Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:14
Behavioral task
behavioral1
Sample
e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe
Resource
win7-20240903-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe
-
Size
64KB
-
MD5
04e6b5760c4b7ce8217375ba3ce7914a
-
SHA1
dd6a17ad99eb90a623db5b4cbed4e1faf6587523
-
SHA256
e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f
-
SHA512
2f68ae2b06bbf8fda80e185e616ceb65afe7a2be1c2e53e2326df70de1a2d39504ceb4669abca36c97e99b679622943321c11f99b03fe4ebbbc2eddf4b41d729
-
SSDEEP
1536:8g/9T8ROcQupqqusN3mrS/ztMhkywRFUnTmc5n4IIIIIIIIIIIIIIIIII/IIIIIN:8g585LpPCrQt7F84IIIIIIIIIIIIIIIT
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSlb.exe" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSlb.exe" SMSSlb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSlb.exe" SMSSlb.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSSlb.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (int) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSSlb.exe -
resource yara_rule behavioral1/files/0x000a0000000120d6-6.dat aspack_v212_v242 -
Executes dropped EXE 2 IoCs
pid Process 2352 SMSSlb.exe 2328 SMSSlb.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\SMSSlb.exe" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsColorChart.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsMacroTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PROTTPLV.DOC SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplateRTL.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\OUTFORM.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Traditional.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsVersion1Warning.htm SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsImageTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ENGIDX.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Thatch.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PROTTPLN.DOC SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHSRN.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsImageTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Simple.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHLEX.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\AccessWeb\CLNTWRAP.HTM SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBlankPage.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsDoNotTrust.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPrintTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPrintTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Newsprint.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHPHN.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\JFONT.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\DefaultBlackAndWhite.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHLTS.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewFrame.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsFormTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Fancy.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Formal.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewFrame.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewFrame.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsMacroTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Perspective.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OCRVC.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Elegant.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ENGDIC.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\LOOKUP.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OCRHC.DAT SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Classic.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Manuscript.dotx SMSSlb.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html SMSSlb.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\svchost.exe e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Crack.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Crack.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplateRTL.html SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Keygen.exe SMSSlb.exe File created C:\Windows\SMSSlb.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Keygen.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBrowserUpgrade.html SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe SMSSlb.exe File created C:\Windows\message.htm SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Crack.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplate.html SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Keygen.exe SMSSlb.exe File created C:\Windows\SMSSlb.exe e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Keygen.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Studio MX 2004 AllApps Crack.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsDoNotTrust.html SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsHomePage.html SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewFrame.html SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsColorChart.html SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsMacroTemplate.html SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\iMesh 4.2 Ad Remover Crack.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsImageTemplate.html SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplateRTL.html SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Borland C++ BuilderX 1.0 Enterprise Edition Crack.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBrowserUpgrade.html SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Crack.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBlankPage.html SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewTemplate.html SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\OSPP.HTM SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Keygen.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Crack.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Keygen.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsColorChart.html SMSSlb.exe File opened for modification C:\Windows\SMSSlb.exe e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Crack.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Sophos AntiVirus v3.74 Keygen.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Microsoft Office System Professional V2003 Crack.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Crack.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplate.html SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Crack.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee VirusScan Home Edition 2004 Crack.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Crack.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBlankPage.html SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Keygen.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Keygen.exe SMSSlb.exe File created C:\Windows\SMSSlb.exe SMSSlb.exe File opened for modification C:\Windows\svchost.exe SMSSlb.exe File created C:\Windows\message.dat SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Keygen.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Crack.exe SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\CLNTWRAP.HTM SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplate.html SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsVersion1Warning.htm SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsImageTemplate.html SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplate.html SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Crack.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Crack.exe SMSSlb.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsVersion1Warning.htm SMSSlb.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewTemplate.html SMSSlb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMSSlb.exe -
Modifies data under HKEY_USERS 47 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles SMSSlb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSSlb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000404e8a968c3cdb01 SMSSlb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UIFallback = 30003b0031003000330033000000 SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\XLChangeInstallLanguage = "No" SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PPTChangeInstallLanguage = "No" SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\SharePointDesignerChangeInstallLanguage = "No" SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\LangTuneUp = "OfficeCompleted" SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\Software SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\ProjectChangeInstallLanguage = "No" SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages\1033 = "On" SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\OutlookChangeInstallLanguage = "No" SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office SMSSlb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WinXPLanguagePatch = "1" SMSSlb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\InstallLanguage = "1033" SMSSlb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PreviousInstallLanguage = "1033" SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WordMailChangeInstallLanguage = "No" SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\AccessChangeInstallLanguage = "No" SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources SMSSlb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UILanguage = "1033" SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion SMSSlb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common SMSSlb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UISnapshot = 31003000330033000000 SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PublisherChangeInstallLanguage = "No" SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WebDesignerChangeInstallLanguage = "No" SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0 SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WordChangeInstallLanguage = "No" SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\InfoPathChangeInstallLanguage = "No" SMSSlb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Shared\OfficeUILanguage = "1033" SMSSlb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\HelpFallback = 30003b0031003000330033000000 SMSSlb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\HelpLanguage = "1033" SMSSlb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\OneNoteChangeInstallLanguage = "No" SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared SMSSlb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem SMSSlb.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2328 SMSSlb.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2352 1736 e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe 30 PID 1736 wrote to memory of 2352 1736 e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe 30 PID 1736 wrote to memory of 2352 1736 e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe 30 PID 1736 wrote to memory of 2352 1736 e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe"C:\Users\Admin\AppData\Local\Temp\e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SMSSlb.exe"C:\Windows\SMSSlb.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
PID:2352
-
-
C:\Windows\SMSSlb.exeC:\Windows\SMSSlb.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2328
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD504e6b5760c4b7ce8217375ba3ce7914a
SHA1dd6a17ad99eb90a623db5b4cbed4e1faf6587523
SHA256e531757a5d30a7ebb3c64304641acb9f2b475fb207e0e8b59bd995226682222f
SHA5122f68ae2b06bbf8fda80e185e616ceb65afe7a2be1c2e53e2326df70de1a2d39504ceb4669abca36c97e99b679622943321c11f99b03fe4ebbbc2eddf4b41d729
-
Filesize
89KB
MD5b2ed52b8cce1607a1acc8b28a1d188e6
SHA1a838e427b5ba041a59057db75d9580fee9484ccb
SHA2564a2a8209cbf531421a017676c7c8f2358e80c11330f666717b23aec86ee9f7d2
SHA5125f03e6377e94569f75f482cede735070284837e587b512b94d2f53452a4772cfb19563e0c39988841a4b90a5b13e67917ce502cd77c2f1b9380f59f7c23a22c7
-
Filesize
88KB
MD51925b2ae3b2be8954e17bdaa2503d160
SHA1d83ba88c2cec98eb8a3b744d0d2a13f828dd245e
SHA2564a51a39ac2777728622eba6f0e0ffb4d9a43e754cf43e17710963c83922a9d03
SHA512dab162d3de69301cf2258192a8f1101e0a0d2c90ec5b4e84693e81a1d82dc5b5c5777a7080243228cfe5496445f5c3fc06773bc132426d7064cf75de5d62b799