Analysis
-
max time kernel
93s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-12-2024 16:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe
Resource
win7-20240903-en
windows7-x64
14 signatures
120 seconds
Behavioral task
behavioral2
Sample
609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe
-
Size
136KB
-
MD5
6b9f3f1d51c4c4608e9459fb2a30d390
-
SHA1
63aed05364191d433c6055f727ad2c669f019af5
-
SHA256
609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51
-
SHA512
a5aaef1da126388613ada546b56a456822206d802f0c8138382130b0594391ef8cf04422227a85fa59d6449c70e0bf5e469ccff4bd8a54ea5123a67a71ff722d
-
SSDEEP
3072:3LVoDvPd+A4WhkhXDl+i1lApwH08TdpIIIIIIIIIIIIIIIII/IIIIIIIIIIIIII5:ZopGGgbiwU8J+
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSkc.exe" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSkc.exe" SMSSkc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSkc.exe" SMSSkc.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSSkc.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSSkc.exe -
Executes dropped EXE 2 IoCs
pid Process 2360 SMSSkc.exe 2504 SMSSkc.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\SMSSkc.exe" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBrowserUpgrade.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPrintTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplateRTL.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Modern.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Simple.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHSRN.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OCRHC.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsColorChart.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Classic.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\OUTFORM.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsHomePage.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplateRTL.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ENGDIC.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PROTTPLN.DOC SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHLTS.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsColorChart.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPrintTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBrowserUpgrade.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePage.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Manuscript.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHLEX.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsVersion1Warning.htm SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Default.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsImageTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Distinctive.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Traditional.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Formal.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsDoNotTrust.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBlankPage.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePage.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsFormTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Fancy.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Thatch.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OUTLFLTR.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Perspective.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHKEY.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OCRVC.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\OSPP.HTM SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewFrame.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\LOOKUP.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\QuickStyles\Elegant.dotx SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PROTTPLV.DOC SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsImageTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsViewFrame.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\1033\PSRCHPHN.DAT SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsMacroTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html SMSSkc.exe File opened for modification C:\PROGRA~2\MICROS~1\Office14\ENGIDX.DAT SMSSkc.exe -
Drops file in Windows directory 58 IoCs
description ioc Process File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBrowserUpgrade.html SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBrowserUpgrade.html SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplate.html SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewTemplate.html SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewTemplate.html SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Crack.exe SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Keygen.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Keygen.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsDoNotTrust.html SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplate.html SMSSkc.exe File created C:\Windows\svchost.exe 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsVersion1Warning.htm SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsHomePage.html SMSSkc.exe File opened for modification C:\Windows\svchost.exe SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Keygen.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsImageTemplate.html SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsVersion1Warning.htm SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewFrame.html SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplateRTL.html SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplateRTL.html SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Keygen.exe SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsFormTemplate.html SMSSkc.exe File opened for modification C:\Windows\svchost.exe SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ SMSSkc.exe File created C:\Windows\message.htm SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\BearShare Pro 4.3.0 Crack.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsMacroTemplate.html SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Keygen.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Crack.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBlankPage.html SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton Antispam 2004 Crack.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Keygen.exe SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Crack.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplate.html SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsColorChart.html SMSSkc.exe File created C:\Windows\SMSSkc.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsHomePage.html SMSSkc.exe File created C:\Windows\SMSSkc.exe 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Keygen.exe SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsBlankPage.html SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsColorChart.html SMSSkc.exe File created C:\Windows\SMSSkc.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\BearShare Pro 4.3.0 Crack.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Nero Burning ROM v6.0.0.19 Ultra Edition Keygen.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsViewFrame.html SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplateRTL.html SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\OSPP.HTM SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Contribute 2 Crack.exe SMSSkc.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\CLNTWRAP.HTM SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPreviewTemplate.html SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsMacroTemplate.html SMSSkc.exe File opened for modification C:\Windows\SMSSkc.exe 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe File created C:\Windows\message.dat SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsPrintTemplate.html SMSSkc.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\FormsImageTemplate.html SMSSkc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMSSkc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe -
Modifies data under HKEY_USERS 47 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\ProjectChangeInstallLanguage = "No" SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\OneNoteChangeInstallLanguage = "No" SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WebDesignerChangeInstallLanguage = "No" SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources SMSSkc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\InstallLanguage = "1033" SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\XLChangeInstallLanguage = "No" SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Shared SMSSkc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Shared\OfficeUILanguage = "1033" SMSSkc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PreviousInstallLanguage = "1033" SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\SharePointDesignerChangeInstallLanguage = "No" SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\LangTuneUp = "OfficeCompleted" SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\Software SMSSkc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000a02c0c1ca245db01 SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common SMSSkc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\HelpFallback = 30003b0031003000330033000000 SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PPTChangeInstallLanguage = "No" SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\14.0\Common\LanguageResources SMSSkc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WinXPLanguagePatch = "1" SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office SMSSkc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UISnapshot = 31003000330033000000 SMSSkc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\HelpLanguage = "1033" SMSSkc.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UIFallback = 30003b0031003000330033000000 SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced SMSSkc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0 SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WordChangeInstallLanguage = "No" SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\AccessChangeInstallLanguage = "No" SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\OutlookChangeInstallLanguage = "No" SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT SMSSkc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies SMSSkc.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\UILanguage = "1033" SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion SMSSkc.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\WordMailChangeInstallLanguage = "No" SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\PublisherChangeInstallLanguage = "No" SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\InfoPathChangeInstallLanguage = "No" SMSSkc.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages\1033 = "On" SMSSkc.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S" 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2504 SMSSkc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2360 1732 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe 30 PID 1732 wrote to memory of 2360 1732 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe 30 PID 1732 wrote to memory of 2360 1732 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe 30 PID 1732 wrote to memory of 2360 1732 609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe"C:\Users\Admin\AppData\Local\Temp\609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SMSSkc.exe"C:\Windows\SMSSkc.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
PID:2360
-
-
C:\Windows\SMSSkc.exeC:\Windows\SMSSkc.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2504
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD56b9f3f1d51c4c4608e9459fb2a30d390
SHA163aed05364191d433c6055f727ad2c669f019af5
SHA256609e3a4e71537df2af6902d6cacc7d1f72089823ecfdfab987b293d2530a8a51
SHA512a5aaef1da126388613ada546b56a456822206d802f0c8138382130b0594391ef8cf04422227a85fa59d6449c70e0bf5e469ccff4bd8a54ea5123a67a71ff722d
-
Filesize
187KB
MD549f0573a200d4c004e5733e9335604c2
SHA176b294743dd0a5edf5a45f8c2d1a65fcfbf983d8
SHA256722e51fd91c6804f985e60a2d9bbe734a0482978de3be098330efc586cfa775d
SHA51290cb3dc3e22c41a0d41b361e494deccdeda87efcaece8e492c348061915c8cb910e36ed542514a3e4570c5c48af80eb863ec08a9b8ea910b5bc37202f33d29e5
-
Filesize
186KB
MD55dff50fee05ff0593cf927ad963c1c83
SHA1c4d386f7e8535933c2c61d84f772b3ba895f6c0b
SHA2565cbcb352b43e2d28657bed001f3dad92f3d69b96d8da11b633640295727a0840
SHA512d12d3258b67e832a0fcc05e88e1ee17239d666073b12bcba6b307568e90c5f4313729c93fbd592574192d894810f167f08e60c3c18148232a69d4c710577f412