Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
14/11/2023, 18:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe
Resource
win7-20231020-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe
-
Size
118KB
-
MD5
bb8c3055d4d73512c2faab4449601a90
-
SHA1
12d9b881e6e83a1a16874bb5e6b2068e9fd50da4
-
SHA256
0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c
-
SHA512
f0e38c42e8780eaa62eed5c2fd5499adf1f609ecaa431a0fb3564a00284f1d57fc0db46ea0db131b60db2099b901b5f2afb7afe2064bd15b6d54b130d90254c1
-
SSDEEP
3072:XOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:XIs9OKofHfHTXQLzgvnzHPowYbvrjD/m
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0006000000022ce4-10.dat acprotect behavioral2/files/0x0006000000022ce4-30.dat acprotect behavioral2/files/0x0006000000022ce4-34.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 5060 ctfmen.exe 1920 smnss.exe -
Loads dropped DLL 2 IoCs
pid Process 1484 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe 1920 smnss.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 smnss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\shervans.dll 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe File created C:\Windows\SysWOW64\grcopy.dll 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe File created C:\Windows\SysWOW64\smnss.exe 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe File opened for modification C:\Windows\SysWOW64\satornas.dll 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe File opened for modification C:\Windows\SysWOW64\ctfmen.exe 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe File opened for modification C:\Windows\SysWOW64\grcopy.dll 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe File opened for modification C:\Windows\SysWOW64\shervans.dll 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe File created C:\Windows\SysWOW64\satornas.dll 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe File created C:\Windows\SysWOW64\ctfmen.exe 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipschs.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\card_expiration_terms_dict.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL090.XML smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfigOnLogon.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\View3d\3DViewerProductDescription-universal.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses\c2rpridslicensefiles_auto.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinLearningToolsLocal.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Content.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial Black-Arial.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\HeartbeatConfig.xml smnss.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\vlm_cmd.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml smnss.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL078.XML smnss.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\Products.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Red.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\lpklegal.txt smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\avtransport.xml smnss.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\README.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial-Times New Roman.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.Resource\Xbox.Smartglass.Loc.xml smnss.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\SYMBOL.TXT smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Tw Cen MT-Rockwell.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\ThirdPartyNotices.txt smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Velocity\FeatureStaging-SnipAndSketch.xml smnss.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt smnss.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\excluded.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerView.PowerView.x-none.msi.16.x-none.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL081.XML smnss.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.common.16.xml smnss.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\AppXManifest.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.osmmui.msi.16.en-us.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPackEula.txt smnss.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.Common.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\en-US\Report.System.Wired.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.CPU.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Wired.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\de-DE\Rules.System.Diagnostics.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\fr-FR\Rules.System.Performance.xml smnss.exe File opened for modification C:\Windows\diagnostics\index\IESecurityDiagnostic.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.Wired.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\ja-JP\Report.System.Common.xml smnss.exe File opened for modification C:\Windows\diagnostics\index\NetworkDiagnostics_6_DA.xml smnss.exe File opened for modification C:\Windows\Logs\MoSetup\ActionList.xml smnss.exe File opened for modification C:\Windows\Panther\diagerr.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\it-IT\Report.System.Diagnostics.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\it-IT\Report.System.Summary.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\en-US\Rules.System.Wired.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\ja-JP\Rules.System.Summary.xml smnss.exe File opened for modification C:\Windows\Provisioning\categories.xml smnss.exe File opened for modification C:\Windows\servicing\Editions\ProfessionalEdition.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.Wired.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Memory.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.NetDiagFramework.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Common.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\ja-JP\Rules.System.Disk.xml smnss.exe File opened for modification C:\Windows\schemas\CodeIntegrity\ExamplePolicies\DenyAllAudit.xml smnss.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CROATIAN.TXT smnss.exe File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.Configuration.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.Disk.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\en-US\Rules.System.Summary.xml smnss.exe File opened for modification C:\Windows\diagnostics\index\AudioPlaybackDiagnostic.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Finale.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\fr-FR\Rules.System.Disk.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\ja-JP\Rules.System.Memory.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\ja-JP\Rules.System.Wired.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\en-US\Rules.System.Network.xml smnss.exe File opened for modification C:\Windows\DiagTrack\Scenarios\windows.diag_ondemand.xml smnss.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1257.TXT smnss.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RedistList\FrameworkList.xml smnss.exe File opened for modification C:\Windows\Panther\diagwrn.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\en-US\Report.System.Common.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.Network.xml smnss.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1253.TXT smnss.exe File opened for modification C:\Windows\PLA\Reports\it-IT\Report.System.Performance.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\de-DE\Rules.System.CPU.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\de-DE\Rules.System.Disk.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\fr-FR\Rules.System.Diagnostics.xml smnss.exe File opened for modification C:\Windows\diagnostics\index\DeviceDiagnostic.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Diagnostics.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Wireless.xml smnss.exe File opened for modification C:\Windows\diagnostics\index\NetworkDiagnostics_1_Web.xml smnss.exe File opened for modification C:\Windows\ImmersiveControlPanel\appxblockmap.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\en-US\Rules.System.NetDiagFramework.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\fr-FR\Rules.System.Summary.xml smnss.exe File opened for modification C:\Windows\servicing\Editions\EditionMappings.xml smnss.exe File opened for modification C:\Windows\servicing\Editions\EditionMatrix.xml smnss.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ROMANIAN.TXT smnss.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.CPU.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Finale.xml smnss.exe File opened for modification C:\Windows\servicing\Editions\ProfessionalWorkstationEdition.xml smnss.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\TURKISH.TXT smnss.exe File opened for modification C:\Windows\PLA\Reports\ja-JP\Report.System.NetDiagFramework.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Disk.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.CPU.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\ja-JP\Report.System.Performance.xml smnss.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1920 smnss.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1484 wrote to memory of 5060 1484 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe 93 PID 1484 wrote to memory of 5060 1484 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe 93 PID 1484 wrote to memory of 5060 1484 0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe 93 PID 5060 wrote to memory of 1920 5060 ctfmen.exe 94 PID 5060 wrote to memory of 1920 5060 ctfmen.exe 94 PID 5060 wrote to memory of 1920 5060 ctfmen.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe"C:\Users\Admin\AppData\Local\Temp\0a8f5146230480acdd40edc03d1574bbff7ef4388e1fc44ddac5e1fdd8cf7c4c.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1920
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51365efa5facb18b9f08476331020f8ce
SHA1f3e74376e925f82f36f0674885526d0f1adc6df4
SHA25697c1d7b4de842d1031ad5051b323925c63345f9a2bd7975e2088fd279782ed57
SHA5124e4eb745561f82600288af959ddde4450932ed41ce868f31c92035e967208fedf7af169bbbb2ae20a8576b89d65a38b84d2cf61077d5e5ac37e6db653a40a78e
-
Filesize
4KB
MD51365efa5facb18b9f08476331020f8ce
SHA1f3e74376e925f82f36f0674885526d0f1adc6df4
SHA25697c1d7b4de842d1031ad5051b323925c63345f9a2bd7975e2088fd279782ed57
SHA5124e4eb745561f82600288af959ddde4450932ed41ce868f31c92035e967208fedf7af169bbbb2ae20a8576b89d65a38b84d2cf61077d5e5ac37e6db653a40a78e
-
Filesize
118KB
MD5e99701f45459f23587f3f0248e508f07
SHA133e1c6bace4eb0ab928dc8ace8f5a4d191643410
SHA256c674b769f1ba6ac2fb27c9f60189993cf9085073757ea0d46646a93f16b30d89
SHA512033c811caad19759f8bbae3e4f200b744fe78ebcd25485c3e62027f9dfc4e1e34465df62698d6877d3a9a5bb9bc84316acbcfa40c6a63deeeaa58b1630d3e8e0
-
Filesize
118KB
MD5e99701f45459f23587f3f0248e508f07
SHA133e1c6bace4eb0ab928dc8ace8f5a4d191643410
SHA256c674b769f1ba6ac2fb27c9f60189993cf9085073757ea0d46646a93f16b30d89
SHA512033c811caad19759f8bbae3e4f200b744fe78ebcd25485c3e62027f9dfc4e1e34465df62698d6877d3a9a5bb9bc84316acbcfa40c6a63deeeaa58b1630d3e8e0
-
Filesize
183B
MD55bdb8b12714b14eb455f95bb6ee757bf
SHA1fbfcad081f802b47c4d7d1a664c52ecfe6926a33
SHA2563fa874d21eefb3ba40df1e99ecdef9f3a53e6d190f446cfeb3e9b927f4a811f4
SHA5126e4a3d28932e78c6c1e193c08c0ab045d22b378565abcac85b0ba175ad7fa890eba2df2e5406661808e425c65b91ca6d0c1c3a0aa088a8f09fbf6f8dc305589b
-
Filesize
8KB
MD5e1efdcb29bf29e822df1383138e85a34
SHA1bae2c9bfacee021c10112e23ff5d23fd86a68853
SHA256cdad4387721c44b35f260afca5042872aab7cdd703fb1cc2571461789c249664
SHA512f2c198e73a818b01ac0efb7ccc3df0a60230553ac7531bc5f7bae250e7bbef67b524faa27c4ee64a2fb75a1d00640e9f44241f60eda94a8d95d733a47de498e3
-
Filesize
8KB
MD5e1efdcb29bf29e822df1383138e85a34
SHA1bae2c9bfacee021c10112e23ff5d23fd86a68853
SHA256cdad4387721c44b35f260afca5042872aab7cdd703fb1cc2571461789c249664
SHA512f2c198e73a818b01ac0efb7ccc3df0a60230553ac7531bc5f7bae250e7bbef67b524faa27c4ee64a2fb75a1d00640e9f44241f60eda94a8d95d733a47de498e3
-
Filesize
8KB
MD5e1efdcb29bf29e822df1383138e85a34
SHA1bae2c9bfacee021c10112e23ff5d23fd86a68853
SHA256cdad4387721c44b35f260afca5042872aab7cdd703fb1cc2571461789c249664
SHA512f2c198e73a818b01ac0efb7ccc3df0a60230553ac7531bc5f7bae250e7bbef67b524faa27c4ee64a2fb75a1d00640e9f44241f60eda94a8d95d733a47de498e3
-
Filesize
118KB
MD5e99701f45459f23587f3f0248e508f07
SHA133e1c6bace4eb0ab928dc8ace8f5a4d191643410
SHA256c674b769f1ba6ac2fb27c9f60189993cf9085073757ea0d46646a93f16b30d89
SHA512033c811caad19759f8bbae3e4f200b744fe78ebcd25485c3e62027f9dfc4e1e34465df62698d6877d3a9a5bb9bc84316acbcfa40c6a63deeeaa58b1630d3e8e0
-
Filesize
118KB
MD5e99701f45459f23587f3f0248e508f07
SHA133e1c6bace4eb0ab928dc8ace8f5a4d191643410
SHA256c674b769f1ba6ac2fb27c9f60189993cf9085073757ea0d46646a93f16b30d89
SHA512033c811caad19759f8bbae3e4f200b744fe78ebcd25485c3e62027f9dfc4e1e34465df62698d6877d3a9a5bb9bc84316acbcfa40c6a63deeeaa58b1630d3e8e0