Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/03/2025, 01:41
250301-b4c4pswnw9 1013/01/2025, 01:41
250113-b4f6csskhq 1012/01/2025, 23:10
250112-254wxswpen 1012/01/2025, 22:49
250112-2rs79stjbv 1012/01/2025, 21:15
250112-z39y2szkaz 1012/01/2025, 20:53
250112-zn9dzayndw 1012/01/2025, 20:52
250112-zn8sfayndt 1012/01/2025, 20:50
250112-zmy7lsymht 10Analysis
-
max time kernel
900s -
max time network
754s -
platform
windows11-21h2_x64 -
resource
win11-20250217-en -
resource tags
arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/03/2025, 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
Resource
win11-20250217-en
windows11-21h2-x64
14 signatures
900 seconds
General
-
Target
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe
-
Size
136KB
-
MD5
bfb932c0c15243704cf27cb8c7eff520
-
SHA1
8c9e5e096e0f5855e435978b932d8ab63e859a29
-
SHA256
f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214
-
SHA512
b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5
-
SSDEEP
3072:3LVoDvPd+A4WhkhXDl+i1lApwH08TdpIIIIIIIIIIIIIIIII/IIIIIIIIIIIIII/:ZopGGgbiwU8JY
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSbl.exe" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSbl.exe" SMSSbl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe SMSSbl.exe" SMSSbl.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSSbl.exe Set value (int) \REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (int) \REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSSbl.exe -
Executes dropped EXE 2 IoCs
pid Process 5564 SMSSbl.exe 5596 SMSSbl.exe -
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Service Host = "C:\\Windows\\SMSSbl.exe" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.boot.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\proof.en-us.msi.16.en-us.vreg.dat SMSSbl.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\el.pak.DATA SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\RedAndBlackReport.dotx SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\powerpointmui.msi.16.en-us.vreg.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.es-es.msi.16.es-es.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat SMSSbl.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\Welcome.html SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\officemuiset.msi.16.en-us.vreg.dat SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\ga.pak.DATA SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\devtools\zh-TW.pak.DATA SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.boot.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\officemui.msi.16.en-us.vreg.dat SMSSbl.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile.html SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.boot.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerpivot.x-none.msi.16.x-none.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\proof.fr-fr.msi.16.fr-fr.vreg.dat SMSSbl.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html SMSSbl.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\devtools\de.pak.DATA SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\gl.pak.DATA SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.tree.dat SMSSbl.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\devtools\zh-CN.pak.DATA SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\word.x-none.msi.16.x-none.vreg.dat SMSSbl.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\WebviewOffline.html SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\fa.pak.DATA SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyLetter.dotx SMSSbl.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\fr-CA.pak.DATA SMSSbl.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\security\public_suffix_list.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessReport.dotx SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\excelmui.msi.16.en-us.tree.dat SMSSbl.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\wwwroot\app.html SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\gd.pak.DATA SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicstylish.dotx SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessResume.dotx SMSSbl.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\index.html SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\hi.pak.DATA SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicelegant.dotx SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\osmmui.msi.16.en-us.boot.tree.dat SMSSbl.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\identity_proxy\resources.pri.DATA SMSSbl.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\es.pak.DATA SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\da.pak.DATA SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\office32mui.msi.16.en-us.boot.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\devtools\it.pak.DATA SMSSbl.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\Locales\devtools\ru.pak.DATA SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013bw.dotx SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\office32ww.msi.16.x-none.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.boot.tree.dat SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\StudentReport.dotx SMSSbl.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\excelmui.msi.16.en-us.vreg.dat SMSSbl.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html SMSSbl.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SMSSbl.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\OSPP.HTM SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\vpaid.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\license.html SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Crack.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\stream_config_window.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile.html SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Keygen.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\PersonaSpy.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\MCABOUT.HTM SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\WebviewOffline.html SMSSbl.exe File created C:\Windows\message.htm SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Borland C++ BuilderX 1.0 Enterprise Edition Crack.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\README.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile_equalizer.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile_view.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NOTICE.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Borland C++ BuilderX 1.0 Enterprise Edition Crack.exe SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\WebviewOffline.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Crack.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\browse_window.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mobile_browse.html SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Xbox360PurchaseHostPage.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\create_stream.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\stream_window.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\app.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\JoinStep.zip SMSSbl.exe File opened for modification C:\Windows\SMSSbl.exe f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Keygen.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Crack.exe SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Crack.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ffjcext.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\offset_window.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\bootstrap.html SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\NHL 2004 Crack.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\index.html SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ThirdPartyNotices.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\JoinStep.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Keygen.exe SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Macromedia Studio MX 2004 AllApps Crack.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Halo Keygen.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\mosaic_window.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\vlm.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\msapp-error.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\error_window.html SMSSbl.exe File created C:\Windows\SMSSbl.exe f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe File created C:\Windows\SMSSbl.exe SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee SpamKiller 2004 Crack.exe SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton SystemWorks 2004 Crack.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Norton AntiVirus 2004 Crack.exe SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Crack.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Welcome.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\batch_window.html SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\ThirdPartyNotices.html SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\McAfee Personal Firewall Plus 2004 Keygen.exe SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\Half Life 2 Keygen.exe SMSSbl.exe File opened for modification C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\TVTool v8.31 Keygen.exe SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\README.HTM SMSSbl.exe File created C:\Windows\.{21EC2020-3AEA-1069-A2DD-08002B30309D}\vlm_export.html SMSSbl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMSSbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SMSSbl.exe -
Modifies data under HKEY_USERS 13 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SMSSbl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SMSSbl.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" SMSSbl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SMSSbl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced SMSSbl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System SMSSbl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SMSSbl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies SMSSbl.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SMSSbl.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000ff53db144c8adb01 SMSSbl.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "1" SMSSbl.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SMSSbl.exe Key created \REGISTRY\USER\.DEFAULT\Software SMSSbl.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" /S" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell\open\command f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.exe \"%1\" %*" f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5596 SMSSbl.exe 5596 SMSSbl.exe 5596 SMSSbl.exe 5596 SMSSbl.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5620 wrote to memory of 5564 5620 f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe 77 PID 5620 wrote to memory of 5564 5620 f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe 77 PID 5620 wrote to memory of 5564 5620 f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe"C:\Users\Admin\AppData\Local\Temp\f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5620 -
C:\Windows\SMSSbl.exe"C:\Windows\SMSSbl.exe" -xInstallOurNiceServicesYes2⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5564
-
-
C:\Windows\SMSSbl.exeC:\Windows\SMSSbl.exe -xStartOurNiceServicesYes1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:5596
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
MD5bfb932c0c15243704cf27cb8c7eff520
SHA18c9e5e096e0f5855e435978b932d8ab63e859a29
SHA256f8df85307810f9e4d7de55e28a2ad39eae1439e08e05c8b665addd7094bd9214
SHA512b0ce2a712cbe8185dd856a3b46410976ec2d42495019a808f9dee1ed9b84d44a7f23fd295a1a684859c5319b54e9702a00825763f3fe4c78e4989afd0f47dee5
-
Filesize
187KB
MD5cd7defce01877e18ad20568c6278eddd
SHA19893b7e8e12f0588245e1ba852e7d9a59af43b90
SHA25698ce8de07944b7da0ccf2d3813339654a6eb147b5a9d9532c9f0adfdb1841fcb
SHA512e41a2f9c326da0ef2e7e7735935af0dbf4c96b996ae6621c0dc3ccb6d8706332c409d6eb1d73dc3580e4a211b04eb584dfebf63c90300cbc4415a23707b73ab3
-
Filesize
187KB
MD577e498263723ecdebc74ea1027910e40
SHA1dd34b3abe5d91890f3999a6570cf429bd3719b70
SHA256d45bbbe3394170258848b1fed788e0bca84224e36f78d0f5442869bf0dbac56d
SHA512195a05f75134b9826d4771055547065773849cd21dfa09afcbebcbeb27093e20d6b7a4047e5f03d9f47bea6a08709bcdba01e7f38d53be1ddc86bd7207a53396
-
Filesize
128KB
MD519337742d05f43fe4a743d552f60e451
SHA121dc7538b40c98df44feaba29fc1965858e281fd
SHA2562ad0d613003e9914722ace6b66ab8be70c4f80069b447b7a6497b2bdc015a27b
SHA51223f64d9bcd7ada583a85655ae2f3f400183e485e4ecf44d2002d7109e64b2a87d401ac92c25130f7e3143166c3f11a3a235346cc49efc9c8290e8ead276ec4f1