smss[.]exe | Triage™

General

Target
smss.exe
Size 223KB
Sample260711-gwtpdaez81
SHA256 684d896393abf390a5a01751fe4354eac77bfd4febe607cd02f47178b445dd12
MD5 d997898238c9ffde81d6d3aeef879ee1
SHA1 bd934d7c1805052331a1bccaed3c3576791ed932
SHA512 f1c004c6f910960c3edcee515acb808108ca4223ae131cf6153571fe611ed7a6d5730d90150e1b032a089a525c6322919fe067ee6dd1717aa52832f9950970a7
SSDEEP 3072:Dt3mfdZY6a8tA0Ly8ihbgN++zrQapZ6nG4+Mlip:Dt2DA8tA0Y1x+zrQaac
TLSH
T1BE24F60C32F61084E7B6D67889B18655F9737871172196EF16E0C17A4E32AE8FE35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

smss.exe

.sys 223KB

smss.exe

IMPHASH 1729ef954f6640a57eed0e13aa561ba9
SHA256 684d896393abf390a5a01751fe4354eac77bfd4febe607cd02f47178b445dd12
MD5 d997898238c9ffde81d6d3aeef879ee1
SHA1 bd934d7c1805052331a1bccaed3c3576791ed932
SHA512 f1c004c6f910960c3edcee515acb808108ca4223ae131cf6153571fe611ed7a6d5730d90150e1b032a089a525c6322919fe067ee6dd1717aa52832f9950970a7
SSDEEP 3072:Dt3mfdZY6a8tA0Ly8ihbgN++zrQapZ6nG4+Mlip:Dt2DA8tA0Y1x+zrQaac
TLSH
T1BE24F60C32F61084E7B6D67889B18655F9737871172196EF16E0C17A4E32AE8FE35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

4b:63:00:16:cd:3a:95:ea:97:2e:0d:d6:43:b3:03:c1:80:4c:fc:54:46:a6:3e:51:30:9b:5d:46:35:4b:7b:db

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 17, 2026

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:45:57:55:65:5b:ba:64:6f:eb:00:00:00:00:05:45

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 13, 2025 - Oct 18, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:521A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:17:71:fb:2e:a5:af:01:1d:ea:00:01:00:00:02:17

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

4496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

smss.pdb

ntdll

NtPowerInformation NtQueryInformationProcess RtlComputeCrc32 RtlInitUnicodeString NtOpenFile NtDeviceIoControlFile NtClose NtQuerySystemInformation RtlUpcaseUnicodeChar RtlGetNtSystemRoot NtOpenKey RtlGetVersion TpAllocTimer TpSetTimer RtlAllocateHeap RtlFreeHeap NtSetValueKey RtlFreeUnicodeString NtQueryValueKey RtlPrefixUnicodeString NtQueryVolumeInformationFile RtlInitUnicodeStringEx _vsnwprintf_s NtCreatePagingFile NtQueryLicenseValue NtSetSystemInformation RtlAppendUnicodeToString RtlSecondsSince1970ToTime qsort NtSetInformationFile NtQueryInformationFile NtFsControlFile RtlCompareUnicodeString RtlAppendUnicodeStringToString RtlCompareMemory NtDeleteValueKey NtFlushKey NtUpdateWnfStateData NtInitializeRegistry RtlUnicodeStringToInteger NtManagePartition RtlSubscribeWnfStateChangeNotification RtlAllocateAndInitializeSid RtlCreateSecurityDescriptor RtlCreateAcl RtlAddAccessAllowedAce RtlSetDaclSecurityDescriptor RtlSetOwnerSecurityDescriptor NtSetSecurityObject RtlExpandEnvironmentStrings_U RtlDosPathNameToNtPathName_U NtCreateFile NtReadFile NtCreateKey NtAllocateVirtualMemory NtWriteFile EtwEventWriteTransfer NtFreeVirtualMemory RtlCreateUnicodeString EtwEventWrite EtwEventEnabled _vsnwprintf RtlCopyUnicodeString RtlAddMandatoryAce RtlSetSaclSecurityDescriptor RtlAdjustPrivilege RtlFreeSid RtlLengthSid NtCreateMutant RtlCreateTagHeap NtSetInformationProcess NtAlpcCreatePort RtlInitializeBitMap RtlClearAllBits RtlSetBits NtOpenEvent RtlCreateEnvironment NtQuerySystemInformationEx RtlSetCurrentEnvironment RtlQueryRegistryValuesEx NtCreateDirectoryObject RtlEqualUnicodeString NtSerializeBoot NtSetEvent RtlQueryPerformanceFrequency RtlQueryPerformanceCounter NtResumeThread NtWaitForSingleObject NtTerminateProcess RtlIsStateSeparationEnabled TpAllocWork TpPostWork TpWaitForWork TpReleaseWork _wcsupr_s NtOpenDirectoryObject NtCreateSymbolicLinkObject NtMakeTemporaryObject _stricmp RtlInitAnsiString RtlAnsiStringToUnicodeString RtlDosPathNameToNtPathName_U_WithStatus RtlWow64IsWowGuestMachineSupported NtCreateEvent RtlRandomEx qsort_s NtQueryObject NtSystemDebugControl LdrVerifyImageMatchesChecksumEx RtlAppxIsFileOwnedByTrustedInstaller RtlCompareUnicodeStrings NtQueryAttributesFile NtQueryDirectoryFile RtlDeleteRegistryValue RtlWriteRegistryValue _wcsicmp RtlSetEnvironmentVariable NtCreateSection NtMapViewOfSection NtUnmapViewOfSection NtDuplicateObject iswctype RtlQueryEnvironmentVariable_U RtlDosSearchPath_U RtlTestBit RtlInterlockedSetBitRun RtlFindSetBits RtlCreateProcessParametersEx RtlCreateUserProcessEx RtlDestroyProcessParameters NtDisplayString RtlAddProcessTrustLabelAce RtlGetAce NtQueryDirectoryObject NtOpenSymbolicLinkObject NtQuerySymbolicLinkObject RtlGetSystemTimeAndBias RtlTimeToTimeFields NtDeleteFile __C_specific_handler RtlAcquireSRWLockExclusive NtAlpcDisconnectPort RtlReleaseSRWLockExclusive RtlAcquireSRWLockShared RtlReleaseSRWLockShared NtAlpcImpersonateClientOfPort NtOpenThreadToken NtQueryInformationToken NtSetInformationThread TpSetPoolMinThreads RtlSetThreadIsCritical AlpcInitializeMessageAttribute NtAlpcSendWaitReceivePort AlpcGetMessageAttribute NtAlpcCancelMessage NtAlpcOpenSenderProcess RtlInitializeSRWLock NtAlpcAcceptConnectPort NtAlpcConnectPort RtlDeleteNoSplay RtlSleepConditionVariableSRW RtlWakeAllConditionVariable NtQueryInformationJobObject NtAssignProcessToJobObject EtwGetTraceLoggerHandle EtwGetTraceEnableLevel EtwGetTraceEnableFlags EtwRegisterTraceGuidsW RtlGetCurrentServiceSessionId NtDelayExecution RtlSetHeapInformation EtwEventSetInformation EtwEventRegister TpAllocPool TpAllocAlpcCompletion NtWaitForMultipleObjects NtRaiseHardError RtlInitializeConditionVariable NtClearEvent RtlUnicodeStringToAnsiString NtQueryEvent wcstoul LdrQueryImageFileExecutionOptions RtlAcquirePrivilege RtlReleasePrivilege RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnhandledExceptionFilter RtlQueryFeatureConfiguration RtlNotifyFeatureUsage memmove RtlNormalizeProcessParams iswspace RtlConnectToSm RtlSendMsgToSm NtQueryKey NtDeleteKey RtlNtStatusToDosError wcslen RtlSetLastWin32Error _wcsnicmp RtlDosPathNameToRelativeNtPathName_U_WithStatus RtlReleaseRelativeName RtlIsDosDeviceName_U RtlDosPathNameToRelativeNtPathName_U NtQueryEaFile SbSelectProcedure RtlDetermineDosPathNameType_U RtlInitializeCriticalSection RtlEnterCriticalSection NtQueryDirectoryFileEx RtlLeaveCriticalSection RtlDeleteCriticalSection __chkstk memcpy memset

Name

.text

Size

124KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

smss.exe

ntdll

generic