50911e1a23d33eb4a7bc66387585299339d3971f9933c0aa943c06af6daed9da

Analysis

max time kernel
146s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
03/11/2023, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Size

118KB
MD5

cf9461003d7870f4ac0c1714d104b860
SHA1

90549076c16f93390719b9b3489669e5e4261209
SHA256

50911e1a23d33eb4a7bc66387585299339d3971f9933c0aa943c06af6daed9da
SHA512

116b1c79e0cad9c33a146fa4971b4706b7eb57900b2ac93abdecbdb3d322d35a454f20f301b2b4345cb3005db23dacf3ffd4d9445443c665b138ce3a6b38af7a
SSDEEP

3072:vOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:vIs9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score

7^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000600000001210b-10.dat	acprotect
behavioral1/files/0x000600000001210b-32.dat	acprotect
behavioral1/files/0x000600000001210b-38.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
1948	ctfmen.exe
2816	smnss.exe

Loads dropped DLL 9 IoCs

pid	Process
3004	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
3004	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
3004	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
1948	ctfmen.exe
1948	ctfmen.exe
2816	smnss.exe
2812	WerFault.exe
2812	WerFault.exe
2812	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	NEAS.cf9461003d7870f4ac0c1714d104b860.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	NEAS.cf9461003d7870f4ac0c1714d104b860.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File created	C:\Windows\SysWOW64\shervans.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File created	C:\Windows\SysWOW64\smnss.exe	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File created	C:\Windows\SysWOW64\satornas.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File created	C:\Windows\SysWOW64\grcopy.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm	smnss.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline.cpu.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2812	2816	WerFault.exe	29

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2816	smnss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1948	3004	NEAS.cf9461003d7870f4ac0c1714d104b860.exe	28
PID 3004 wrote to memory of 1948	3004	NEAS.cf9461003d7870f4ac0c1714d104b860.exe	28
PID 3004 wrote to memory of 1948	3004	NEAS.cf9461003d7870f4ac0c1714d104b860.exe	28
PID 3004 wrote to memory of 1948	3004	NEAS.cf9461003d7870f4ac0c1714d104b860.exe	28
PID 1948 wrote to memory of 2816	1948	ctfmen.exe	29
PID 1948 wrote to memory of 2816	1948	ctfmen.exe	29
PID 1948 wrote to memory of 2816	1948	ctfmen.exe	29
PID 1948 wrote to memory of 2816	1948	ctfmen.exe	29
PID 2816 wrote to memory of 2812	2816	smnss.exe	30
PID 2816 wrote to memory of 2812	2816	smnss.exe	30
PID 2816 wrote to memory of 2812	2816	smnss.exe	30
PID 2816 wrote to memory of 2812	2816	smnss.exe	30

C:\Users\Admin\AppData\Local\Temp\NEAS.cf9461003d7870f4ac0c1714d104b860.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cf9461003d7870f4ac0c1714d104b860.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 792
      4⤵
      Loads dropped DLL
      Program crash
      PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
7af2c66db12f99ec9edcf2c1ad5ec98d

SHA1
fc71bfaf316d940291916e808b0feb981da56941

SHA256
dd3b01c5e02dc21449e02bf0d4c55e197cfdfd47e2126cbfadcd017a9b70dbb3

SHA512
fb34aca5f940b0f1a5dcdf9e217868ccf7a480eee92d3c819ebcf107ad5472c55efbd7a55f1e4a354503eeeb92e6ece04d489cc250cb9c97b2d9c508f614e72d

Download Submit
C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
7af2c66db12f99ec9edcf2c1ad5ec98d

SHA1
fc71bfaf316d940291916e808b0feb981da56941

SHA256
dd3b01c5e02dc21449e02bf0d4c55e197cfdfd47e2126cbfadcd017a9b70dbb3

SHA512
fb34aca5f940b0f1a5dcdf9e217868ccf7a480eee92d3c819ebcf107ad5472c55efbd7a55f1e4a354503eeeb92e6ece04d489cc250cb9c97b2d9c508f614e72d

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
118KB

MD5
1208e1254b4526f1b5832b5b71b5567c

SHA1
e5e05d77332dfd19b06f358ae83a358b12252661

SHA256
86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

SHA512
6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
8b7cca691dfdd76a424061a745e5c53b

SHA1
6ffbf4f8c12d98e1df02e3a79024e3b0f0681dc1

SHA256
59d534fa90205e71e83ab47eb0da13c85b4314f27ef03a1d20a8a0be1402c1c4

SHA512
0bfe1e0ca6da1655118a7422d70ff8bf169795a5fac5cb90ddaa0a50b2cf3114ef7538a7e9818b6debea820315fc856ffb9cc38387f6ad8b8aeff083964f4207

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
ebd22461988c870d015150259fbcc4a7

SHA1
0587dc7fe709ef8b1b4b1e71c326809416ccd689

SHA256
94d9027c3812f657cd60bbb813793be6fcc109a5968d6a280de57d9d4ad1847b

SHA512
5ddf528b59c82a4c6906bd42440d9b6c89345df87572a7e043848f73947c562ce1b704fa1824f0ab7bed2e44fbb5b58103249f6165ae8a0a46637c2652181acc

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
1208e1254b4526f1b5832b5b71b5567c

SHA1
e5e05d77332dfd19b06f358ae83a358b12252661

SHA256
86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

SHA512
6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
1208e1254b4526f1b5832b5b71b5567c

SHA1
e5e05d77332dfd19b06f358ae83a358b12252661

SHA256
86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

SHA512
6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
7af2c66db12f99ec9edcf2c1ad5ec98d

SHA1
fc71bfaf316d940291916e808b0feb981da56941

SHA256
dd3b01c5e02dc21449e02bf0d4c55e197cfdfd47e2126cbfadcd017a9b70dbb3

SHA512
fb34aca5f940b0f1a5dcdf9e217868ccf7a480eee92d3c819ebcf107ad5472c55efbd7a55f1e4a354503eeeb92e6ece04d489cc250cb9c97b2d9c508f614e72d

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
7af2c66db12f99ec9edcf2c1ad5ec98d

SHA1
fc71bfaf316d940291916e808b0feb981da56941

SHA256
dd3b01c5e02dc21449e02bf0d4c55e197cfdfd47e2126cbfadcd017a9b70dbb3

SHA512
fb34aca5f940b0f1a5dcdf9e217868ccf7a480eee92d3c819ebcf107ad5472c55efbd7a55f1e4a354503eeeb92e6ece04d489cc250cb9c97b2d9c508f614e72d

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
ebd22461988c870d015150259fbcc4a7

SHA1
0587dc7fe709ef8b1b4b1e71c326809416ccd689

SHA256
94d9027c3812f657cd60bbb813793be6fcc109a5968d6a280de57d9d4ad1847b

SHA512
5ddf528b59c82a4c6906bd42440d9b6c89345df87572a7e043848f73947c562ce1b704fa1824f0ab7bed2e44fbb5b58103249f6165ae8a0a46637c2652181acc

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
ebd22461988c870d015150259fbcc4a7

SHA1
0587dc7fe709ef8b1b4b1e71c326809416ccd689

SHA256
94d9027c3812f657cd60bbb813793be6fcc109a5968d6a280de57d9d4ad1847b

SHA512
5ddf528b59c82a4c6906bd42440d9b6c89345df87572a7e043848f73947c562ce1b704fa1824f0ab7bed2e44fbb5b58103249f6165ae8a0a46637c2652181acc

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
1208e1254b4526f1b5832b5b71b5567c

SHA1
e5e05d77332dfd19b06f358ae83a358b12252661

SHA256
86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

SHA512
6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
1208e1254b4526f1b5832b5b71b5567c

SHA1
e5e05d77332dfd19b06f358ae83a358b12252661

SHA256
86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

SHA512
6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
1208e1254b4526f1b5832b5b71b5567c

SHA1
e5e05d77332dfd19b06f358ae83a358b12252661

SHA256
86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

SHA512
6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
1208e1254b4526f1b5832b5b71b5567c

SHA1
e5e05d77332dfd19b06f358ae83a358b12252661

SHA256
86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

SHA512
6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
1208e1254b4526f1b5832b5b71b5567c

SHA1
e5e05d77332dfd19b06f358ae83a358b12252661

SHA256
86cac92057101e28e26308555035ebb164bd1e54c6dcabe3e1d8ab17e142f85a

SHA512
6ae3c1e705aa9318a332012c3103f757c28c1a807b3c20f2b87e421d34bbb17a77d626cf4531347c3fa178a987945b4710c8ce5c44ce7d044cb5e74945d84fe8

Download Submit
memory/1948-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2816-37-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2816-39-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2816-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2816-44-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3004-12-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3004-18-0x0000000000420000-0x0000000000429000-memory.dmp

Filesize
36KB

Download
memory/3004-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3004-25-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3004-33-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads