50911e1a23d33eb4a7bc66387585299339d3971f9933c0aa943c06af6daed9da

Analysis

max time kernel
141s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2023, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Size

118KB
MD5

cf9461003d7870f4ac0c1714d104b860
SHA1

90549076c16f93390719b9b3489669e5e4261209
SHA256

50911e1a23d33eb4a7bc66387585299339d3971f9933c0aa943c06af6daed9da
SHA512

116b1c79e0cad9c33a146fa4971b4706b7eb57900b2ac93abdecbdb3d322d35a454f20f301b2b4345cb3005db23dacf3ffd4d9445443c665b138ce3a6b38af7a
SSDEEP

3072:vOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:vIs9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score

7^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000022e59-10.dat	acprotect
behavioral2/files/0x0008000000022e59-30.dat	acprotect
behavioral2/files/0x0008000000022e59-34.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4920	ctfmen.exe
4680	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
4244	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
4680	smnss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	NEAS.cf9461003d7870f4ac0c1714d104b860.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ctfmen.exe	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File created	C:\Windows\SysWOW64\satornas.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\shervans.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File created	C:\Windows\SysWOW64\grcopy.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File created	C:\Windows\SysWOW64\smnss.exe	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	4680	WerFault.exe	96

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	NEAS.cf9461003d7870f4ac0c1714d104b860.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	NEAS.cf9461003d7870f4ac0c1714d104b860.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4680	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 4920	4244	NEAS.cf9461003d7870f4ac0c1714d104b860.exe	95
PID 4244 wrote to memory of 4920	4244	NEAS.cf9461003d7870f4ac0c1714d104b860.exe	95
PID 4244 wrote to memory of 4920	4244	NEAS.cf9461003d7870f4ac0c1714d104b860.exe	95
PID 4920 wrote to memory of 4680	4920	ctfmen.exe	96
PID 4920 wrote to memory of 4680	4920	ctfmen.exe	96
PID 4920 wrote to memory of 4680	4920	ctfmen.exe	96

C:\Users\Admin\AppData\Local\Temp\NEAS.cf9461003d7870f4ac0c1714d104b860.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cf9461003d7870f4ac0c1714d104b860.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 1340
      4⤵
      Program crash
      PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4680 -ip 4680
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
6918553ae421ebfd0ece6b6e464f40c3

SHA1
9f6ddeae2f8205d00da65bbdda997e967af78169

SHA256
69cdfc706bc7330c55e767b13e359c952dd503c56eaae4ed1ad9976b207fd9c5

SHA512
3639df3769248d8b2bacbd8383d3fa9e71f795cc004866ed04314d666591d1c64812c8587ffba26c20edb7b0aed8745f7edcedc77e0fda37f124215a988cdd4b

Download Submit
C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
6918553ae421ebfd0ece6b6e464f40c3

SHA1
9f6ddeae2f8205d00da65bbdda997e967af78169

SHA256
69cdfc706bc7330c55e767b13e359c952dd503c56eaae4ed1ad9976b207fd9c5

SHA512
3639df3769248d8b2bacbd8383d3fa9e71f795cc004866ed04314d666591d1c64812c8587ffba26c20edb7b0aed8745f7edcedc77e0fda37f124215a988cdd4b

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
118KB

MD5
060f77d47bf3ab3374fcab2aae4b02d8

SHA1
8ad47af03097ac71a1e08154b144bcb84e679d00

SHA256
1a8a49e2eaf3d0718fbfff9ea8797ef065bf2ac8d5467bb46aa51a001233faf6

SHA512
d0f51758b41954ea22f59c6f4d780e409c110d9ccf5b88661f8a90713322cb9c76ee29b8b5fa4e003c72737a2b47877b53b9250f425222689e21555414095588

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
118KB

MD5
060f77d47bf3ab3374fcab2aae4b02d8

SHA1
8ad47af03097ac71a1e08154b144bcb84e679d00

SHA256
1a8a49e2eaf3d0718fbfff9ea8797ef065bf2ac8d5467bb46aa51a001233faf6

SHA512
d0f51758b41954ea22f59c6f4d780e409c110d9ccf5b88661f8a90713322cb9c76ee29b8b5fa4e003c72737a2b47877b53b9250f425222689e21555414095588

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
e43bd6f0abc6c1f193752638a3c8f45e

SHA1
904362544e9ea53763ed57e03e383eb78c01dca3

SHA256
a7af90db33be5a799a74724f794dc8fa0860768583a8abefca25292c3e0bd8e5

SHA512
7965da9551f5ec834e6e1550ef031e1cf01f28eff0384468140651817d79a5e77354408c41322a7a04a6ee521e6f5febd2fc012c5d718a9887a01adafa845ce5

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
3d885d133952c9393caf568e850a880d

SHA1
da32a14ec3cb213e40653533da184456bbacbf71

SHA256
56a6c0ca3bd0b3e4a542b4762ac8e87b38e8036c6df73475cc0fdc7028b5e87e

SHA512
f2bbfe5503797f337d6f310c6cff6bde55088cdc1ca5ffec634d129a030a3b2dc5801221b5016419976ff4a62e6dc1e5dee5fa5af72c63bcd992af5fa4b24d01

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
3d885d133952c9393caf568e850a880d

SHA1
da32a14ec3cb213e40653533da184456bbacbf71

SHA256
56a6c0ca3bd0b3e4a542b4762ac8e87b38e8036c6df73475cc0fdc7028b5e87e

SHA512
f2bbfe5503797f337d6f310c6cff6bde55088cdc1ca5ffec634d129a030a3b2dc5801221b5016419976ff4a62e6dc1e5dee5fa5af72c63bcd992af5fa4b24d01

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
3d885d133952c9393caf568e850a880d

SHA1
da32a14ec3cb213e40653533da184456bbacbf71

SHA256
56a6c0ca3bd0b3e4a542b4762ac8e87b38e8036c6df73475cc0fdc7028b5e87e

SHA512
f2bbfe5503797f337d6f310c6cff6bde55088cdc1ca5ffec634d129a030a3b2dc5801221b5016419976ff4a62e6dc1e5dee5fa5af72c63bcd992af5fa4b24d01

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
060f77d47bf3ab3374fcab2aae4b02d8

SHA1
8ad47af03097ac71a1e08154b144bcb84e679d00

SHA256
1a8a49e2eaf3d0718fbfff9ea8797ef065bf2ac8d5467bb46aa51a001233faf6

SHA512
d0f51758b41954ea22f59c6f4d780e409c110d9ccf5b88661f8a90713322cb9c76ee29b8b5fa4e003c72737a2b47877b53b9250f425222689e21555414095588

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
060f77d47bf3ab3374fcab2aae4b02d8

SHA1
8ad47af03097ac71a1e08154b144bcb84e679d00

SHA256
1a8a49e2eaf3d0718fbfff9ea8797ef065bf2ac8d5467bb46aa51a001233faf6

SHA512
d0f51758b41954ea22f59c6f4d780e409c110d9ccf5b88661f8a90713322cb9c76ee29b8b5fa4e003c72737a2b47877b53b9250f425222689e21555414095588

Download Submit
memory/4244-21-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4244-26-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4244-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4244-12-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4680-29-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4680-36-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4680-37-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4920-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads