jaffacakes118_smss[.]exe

General

Target
jaffacakes118_smss.exe
Size 153KB
Sample260916-v3c7vsdp81
SHA256 d44c73818b0cf757a1d07274013baa87f36ebf9c59bec8972fea08c6cfb03862
MD5 54a7e1168cf0d30d449462da5fc5a600
SHA1 fc4b6f48a8a7ece73f1da2370d7b488820f10b0d
SHA512 ae8f2fc39f2bf3f1f2a223f334440043c30a2d246fdf8830255bd86f7b9236de8331bbffb5581e5039c946f5db1b523a5303d9c98951dd92b4a2bd1e3bef790e
SSDEEP 1536:LQufZPbiE3y7vxRVXONK5OPviHfeS/DXvBADJkyYUfM8Wl20yBKfjsdmhnwSP2zx:0ANbIk+M8rbXvBAkyYUfW25BKbLnjO1
TLSH
T166E3E60D72F62184E3BAD67589B68554FA337971171192FF05E0C1BA0A32BE4EE35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

jaffacakes118_smss.exe

.sys 153KB

jaffacakes118_smss.exe

IMPHASH 67b500d64f6bdf6ffd6c4f7f4de9fda6
SHA256 d44c73818b0cf757a1d07274013baa87f36ebf9c59bec8972fea08c6cfb03862
MD5 54a7e1168cf0d30d449462da5fc5a600
SHA1 fc4b6f48a8a7ece73f1da2370d7b488820f10b0d
SHA512 ae8f2fc39f2bf3f1f2a223f334440043c30a2d246fdf8830255bd86f7b9236de8331bbffb5581e5039c946f5db1b523a5303d9c98951dd92b4a2bd1e3bef790e
SSDEEP 1536:LQufZPbiE3y7vxRVXONK5OPviHfeS/DXvBADJkyYUfM8Wl20yBKfjsdmhnwSP2zx:0ANbIk+M8rbXvBAkyYUfW25BKbLnjO1
TLSH
T166E3E60D72F62184E3BAD67589B68554FA337971171192FF05E0C1BA0A32BE4EE35B32
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

fa:49:e5:4d:ac:6d:5b:39:a8:76:d3:74:03:28:f4:2c:fd:b9:d2:41:a0:83:3a:69:f0:3f:f2:bd:2f:70:10:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2023

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:49:80:8e:a7:5d:6e:2d:36:87:00:00:00:00:04:49

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2023 - Aug 7, 2024

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ce:0f:18:f7:45:97:e7:c6:ff:00:01:00:00:01:ce

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 25, 2023 - Feb 1, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

5360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

smss.pdb

ntdll

RtlComputeCrc32 RtlInitUnicodeString NtOpenFile NtDeviceIoControlFile NtClose NtQuerySystemInformation RtlUpcaseUnicodeChar RtlGetNtSystemRoot NtOpenKey RtlGetVersion TpAllocTimer TpSetTimer RtlAllocateHeap RtlFreeHeap NtSetValueKey RtlFreeUnicodeString NtQueryValueKey RtlPrefixUnicodeString NtQueryVolumeInformationFile NtQueryInformationProcess RtlInitUnicodeStringEx _vsnwprintf_s NtCreatePagingFile NtQueryLicenseValue NtSetSystemInformation RtlAppendUnicodeToString RtlSecondsSince1970ToTime qsort NtSetInformationFile NtQueryInformationFile NtFsControlFile RtlCompareUnicodeString RtlAppendUnicodeStringToString RtlCompareMemory NtDeleteValueKey NtFlushKey NtUpdateWnfStateData NtInitializeRegistry RtlUnicodeStringToInteger RtlAllocateAndInitializeSid RtlCreateSecurityDescriptor RtlCreateAcl RtlAddAccessAllowedAce RtlSetDaclSecurityDescriptor RtlSetOwnerSecurityDescriptor NtSetSecurityObject RtlExpandEnvironmentStrings_U RtlDosPathNameToNtPathName_U NtCreateFile NtReadFile NtCreateKey NtAllocateVirtualMemory NtWriteFile EtwEventWriteTransfer NtFreeVirtualMemory RtlCreateUnicodeString EtwEventWrite EtwEventEnabled _vsnwprintf RtlCopyUnicodeString RtlAddMandatoryAce RtlSetSaclSecurityDescriptor RtlAdjustPrivilege RtlFreeSid RtlLengthSid NtCreateMutant RtlCreateTagHeap NtSetInformationProcess NtAlpcCreatePort RtlInitializeBitMap RtlClearAllBits RtlSetBits NtOpenEvent RtlCreateEnvironment RtlSetCurrentEnvironment RtlQueryRegistryValuesEx NtCreateDirectoryObject RtlEqualUnicodeString NtSerializeBoot NtSetEvent RtlQueryPerformanceFrequency RtlQueryPerformanceCounter NtResumeThread NtWaitForSingleObject NtTerminateProcess RtlIsStateSeparationEnabled TpAllocWork TpPostWork TpWaitForWork TpReleaseWork _wcsupr_s NtOpenDirectoryObject NtCreateSymbolicLinkObject NtMakeTemporaryObject _stricmp RtlInitAnsiString RtlAnsiStringToUnicodeString RtlDosPathNameToNtPathName_U_WithStatus RtlWow64IsWowGuestMachineSupported NtCreateEvent RtlRandomEx qsort_s NtQueryObject NtSystemDebugControl LdrVerifyImageMatchesChecksumEx RtlAppxIsFileOwnedByTrustedInstaller NtQueryAttributesFile NtQueryDirectoryFile RtlDeleteRegistryValue RtlWriteRegistryValue _wcsicmp RtlSetEnvironmentVariable NtCreateSection NtMapViewOfSection NtUnmapViewOfSection NtDuplicateObject iswctype RtlQueryEnvironmentVariable_U RtlDosSearchPath_U RtlTestBit RtlInterlockedSetBitRun RtlFindSetBits RtlCreateProcessParametersEx RtlCreateUserProcessEx RtlDestroyProcessParameters NtDisplayString RtlAddProcessTrustLabelAce RtlGetAce NtQueryDirectoryObject NtOpenSymbolicLinkObject NtQuerySymbolicLinkObject LdrGetDllHandle LdrGetProcedureAddress RtlGetCurrentServiceSessionId RtlTimeToTimeFields NtDeleteFile __C_specific_handler RtlAcquireSRWLockExclusive NtAlpcDisconnectPort RtlReleaseSRWLockExclusive RtlAcquireSRWLockShared RtlReleaseSRWLockShared NtAlpcImpersonateClientOfPort NtOpenThreadToken NtQueryInformationToken NtSetInformationThread TpSetPoolMinThreads RtlSetThreadIsCritical AlpcInitializeMessageAttribute NtAlpcSendWaitReceivePort AlpcGetMessageAttribute NtAlpcCancelMessage NtAlpcOpenSenderProcess RtlInitializeSRWLock NtAlpcAcceptConnectPort NtConnectPort NtRequestWaitReplyPort RtlDeleteNoSplay RtlSleepConditionVariableSRW RtlWakeAllConditionVariable NtQueryInformationJobObject NtAssignProcessToJobObject EtwGetTraceLoggerHandle EtwGetTraceEnableLevel EtwGetTraceEnableFlags EtwRegisterTraceGuidsW NtDelayExecution RtlSetHeapInformation EtwEventSetInformation EtwEventRegister TpAllocPool TpAllocAlpcCompletion NtWaitForMultipleObjects NtRaiseHardError RtlInitializeConditionVariable NtClearEvent RtlUnicodeStringToAnsiString NtQueryEvent wcstoul LdrQueryImageFileExecutionOptions RtlAcquirePrivilege RtlReleasePrivilege RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnhandledExceptionFilter RtlCompareUnicodeStrings memcpy RtlNormalizeProcessParams iswspace RtlConnectToSm RtlSendMsgToSm NtQueryKey NtDeleteKey NtQuerySystemInformationEx __chkstk memset

Name

.text

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

572B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_smss.exe

ntdll

generic