Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10-01-2025 13:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe
Resource
win7-20241010-en
windows7-x64
24 signatures
150 seconds
General
-
Target
2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe
-
Size
208KB
-
MD5
6d89d0b22551b60ff06b493dc3e2dd1e
-
SHA1
a1386619d46d694214919a9a1e44258bc000e20b
-
SHA256
1798f38c0183e7055fd443d6073f21bbb2eb04bfe247cafec16b310081027e10
-
SHA512
b675c0bdabb64499722172e4d708a64d44a2882ed3908676adaa0d78fbeb34b0a2c3fe56ab253ea3b9ebdd4f06b0b4a773ab3b5951a1821e0a19fb1152143217
-
SSDEEP
3072:RxTrRfPa/DrTHQDgvkO7skKSro1Ykq6YoxmB9GCHASPy0Z+lzXWSSSmb9uEmBkCt:RxTrFeXbkvYFSm2G6wizXWS1mbPmyM
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 3 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral1/memory/2852-34-0x0000000001220000-0x0000000001229000-memory.dmp family_bdaejec_backdoor behavioral1/memory/2852-46-0x0000000001220000-0x0000000001229000-memory.dmp family_bdaejec_backdoor behavioral1/memory/2852-91-0x0000000001220000-0x0000000001229000-memory.dmp family_bdaejec_backdoor -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
resource yara_rule behavioral1/files/0x000d000000012263-32.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2852 zaPGvW.exe -
Loads dropped DLL 2 IoCs
pid Process 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
resource yara_rule behavioral1/memory/2904-5-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-33-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-4-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-27-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-7-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-8-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-6-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-26-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-28-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-38-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-39-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-40-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-44-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-45-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-50-0x00000000020B0000-0x000000000313E000-memory.dmp upx behavioral1/memory/2904-65-0x00000000020B0000-0x000000000313E000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe zaPGvW.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe zaPGvW.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe zaPGvW.exe File opened for modification C:\Program Files\7-Zip\7z.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe zaPGvW.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe zaPGvW.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHTMED.EXE zaPGvW.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE zaPGvW.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe zaPGvW.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe zaPGvW.exe File opened for modification C:\Program Files\Windows Mail\wab.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE zaPGvW.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe zaPGvW.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe zaPGvW.exe File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\shvlzm.exe zaPGvW.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\pack200.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe zaPGvW.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe zaPGvW.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe zaPGvW.exe File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe zaPGvW.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE zaPGvW.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe zaPGvW.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE zaPGvW.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zaPGvW.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe Token: SeDebugPrivilege 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2852 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 30 PID 2904 wrote to memory of 2852 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 30 PID 2904 wrote to memory of 2852 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 30 PID 2904 wrote to memory of 2852 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 30 PID 2904 wrote to memory of 1108 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 19 PID 2904 wrote to memory of 1160 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 20 PID 2904 wrote to memory of 1188 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 21 PID 2904 wrote to memory of 1580 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 25 PID 2904 wrote to memory of 1108 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 19 PID 2904 wrote to memory of 1160 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 20 PID 2904 wrote to memory of 1188 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 21 PID 2904 wrote to memory of 1580 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 25 PID 2904 wrote to memory of 2852 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 30 PID 2904 wrote to memory of 2852 2904 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe 30 PID 2852 wrote to memory of 2216 2852 zaPGvW.exe 32 PID 2852 wrote to memory of 2216 2852 zaPGvW.exe 32 PID 2852 wrote to memory of 2216 2852 zaPGvW.exe 32 PID 2852 wrote to memory of 2216 2852 zaPGvW.exe 32 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1160
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe"C:\Users\Admin\AppData\Local\Temp\2025-01-10_6d89d0b22551b60ff06b493dc3e2dd1e_smoke-loader_wapomi.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\zaPGvW.exeC:\Users\Admin\AppData\Local\Temp\zaPGvW.exe3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\0f3158df.bat" "4⤵
- System Location Discovery: System Language Discovery
PID:2216
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1580
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5d04436735e66ec95eea6f8dc600e4c15
SHA1ec136436dc3148f46ef3ce50472d974be63ae8bc
SHA256e5b2c9b6c2658ac2b183026bdc15d78ae903f4e59e26da481867d5023060c144
SHA512a6d0bd834579bd76c0c050938fde266da69eb7ea6a891e4dbca67020eff7e31cb95b03311af67debce09a69314ddc1c03c3d3e25c28f96715863b204ab4ad72e
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e