Report - smss.exe

Malicious Library UPX PE File PE32 MZP Format DllRegisterServer dll
ScreenShot
Created 2023.11.09 08:08 Machine s1_win7_x6401
Filename smss.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
4
Behavior Score
3.0
ZERO API file : mailcious
VT API (file)
md5 62c8a57ed7d641bc8b4e451e37452df1
sha256 d9c05e4806384074097aabfbdd8965b3767d673f9032b06bed207fda7feccbd7
ssdeep 49152:JggJ5QtRwohuzcMwF5yNkr+eHlBJ/k2IDVBsd:JgO6AxcMEyNkrzpDu+
imphash dec0ca48019c2204aafb8931b58bfea3
impfuzzy 192:oN3MSbuu0xSUvK9kso1XE75oig1QhPbOQf:O3B0q9u31qPbOQf
  Network IP location

Signature (8cnts)

Level Description
watch Disables proxy possibly for traffic interception
watch Network communications indicative of possible code injection originated from the process smss.exe
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (6cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info DllRegisterServer_Zero execute regsvr32.exe binaries (upload)
info IsPE32 (no description) binaries (upload)
info mzp_file_format MZP(Delphi) file format binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (2cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
onedrive.live.com US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious
13.107.42.13 US MICROSOFT-CORP-MSN-AS-BLOCK 13.107.42.13 mailcious

Suricata ids

PE API

IAT(Import Address Table) Library

oleaut32.dll
 0x46c7a8 SysFreeString
 0x46c7ac SysReAllocStringLen
 0x46c7b0 SysAllocStringLen
advapi32.dll
 0x46c7b8 RegQueryValueExA
 0x46c7bc RegOpenKeyExA
 0x46c7c0 RegCloseKey
user32.dll
 0x46c7c8 GetKeyboardType
 0x46c7cc DestroyWindow
 0x46c7d0 LoadStringA
 0x46c7d4 MessageBoxA
 0x46c7d8 CharNextA
kernel32.dll
 0x46c7e0 GetACP
 0x46c7e4 Sleep
 0x46c7e8 VirtualFree
 0x46c7ec VirtualAlloc
 0x46c7f0 GetCurrentThreadId
 0x46c7f4 InterlockedDecrement
 0x46c7f8 InterlockedIncrement
 0x46c7fc VirtualQuery
 0x46c800 WideCharToMultiByte
 0x46c804 MultiByteToWideChar
 0x46c808 lstrlenA
 0x46c80c lstrcpynA
 0x46c810 LoadLibraryExA
 0x46c814 GetThreadLocale
 0x46c818 GetStartupInfoA
 0x46c81c GetProcAddress
 0x46c820 GetModuleHandleA
 0x46c824 GetModuleFileNameA
 0x46c828 GetLocaleInfoA
 0x46c82c GetLastError
 0x46c830 GetCommandLineA
 0x46c834 FreeLibrary
 0x46c838 FindFirstFileA
 0x46c83c FindClose
 0x46c840 ExitProcess
 0x46c844 CompareStringA
 0x46c848 WriteFile
 0x46c84c UnhandledExceptionFilter
 0x46c850 SetFilePointer
 0x46c854 SetEndOfFile
 0x46c858 RtlUnwind
 0x46c85c ReadFile
 0x46c860 RaiseException
 0x46c864 GetStdHandle
 0x46c868 GetFileSize
 0x46c86c GetFileType
 0x46c870 CreateFileA
 0x46c874 CloseHandle
kernel32.dll
 0x46c87c TlsSetValue
 0x46c880 TlsGetValue
 0x46c884 LocalAlloc
 0x46c888 GetModuleHandleA
user32.dll
 0x46c890 CreateWindowExA
 0x46c894 WindowFromPoint
 0x46c898 WaitMessage
 0x46c89c UpdateWindow
 0x46c8a0 UnregisterClassA
 0x46c8a4 UnhookWindowsHookEx
 0x46c8a8 TranslateMessage
 0x46c8ac TranslateMDISysAccel
 0x46c8b0 TrackPopupMenu
 0x46c8b4 SystemParametersInfoA
 0x46c8b8 ShowWindow
 0x46c8bc ShowScrollBar
 0x46c8c0 ShowOwnedPopups
 0x46c8c4 SetWindowsHookExA
 0x46c8c8 SetWindowPos
 0x46c8cc SetWindowPlacement
 0x46c8d0 SetWindowLongW
 0x46c8d4 SetWindowLongA
 0x46c8d8 SetTimer
 0x46c8dc SetScrollRange
 0x46c8e0 SetScrollPos
 0x46c8e4 SetScrollInfo
 0x46c8e8 SetRect
 0x46c8ec SetPropA
 0x46c8f0 SetParent
 0x46c8f4 SetMenuItemInfoA
 0x46c8f8 SetMenu
 0x46c8fc SetForegroundWindow
 0x46c900 SetFocus
 0x46c904 SetCursor
 0x46c908 SetClassLongA
 0x46c90c SetCapture
 0x46c910 SetActiveWindow
 0x46c914 SendMessageW
 0x46c918 SendMessageA
 0x46c91c ScrollWindow
 0x46c920 ScreenToClient
 0x46c924 RemovePropA
 0x46c928 RemoveMenu
 0x46c92c ReleaseDC
 0x46c930 ReleaseCapture
 0x46c934 RegisterWindowMessageA
 0x46c938 RegisterClipboardFormatA
 0x46c93c RegisterClassA
 0x46c940 RedrawWindow
 0x46c944 PtInRect
 0x46c948 PostQuitMessage
 0x46c94c PostMessageA
 0x46c950 PeekMessageW
 0x46c954 PeekMessageA
 0x46c958 OffsetRect
 0x46c95c OemToCharA
 0x46c960 MessageBoxA
 0x46c964 MapWindowPoints
 0x46c968 MapVirtualKeyA
 0x46c96c LoadStringA
 0x46c970 LoadKeyboardLayoutA
 0x46c974 LoadIconA
 0x46c978 LoadCursorA
 0x46c97c LoadBitmapA
 0x46c980 KillTimer
 0x46c984 IsZoomed
 0x46c988 IsWindowVisible
 0x46c98c IsWindowUnicode
 0x46c990 IsWindowEnabled
 0x46c994 IsWindow
 0x46c998 IsRectEmpty
 0x46c99c IsIconic
 0x46c9a0 IsDialogMessageW
 0x46c9a4 IsDialogMessageA
 0x46c9a8 IsChild
 0x46c9ac InvalidateRect
 0x46c9b0 IntersectRect
 0x46c9b4 InsertMenuItemA
 0x46c9b8 InsertMenuA
 0x46c9bc InflateRect
 0x46c9c0 GetWindowThreadProcessId
 0x46c9c4 GetWindowTextA
 0x46c9c8 GetWindowRect
 0x46c9cc GetWindowPlacement
 0x46c9d0 GetWindowLongW
 0x46c9d4 GetWindowLongA
 0x46c9d8 GetWindowDC
 0x46c9dc GetTopWindow
 0x46c9e0 GetSystemMetrics
 0x46c9e4 GetSystemMenu
 0x46c9e8 GetSysColorBrush
 0x46c9ec GetSysColor
 0x46c9f0 GetSubMenu
 0x46c9f4 GetScrollRange
 0x46c9f8 GetScrollPos
 0x46c9fc GetScrollInfo
 0x46ca00 GetPropA
 0x46ca04 GetParent
 0x46ca08 GetWindow
 0x46ca0c GetMessagePos
 0x46ca10 GetMenuStringA
 0x46ca14 GetMenuState
 0x46ca18 GetMenuItemInfoA
 0x46ca1c GetMenuItemID
 0x46ca20 GetMenuItemCount
 0x46ca24 GetMenu
 0x46ca28 GetLastActivePopup
 0x46ca2c GetKeyboardState
 0x46ca30 GetKeyboardLayoutNameA
 0x46ca34 GetKeyboardLayoutList
 0x46ca38 GetKeyboardLayout
 0x46ca3c GetKeyState
 0x46ca40 GetKeyNameTextA
 0x46ca44 GetIconInfo
 0x46ca48 GetForegroundWindow
 0x46ca4c GetFocus
 0x46ca50 GetDesktopWindow
 0x46ca54 GetDCEx
 0x46ca58 GetDC
 0x46ca5c GetCursorPos
 0x46ca60 GetCursor
 0x46ca64 GetClientRect
 0x46ca68 GetClassLongA
 0x46ca6c GetClassInfoA
 0x46ca70 GetCapture
 0x46ca74 GetActiveWindow
 0x46ca78 FrameRect
 0x46ca7c FindWindowA
 0x46ca80 FillRect
 0x46ca84 EqualRect
 0x46ca88 EnumWindows
 0x46ca8c EnumThreadWindows
 0x46ca90 EnumChildWindows
 0x46ca94 EndPaint
 0x46ca98 EnableWindow
 0x46ca9c EnableScrollBar
 0x46caa0 EnableMenuItem
 0x46caa4 DrawTextA
 0x46caa8 DrawMenuBar
 0x46caac DrawIconEx
 0x46cab0 DrawIcon
 0x46cab4 DrawFrameControl
 0x46cab8 DrawEdge
 0x46cabc DispatchMessageW
 0x46cac0 DispatchMessageA
 0x46cac4 DestroyWindow
 0x46cac8 DestroyMenu
 0x46cacc DestroyIcon
 0x46cad0 DestroyCursor
 0x46cad4 DeleteMenu
 0x46cad8 DefWindowProcA
 0x46cadc DefMDIChildProcA
 0x46cae0 DefFrameProcA
 0x46cae4 CreatePopupMenu
 0x46cae8 CreateMenu
 0x46caec CreateIcon
 0x46caf0 ClientToScreen
 0x46caf4 CheckMenuItem
 0x46caf8 CharNextW
 0x46cafc CallWindowProcA
 0x46cb00 CallNextHookEx
 0x46cb04 BeginPaint
 0x46cb08 CharNextA
 0x46cb0c CharLowerA
 0x46cb10 CharUpperBuffA
 0x46cb14 CharToOemA
 0x46cb18 AdjustWindowRectEx
 0x46cb1c ActivateKeyboardLayout
gdi32.dll
 0x46cb24 UnrealizeObject
 0x46cb28 StretchBlt
 0x46cb2c SetWindowOrgEx
 0x46cb30 SetViewportOrgEx
 0x46cb34 SetTextColor
 0x46cb38 SetStretchBltMode
 0x46cb3c SetROP2
 0x46cb40 SetPixel
 0x46cb44 SetDIBColorTable
 0x46cb48 SetBrushOrgEx
 0x46cb4c SetBkMode
 0x46cb50 SetBkColor
 0x46cb54 SelectPalette
 0x46cb58 SelectObject
 0x46cb5c SaveDC
 0x46cb60 RestoreDC
 0x46cb64 RectVisible
 0x46cb68 RealizePalette
 0x46cb6c PatBlt
 0x46cb70 MoveToEx
 0x46cb74 MaskBlt
 0x46cb78 LineTo
 0x46cb7c IntersectClipRect
 0x46cb80 GetWindowOrgEx
 0x46cb84 GetTextMetricsA
 0x46cb88 GetTextExtentPoint32A
 0x46cb8c GetSystemPaletteEntries
 0x46cb90 GetStockObject
 0x46cb94 GetRgnBox
 0x46cb98 GetPixel
 0x46cb9c GetPaletteEntries
 0x46cba0 GetObjectA
 0x46cba4 GetDeviceCaps
 0x46cba8 GetDIBits
 0x46cbac GetDIBColorTable
 0x46cbb0 GetDCOrgEx
 0x46cbb4 GetDCBrushColor
 0x46cbb8 GetCurrentPositionEx
 0x46cbbc GetClipBox
 0x46cbc0 GetBrushOrgEx
 0x46cbc4 GetBkColor
 0x46cbc8 GetBitmapBits
 0x46cbcc ExcludeClipRect
 0x46cbd0 DeleteObject
 0x46cbd4 DeleteDC
 0x46cbd8 CreateSolidBrush
 0x46cbdc CreatePenIndirect
 0x46cbe0 CreatePalette
 0x46cbe4 CreateHalftonePalette
 0x46cbe8 CreateFontIndirectA
 0x46cbec CreateDIBitmap
 0x46cbf0 CreateDIBSection
 0x46cbf4 CreateCompatibleDC
 0x46cbf8 CreateCompatibleBitmap
 0x46cbfc CreateBrushIndirect
 0x46cc00 CreateBitmap
 0x46cc04 BitBlt
version.dll
 0x46cc0c VerQueryValueA
 0x46cc10 GetFileVersionInfoSizeA
 0x46cc14 GetFileVersionInfoA
kernel32.dll
 0x46cc1c lstrcpyA
 0x46cc20 WriteFile
 0x46cc24 WaitForSingleObject
 0x46cc28 VirtualQuery
 0x46cc2c VirtualAlloc
 0x46cc30 SizeofResource
 0x46cc34 SetThreadLocale
 0x46cc38 SetFilePointer
 0x46cc3c SetEvent
 0x46cc40 SetErrorMode
 0x46cc44 SetEndOfFile
 0x46cc48 ResetEvent
 0x46cc4c ReadFile
 0x46cc50 MultiByteToWideChar
 0x46cc54 MulDiv
 0x46cc58 LockResource
 0x46cc5c LoadResource
 0x46cc60 LoadLibraryExA
 0x46cc64 LoadLibraryA
 0x46cc68 LeaveCriticalSection
 0x46cc6c InitializeCriticalSection
 0x46cc70 GlobalFindAtomA
 0x46cc74 GlobalDeleteAtom
 0x46cc78 GlobalAddAtomA
 0x46cc7c GetVersionExA
 0x46cc80 GetVersion
 0x46cc84 GetTickCount
 0x46cc88 GetThreadLocale
 0x46cc8c GetStdHandle
 0x46cc90 GetProcAddress
 0x46cc94 GetModuleHandleA
 0x46cc98 GetModuleFileNameA
 0x46cc9c GetLocaleInfoA
 0x46cca0 GetLocalTime
 0x46cca4 GetLastError
 0x46cca8 GetFullPathNameA
 0x46ccac GetDiskFreeSpaceA
 0x46ccb0 GetDateFormatA
 0x46ccb4 GetCurrentThreadId
 0x46ccb8 GetCurrentProcessId
 0x46ccbc GetCurrentProcess
 0x46ccc0 GetCPInfo
 0x46ccc4 FreeResource
 0x46ccc8 InterlockedExchange
 0x46cccc FreeLibrary
 0x46ccd0 FormatMessageA
 0x46ccd4 FindResourceA
 0x46ccd8 EnumCalendarInfoA
 0x46ccdc EnterCriticalSection
 0x46cce0 DeleteCriticalSection
 0x46cce4 CreateThread
 0x46cce8 CreateFileA
 0x46ccec CreateEventA
 0x46ccf0 CompareStringA
 0x46ccf4 CloseHandle
advapi32.dll
 0x46ccfc RegQueryValueExA
 0x46cd00 RegOpenKeyExA
 0x46cd04 RegFlushKey
 0x46cd08 RegCloseKey
oleaut32.dll
 0x46cd10 GetErrorInfo
 0x46cd14 SysFreeString
ole32.dll
 0x46cd1c CoUninitialize
 0x46cd20 CoInitialize
kernel32.dll
 0x46cd28 Sleep
oleaut32.dll
 0x46cd30 SafeArrayPtrOfIndex
 0x46cd34 SafeArrayPutElement
 0x46cd38 SafeArrayGetElement
 0x46cd3c SafeArrayUnaccessData
 0x46cd40 SafeArrayAccessData
 0x46cd44 SafeArrayGetUBound
 0x46cd48 SafeArrayGetLBound
 0x46cd4c SafeArrayCreate
 0x46cd50 VariantChangeType
 0x46cd54 VariantCopyInd
 0x46cd58 VariantCopy
 0x46cd5c VariantClear
 0x46cd60 VariantInit
comctl32.dll
 0x46cd68 _TrackMouseEvent
 0x46cd6c ImageList_SetIconSize
 0x46cd70 ImageList_GetIconSize
 0x46cd74 ImageList_Write
 0x46cd78 ImageList_Read
 0x46cd7c ImageList_DragShowNolock
 0x46cd80 ImageList_DragMove
 0x46cd84 ImageList_DragLeave
 0x46cd88 ImageList_DragEnter
 0x46cd8c ImageList_EndDrag
 0x46cd90 ImageList_BeginDrag
 0x46cd94 ImageList_Remove
 0x46cd98 ImageList_DrawEx
 0x46cd9c ImageList_Draw
 0x46cda0 ImageList_GetBkColor
 0x46cda4 ImageList_SetBkColor
 0x46cda8 ImageList_Add
 0x46cdac ImageList_GetImageCount
 0x46cdb0 ImageList_Destroy
 0x46cdb4 ImageList_Create
ntdll
 0x46cdbc NtAllocateVirtualMemory
nTDLL
 0x46cdc4 ZwProtectVirtualMemory
uRL
 0x46cdcc AutodialHookCallback

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure