Analysis
-
max time kernel
141s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
17/11/2024, 15:12
Behavioral task
behavioral1
Sample
ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe
Resource
win10v2004-20241007-en
General
-
Target
ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe
-
Size
64KB
-
MD5
4a76a4e930bec401bea9deb37512c9e0
-
SHA1
ddd938da715326a366b97d800698edac2fae4749
-
SHA256
ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017
-
SHA512
db6d5d9408eedc99f796173a6e4fc938810746b15e6176af780041fd74b39f119c127a21b4631230e59a695ccdfddca3aa57392bb1af9383b22716b8ac0c6200
-
SSDEEP
1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIII0:8g585LpPCrQt7F84IIIIIIIIIIIIIIIW
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSlm.exe" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSlm.exe" SMSSlm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSlm.exe" SMSSlm.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSSlm.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSSlm.exe -
resource yara_rule behavioral1/files/0x00080000000120fd-4.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 1156 SMSSlm.exe 2180 SMSSlm.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\SMSSlm.exe" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\LOOKUP.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHLEX.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBlankPage.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewFrame.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHSRN.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Fancy.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Thatch.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Traditional.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PROTTPLN.DOC SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsMacroTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Classic.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHKEY.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OCRVC.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHLTS.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewFrame.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsColorChart.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsMacroTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsDoNotTrust.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsImageTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsImageTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ENGIDX.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\DefaultBlackAndWhite.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHPHN.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsFormTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplateRTL.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Perspective.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPrintTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OUTLFLTR.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\AccessWeb\CLNTWRAP.HTM SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPrintTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OSPP.HTM SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Distinctive.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Simple.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\OUTFORM.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PROTTPLV.DOC SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Elegant.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\JFONT.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OCRHC.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ENGDIC.DAT SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Default.dotx SMSSlm.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsVersion1Warning.htm SMSSlm.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewFrame.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsColorChart.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe File opened for modification C:\Windows\svchost.exe SMSSlm.exe File created C:\Windows\message.htm SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Crack.exe SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsMacroTemplate.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplate.html SMSSlm.exe File created C:\Windows\SMSSlm.exe ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplate.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplateRTL.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\BearShare Pro 4.3.0 Keygen.exe SMSSlm.exe File created C:\Windows\SMSSlm.exe SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplate.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsVersion1Warning.htm SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Crack.exe SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Keygen.exe SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBlankPage.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBrowserUpgrade.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsMacroTemplate.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplateRTL.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsColorChart.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewTemplate.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Crack.exe SMSSlm.exe File opened for modification C:\Windows\SMSSlm.exe ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Crack.exe SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\CLNTWRAP.HTM SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsDoNotTrust.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\OSPP.HTM SMSSlm.exe File created C:\Windows\svchost.exe ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplateRTL.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\iMesh 4.2 Ad Remover Crack.exe SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Crack.exe SMSSlm.exe File created C:\Windows\SMSSlm.exe SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsImageTemplate.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsVersion1Warning.htm SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Keygen.exe SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Borland C++ BuilderX 1.0 Enterprise Edition Keygen.exe SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Crack.exe SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\BearShare Pro 4.3.0 Keygen.exe SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplate.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsHomePage.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsImageTemplate.html SMSSlm.exe File opened for modification C:\Windows\svchost.exe SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBlankPage.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBrowserUpgrade.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplate.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplate.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\iMesh 4.2 Ad Remover Crack.exe SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Keygen.exe SMSSlm.exe File created C:\Windows\message.dat SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsHomePage.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewFrame.html SMSSlm.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewTemplate.html SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Keygen.exe SMSSlm.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Borland C++ BuilderX 1.0 Enterprise Edition Keygen.exe SMSSlm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMSSlm.exe -
Modifies data under HKEY_USERS 44 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\LangTuneUp = "OfficeCompleted" SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0 SMSSlm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\WinXPLanguagePatch = "1" SMSSlm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\InstallLanguage = "1033" SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\SharePointDesignerChangeInstallLanguage = "No" SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\ProjectChangeInstallLanguage = "No" SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software SMSSlm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\HelpLanguage = "1033" SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\WordChangeInstallLanguage = "No" SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\PPTChangeInstallLanguage = "No" SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\InfoPathChangeInstallLanguage = "No" SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages\1033 = "On" SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources SMSSlm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\UISnapshot = 31003000330033000000 SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\OneNoteChangeInstallLanguage = "No" SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\WebDesignerChangeInstallLanguage = "No" SMSSlm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\UILanguage = "1033" SMSSlm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\PreviousInstallLanguage = "1033" SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\PublisherChangeInstallLanguage = "No" SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SMSSlm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SMSSlm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 01000000000000007000d9290339db01 SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\WordMailChangeInstallLanguage = "No" SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\XLChangeInstallLanguage = "No" SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\OutlookChangeInstallLanguage = "No" SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies SMSSlm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\UIFallback = 30003b0031003000330033000000 SMSSlm.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\HelpFallback = 30003b0031003000330033000000 SMSSlm.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\AccessChangeInstallLanguage = "No" SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared SMSSlm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared\OfficeUILanguage = "1033" SMSSlm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion SMSSlm.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2180 SMSSlm.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1156 2004 ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe 30 PID 2004 wrote to memory of 1156 2004 ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe 30 PID 2004 wrote to memory of 1156 2004 ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe 30 PID 2004 wrote to memory of 1156 2004 ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe"C:\Users\Admin\AppData\Local\Temp\ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SMSSlm.exe"C:\Windows\SMSSlm.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
PID:1156
-
-
C:\Windows\SMSSlm.exeC:\Windows\SMSSlm.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2180
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD54a76a4e930bec401bea9deb37512c9e0
SHA1ddd938da715326a366b97d800698edac2fae4749
SHA256ad42757c8047eb19d63802fe648dab5ed361d0541d397febf33b8b47a1309017
SHA512db6d5d9408eedc99f796173a6e4fc938810746b15e6176af780041fd74b39f119c127a21b4631230e59a695ccdfddca3aa57392bb1af9383b22716b8ac0c6200
-
Filesize
88KB
MD584b61b37074a65e5aa03f387be522d59
SHA102f623ef7a8be858b7921a173c2ec53635b879cb
SHA2566f585632c22adfaf37952a7adcef260014f72bfdcb69e729ca568e6fb6691f3b
SHA512264b390be497ff44deec22f081cc772d57c5f85c8d6ecbf08f04a2ae3ecf3b86a83c30085cd32ff99d445a9bf76c106a7f308c3b631afed8427c1d70d70948a1
-
Filesize
88KB
MD53500da4b2317ad36ceeae88ebba98f47
SHA116303f881930b076717c6ca78ddcc9fcb8891901
SHA2564e2398f6744cb560a9c848604fc2c51695702e6f746435245fcd0f5a3313a0ba
SHA512bdb2b4e5ceff9bedeb68c403095fa7f6830eff2e314577e7fc75649d86b6eb596c23bd070b3177749963904b6268e429cd6a667fc3b9b8d3bec42cd64ea3f29f
-
Filesize
64KB
MD54c0f811440f10527601a6e7a7b99833e
SHA158057ca967d63250ae3b0888a6f01ec5da031bca
SHA25617f0d109fd57d3ce2a21e5c541ebb9e66c441c25892e875f609bb6648bb15728
SHA5122dfb5bbfca13fca4fb22c28a623795b7c4ddc89e6bde24ff2dcac3418fbc13949fa02779e529d6654dd94ec256a199a140b0d56daa971a3cdaf16b721ace01d6