Analysis
-
max time kernel
141s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 17:56
Behavioral task
behavioral1
Sample
1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe
Resource
win7-20240729-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe
-
Size
62KB
-
MD5
fb7f1c3c694ea35946a1fe0415f882de
-
SHA1
c51196f374e9f21a7086f24929ab20a257432873
-
SHA256
1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2
-
SHA512
7e7ecea62af28573761848d2742aa9cff02e4dcfa74b3b918545ebd42add3b051e7afb4ef66e1fc900e8c917d18e1771175cbf80495334f3d26497556f707385
-
SSDEEP
1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIIIDIIIIIC:8g585LpPCrQt7F84IIIIIIIIIIIIIIIU
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSvx.exe" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSvx.exe" SMSSvx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSvx.exe" SMSSvx.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSSvx.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSSvx.exe -
resource yara_rule behavioral1/files/0x00080000000120fd-6.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 2956 SMSSvx.exe 2716 SMSSvx.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\SMSSvx.exe" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Simple.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OCRHC.DAT SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PROTTPLN.DOC SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\LOOKUP.DAT SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Elegant.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsDoNotTrust.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewFrame.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OUTLFLTR.DAT SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Default.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsVersion1Warning.htm SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewFrame.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsImageTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHLTS.DAT SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Newsprint.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PROTTPLV.DOC SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\AccessWeb\CLNTWRAP.HTM SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OSPP.HTM SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Classic.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Manuscript.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Modern.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHPHN.DAT SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Fancy.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsMacroTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBlankPage.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsColorChart.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsMacroTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsColorChart.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplateRTL.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ENGDIC.DAT SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Formal.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Distinctive.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Perspective.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Traditional.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPrintTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewFrame.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPrintTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\DefaultBlackAndWhite.dotx SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsFormTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHSRN.DAT SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\JFONT.DAT SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHKEY.DAT SMSSvx.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm SMSSvx.exe -
Drops file in Windows directory 54 IoCs
description ioc Process File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplate.html SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplateRTL.html SMSSvx.exe File opened for modification C:\Windows\SMSSvx.exe 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Dragon NaturallySpeaking 8 ISO Multilanguage Crack.exe SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewFrame.html SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\OSPP.HTM SMSSvx.exe File created C:\Windows\svchost.exe 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Crack.exe SMSSvx.exe File opened for modification C:\Windows\svchost.exe SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\CLNTWRAP.HTM SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsMacroTemplate.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsColorChart.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplate.html SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsDoNotTrust.html SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewTemplate.html SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBlankPage.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBlankPage.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsVersion1Warning.htm SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplate.html SMSSvx.exe File created C:\Windows\message.htm SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Crack.exe SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBrowserUpgrade.html SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplateRTL.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Dragon NaturallySpeaking 8 ISO Multilanguage Crack.exe SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Keygen.exe SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsColorChart.html SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplate.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewTemplate.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsImageTemplate.html SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Crack.exe SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplate.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBrowserUpgrade.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsMacroTemplate.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Keygen.exe SMSSvx.exe File opened for modification C:\Windows\svchost.exe SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsImageTemplate.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplate.html SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplateRTL.html SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsHomePage.html SMSSvx.exe File created C:\Windows\SMSSvx.exe SMSSvx.exe File created C:\Windows\SMSSvx.exe SMSSvx.exe File created C:\Windows\message.dat SMSSvx.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Crack.exe SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsHomePage.html SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsVersion1Warning.htm SMSSvx.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewFrame.html SMSSvx.exe File created C:\Windows\SMSSvx.exe 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMSSvx.exe -
Modifies data under HKEY_USERS 44 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\WordMailChangeInstallLanguage = "No" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\XLChangeInstallLanguage = "No" SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0 SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common SMSSvx.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\HelpFallback = 30003b0031003000330033000000 SMSSvx.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\WinXPLanguagePatch = "1" SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SMSSvx.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\UILanguage = "1033" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages\1033 = "On" SMSSvx.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared\OfficeUILanguage = "1033" SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office SMSSvx.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\HelpLanguage = "1033" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\PublisherChangeInstallLanguage = "No" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\InfoPathChangeInstallLanguage = "No" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\OneNoteChangeInstallLanguage = "No" SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System SMSSvx.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\PreviousInstallLanguage = "1033" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\OutlookChangeInstallLanguage = "No" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\ProjectChangeInstallLanguage = "No" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\WebDesignerChangeInstallLanguage = "No" SMSSvx.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSSvx.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 010000000000000090e8618d753bdb01 SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources SMSSvx.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\UIFallback = 30003b0031003000330033000000 SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion SMSSvx.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\UISnapshot = 31003000330033000000 SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\PPTChangeInstallLanguage = "No" SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT SMSSvx.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\InstallLanguage = "1033" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\AccessChangeInstallLanguage = "No" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\SharePointDesignerChangeInstallLanguage = "No" SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\LangTuneUp = "OfficeCompleted" SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles SMSSvx.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SMSSvx.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources\WordChangeInstallLanguage = "No" SMSSvx.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem SMSSvx.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2716 SMSSvx.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2956 1856 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe 30 PID 1856 wrote to memory of 2956 1856 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe 30 PID 1856 wrote to memory of 2956 1856 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe 30 PID 1856 wrote to memory of 2956 1856 1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe"C:\Users\Admin\AppData\Local\Temp\1ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SMSSvx.exe"C:\Windows\SMSSvx.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
PID:2956
-
-
C:\Windows\SMSSvx.exeC:\Windows\SMSSvx.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2716
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5fb7f1c3c694ea35946a1fe0415f882de
SHA1c51196f374e9f21a7086f24929ab20a257432873
SHA2561ef6cd42023e9b6fca4168019bd49b8b3544a28541c041cd2c22e073ec1f9ab2
SHA5127e7ecea62af28573761848d2742aa9cff02e4dcfa74b3b918545ebd42add3b051e7afb4ef66e1fc900e8c917d18e1771175cbf80495334f3d26497556f707385
-
Filesize
86KB
MD568c6a6a15a2a9fd70378fca2e1f1f81a
SHA1026f06c7708d11a856569f15ee772c73c8d5c708
SHA256a41d21f7dd2059040cdc951be92a49ae881492c181fdacaebaab752cad750466
SHA512983173ebc7f3c498889582f42cae9b2c6fca5e212942e5c5cf9db7dfa44ca82ad6b1f055b86122f9404dd36e82e1890cad963a704042f1a14e86aaaf18c40c10
-
Filesize
85KB
MD5e48e177a74a95b3b117d18c69f2d77df
SHA15d3a3c8fcb299478951a180a7902d06c3ae2fa66
SHA25632a05ef7766e5bb6e57e367610e4bfa206150f230190b29c3f711dc19a706211
SHA512d1d01e20ff6096cd129527f6dcea6c1e2285ad855087f67e17af202c9e3f346b5571ea0c40f89a5d02cd63231016e37c3a29f560bdcbaf5b1df470f591a2a8c6