e844aab9199cceb1a475ae71fdcd9b134c6ed4915dc117683314d5a5daa1d353

Analysis

max time kernel
141s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
22a7b3f63ad7ddd226052aa94b899548_JC.exe
Size 119KB
Sample231005-v88kysfd22
SHA256 e844aab9199cceb1a475ae71fdcd9b134c6ed4915dc117683314d5a5daa1d353
MD5 22a7b3f63ad7ddd226052aa94b899548
SHA1 f91e71e2473c2652e37a9cf5cb3afb8a50a636cd
SHA512 78dbd4ad177c540f6d406ed4c8897dd56222abba69543a24ecdc76e4c33b98bbcc499d5927d62d43b9e9b92d5280ab60d009e6d907dd0538a6795338ac027c7c
SSDEEP 3072:2OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:2Is9OKofHfHTXQLzgvnzHPowYbvrjD/E
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000800000002321e-10.dat	acprotect
behavioral2/files/0x000800000002321e-29.dat	acprotect
behavioral2/files/0x000800000002321e-34.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4648	ctfmen.exe
4656	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
408	22a7b3f63ad7ddd226052aa94b899548_JC.exe
4656	smnss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	22a7b3f63ad7ddd226052aa94b899548_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	22a7b3f63ad7ddd226052aa94b899548_JC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	22a7b3f63ad7ddd226052aa94b899548_JC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	22a7b3f63ad7ddd226052aa94b899548_JC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	22a7b3f63ad7ddd226052aa94b899548_JC.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\grcopy.dll	22a7b3f63ad7ddd226052aa94b899548_JC.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	22a7b3f63ad7ddd226052aa94b899548_JC.exe
File created	C:\Windows\SysWOW64\smnss.exe	22a7b3f63ad7ddd226052aa94b899548_JC.exe
File created	C:\Windows\SysWOW64\satornas.dll	22a7b3f63ad7ddd226052aa94b899548_JC.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	22a7b3f63ad7ddd226052aa94b899548_JC.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	22a7b3f63ad7ddd226052aa94b899548_JC.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	22a7b3f63ad7ddd226052aa94b899548_JC.exe
File created	C:\Windows\SysWOW64\shervans.dll	22a7b3f63ad7ddd226052aa94b899548_JC.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4092	4656	WerFault.exe	93

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	22a7b3f63ad7ddd226052aa94b899548_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	22a7b3f63ad7ddd226052aa94b899548_JC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	22a7b3f63ad7ddd226052aa94b899548_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	22a7b3f63ad7ddd226052aa94b899548_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	22a7b3f63ad7ddd226052aa94b899548_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 4648	408	22a7b3f63ad7ddd226052aa94b899548_JC.exe	92
PID 408 wrote to memory of 4648	408	22a7b3f63ad7ddd226052aa94b899548_JC.exe	92
PID 408 wrote to memory of 4648	408	22a7b3f63ad7ddd226052aa94b899548_JC.exe	92
PID 4648 wrote to memory of 4656	4648	ctfmen.exe	93
PID 4648 wrote to memory of 4656	4648	ctfmen.exe	93
PID 4648 wrote to memory of 4656	4648	ctfmen.exe	93

C:\Users\Admin\AppData\Local\Temp\22a7b3f63ad7ddd226052aa94b899548_JC.exe
"C:\Users\Admin\AppData\Local\Temp\22a7b3f63ad7ddd226052aa94b899548_JC.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1340
      4⤵
      Program crash
      PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4656 -ip 4656
1⤵
PID:3932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ctfmen.exe

Path C:\Windows\SysWOW64\ctfmen.exe
Size 4KB
SHA256 96ad79aa56d213dcb37e788f96da3bc4efe741430b2d582691dd9c356aacb313
MD5 94384911b3e6a7f19cab7ea10b4afb3f
SHA1 d5c6dd0e890354f559c6021533bca5489c225366
SHA512 9975fb6f9b8356a627dfda3f164718c029744bafd03fa081d7b5645f2cc55df2d3fd8944e1f219d5e4496191c6ac92ef56d2c698ca025ba34abb92a1dfea001d
SSDEEP 96:L8IdSLQPZARC3dCE8Y0Jw5NL6EVwHHKg2:wswdRCNCE8YPWowHHK7
MD5 SHA1 SHA512 SSDEEP

Submit Download

ctfmen.exe

Path C:\Windows\SysWOW64\ctfmen.exe
Size 4KB
SHA256 96ad79aa56d213dcb37e788f96da3bc4efe741430b2d582691dd9c356aacb313
MD5 94384911b3e6a7f19cab7ea10b4afb3f
SHA1 d5c6dd0e890354f559c6021533bca5489c225366
SHA512 9975fb6f9b8356a627dfda3f164718c029744bafd03fa081d7b5645f2cc55df2d3fd8944e1f219d5e4496191c6ac92ef56d2c698ca025ba34abb92a1dfea001d
SSDEEP 96:L8IdSLQPZARC3dCE8Y0Jw5NL6EVwHHKg2:wswdRCNCE8YPWowHHK7
MD5 SHA1 SHA512 SSDEEP

Submit Download

grcopy.dll

Path C:\Windows\SysWOW64\grcopy.dll
Size 119KB
SHA256 fdac237b0d946f3bf9ce68480406d78372246b43ec7be953a2ea0ce53e4c1d6b
MD5 d4e1f4a874e87fc6ef2c685884509000
SHA1 68883bbed50fe0bce66992dc3bbe21afe4a6d7c1
SHA512 23ca292f222aae4945e1d61e699caf49807bd436b0c10cdb062560134a9efa4be371e9128a34c693a923e69f15d81a36b83fa10ed75e6ab3303f6b92924a6b68
SSDEEP 3072:uOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:uIs9OKofHfHTXQLzgvnzHPowYbvrjD/E
MD5 SHA1 SHA512 SSDEEP

Submit Download

grcopy.dll

Path C:\Windows\SysWOW64\grcopy.dll
Size 119KB
SHA256 fdac237b0d946f3bf9ce68480406d78372246b43ec7be953a2ea0ce53e4c1d6b
MD5 d4e1f4a874e87fc6ef2c685884509000
SHA1 68883bbed50fe0bce66992dc3bbe21afe4a6d7c1
SHA512 23ca292f222aae4945e1d61e699caf49807bd436b0c10cdb062560134a9efa4be371e9128a34c693a923e69f15d81a36b83fa10ed75e6ab3303f6b92924a6b68
SSDEEP 3072:uOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:uIs9OKofHfHTXQLzgvnzHPowYbvrjD/E
MD5 SHA1 SHA512 SSDEEP

Submit Download

satornas.dll

Path C:\Windows\SysWOW64\satornas.dll
Size 183B
SHA256 e7154508e2582bf6b87d391de7ffdc36a6f9bcbebd42e2b8f51bdbfe29eac381
MD5 b4db7f802f0ecf5e10937c8aed3aaf99
SHA1 f5e980c6910372ede5fc76db9220b645dabd91d0
SHA512 4cef855d7c70985480d484398f0883d0f566fe3afa8a256d8293e5688fa9991dad06b6d62a57c581181a6a4addfb58c695c1b5559000c887123a964147da5c6b
MD5 SHA1 SHA512

Submit Download

shervans.dll

Path C:\Windows\SysWOW64\shervans.dll
Size 8KB
SHA256 5c4291b15bdbb826263acdcdb69eba40341549171d58b8a3c86e4cd331f0d24f
MD5 c332ff14573fc7a47acc6991c996b711
SHA1 ba963e9d6bcd691e2ead720a8ef01e8a1194f494
SHA512 2663773c591e6ea7e39139a22c36ae89d4a45536293d1525734c49c431596113d4373ab0d3f1c879d4b0fdb54b38fc7830c6aca5c9b19252be7e5b91d24663b0
SSDEEP 192:qh4SFyvWohE5xf6YUBSL63SUJqtMblWN:qO+ohE2B13NJqtM
MD5 SHA1 SHA512 SSDEEP

Submit Download

shervans.dll

Path C:\Windows\SysWOW64\shervans.dll
Size 8KB
SHA256 5c4291b15bdbb826263acdcdb69eba40341549171d58b8a3c86e4cd331f0d24f
MD5 c332ff14573fc7a47acc6991c996b711
SHA1 ba963e9d6bcd691e2ead720a8ef01e8a1194f494
SHA512 2663773c591e6ea7e39139a22c36ae89d4a45536293d1525734c49c431596113d4373ab0d3f1c879d4b0fdb54b38fc7830c6aca5c9b19252be7e5b91d24663b0
SSDEEP 192:qh4SFyvWohE5xf6YUBSL63SUJqtMblWN:qO+ohE2B13NJqtM
MD5 SHA1 SHA512 SSDEEP

Submit Download

shervans.dll

Path C:\Windows\SysWOW64\shervans.dll
Size 8KB
SHA256 5c4291b15bdbb826263acdcdb69eba40341549171d58b8a3c86e4cd331f0d24f
MD5 c332ff14573fc7a47acc6991c996b711
SHA1 ba963e9d6bcd691e2ead720a8ef01e8a1194f494
SHA512 2663773c591e6ea7e39139a22c36ae89d4a45536293d1525734c49c431596113d4373ab0d3f1c879d4b0fdb54b38fc7830c6aca5c9b19252be7e5b91d24663b0
SSDEEP 192:qh4SFyvWohE5xf6YUBSL63SUJqtMblWN:qO+ohE2B13NJqtM
MD5 SHA1 SHA512 SSDEEP

Submit Download

smnss.exe

Path C:\Windows\SysWOW64\smnss.exe
Size 119KB
SHA256 fdac237b0d946f3bf9ce68480406d78372246b43ec7be953a2ea0ce53e4c1d6b
MD5 d4e1f4a874e87fc6ef2c685884509000
SHA1 68883bbed50fe0bce66992dc3bbe21afe4a6d7c1
SHA512 23ca292f222aae4945e1d61e699caf49807bd436b0c10cdb062560134a9efa4be371e9128a34c693a923e69f15d81a36b83fa10ed75e6ab3303f6b92924a6b68
SSDEEP 3072:uOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:uIs9OKofHfHTXQLzgvnzHPowYbvrjD/E
MD5 SHA1 SHA512 SSDEEP

Submit Download

smnss.exe

Path C:\Windows\SysWOW64\smnss.exe
Size 119KB
SHA256 fdac237b0d946f3bf9ce68480406d78372246b43ec7be953a2ea0ce53e4c1d6b
MD5 d4e1f4a874e87fc6ef2c685884509000
SHA1 68883bbed50fe0bce66992dc3bbe21afe4a6d7c1
SHA512 23ca292f222aae4945e1d61e699caf49807bd436b0c10cdb062560134a9efa4be371e9128a34c693a923e69f15d81a36b83fa10ed75e6ab3303f6b92924a6b68
SSDEEP 3072:uOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:uIs9OKofHfHTXQLzgvnzHPowYbvrjD/E
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/408-30-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/408-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/408-21-0x0000000010000000-0x000000001000D000-memory.dmp

Download

memory/408-13-0x0000000010000000-0x000000001000D000-memory.dmp

Download

memory/4648-25-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4648-23-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4656-28-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4656-36-0x0000000010000000-0x000000001000D000-memory.dmp

Download

memory/4656-37-0x0000000000400000-0x0000000000420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads