256
ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99b
Threat Level: Likely malicious
The file ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN was found to be: Likely malicious.
Malicious Activity Summary
Stops running service(s)
Loads dropped DLL
Executes dropped EXE
Drops file in System32 directory
Launches sc.exe
System Location Discovery: System Language Discovery
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-07 22:59
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-07 22:59
Reported
2024-11-07 23:01
Platform
win10v2004-20241007-en
Max time kernel
94s
Max time network
95s
Command Line
Signatures
Stops running service(s)
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\1230\smss.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\1230\smss.exe | C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\1230\smss.exe | C:\Windows\SysWOW64\1230\smss.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\Service.exe | C:\Windows\SysWOW64\1230\smss.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\1230\smss.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\1230\smss.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe
"C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe"
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe stop SharedAccess
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe stop wscsvc
C:\Windows\SysWOW64\1230\smss.exe
C:\Windows\system32\1230\smss.exe -d
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe stop SharedAccess
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe stop wscsvc
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 13.86.106.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 28.118.140.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 98.209.201.84.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 19.229.111.52.in-addr.arpa | udp |
Files
C:\Windows\SysWOW64\1230\smss.exe
| MD5 | fb5db98f18a508f68a640174ac549319 |
| SHA1 | 2209a54c21af3150f468e51a4f7c93b8ba8ee167 |
| SHA256 | 097b33faba2c4d87f346a99d21e0232fd737dedebfe5691500b620962dfa8d63 |
| SHA512 | caf5814caa9c92b116bf0c5da7409375e69e2ccd3ff09029cae98cb3a50760167fbd1d9c35c222b9b4b733c2da9acfb92713ee41f508189dc3bddd4b02646df6 |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-07 22:59
Reported
2024-11-07 23:01
Platform
win7-20240903-en
Max time kernel
119s
Max time network
120s
Command Line
Signatures
Stops running service(s)
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\1230\smss.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\Service.exe | C:\Windows\SysWOW64\1230\smss.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\1230\smss.exe | C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\1230\smss.exe | C:\Windows\SysWOW64\1230\smss.exe | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\1230\smss.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\sc.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\1230\smss.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe
"C:\Users\Admin\AppData\Local\Temp\ccb6dd3ab068fec6f8716c0cb62d9fed347538995486497c5c2ef088efb0a99bN.exe"
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe stop SharedAccess
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe stop wscsvc
C:\Windows\SysWOW64\1230\smss.exe
C:\Windows\system32\1230\smss.exe -d
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe stop SharedAccess
C:\Windows\SysWOW64\sc.exe
C:\Windows\system32\sc.exe stop wscsvc
Network
Files
\Windows\SysWOW64\1230\smss.exe
| MD5 | e27ad002701b1e6283b6bb434940f7b2 |
| SHA1 | 5a18385185b89838c041a6df8a7264bfaed0f292 |
| SHA256 | 2e6ea3ea6538a5a19b70f8a19962f316a77952336989287ab826b462a6062681 |
| SHA512 | a7c50e4488e59b1f4c3edbc73114ce557d21bccfdd1762914cbe855d7714e906ede2f7854dd90a6b55f298b4ba02bba5d67ae1c7f0ba29aa915f77ac705486e4 |