7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e

Analysis

max time kernel
145s
max time network
124s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 18:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
Size

75KB
MD5

84d518fa776be0277e054fe0d9531750
SHA1

663646b0d4355402202c86da2b9c477b82cec492
SHA256

7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e
SHA512

55331075151605661d0e126f53a692f40398139ba6c2cc73bd104ecedba990beabb410a3b79faf13c6619928326008c3aea64aa42ede698b0a86ba75dba69c08
SSDEEP

1536:5x1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3g:jOjWuyt0ZsqsXOKofHfHTXQLzgvnzHP4

Score

7^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c000000012274-9.dat	acprotect
behavioral1/files/0x000c000000012274-31.dat	acprotect
behavioral1/files/0x000c000000012274-36.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2580	ctfmen.exe
2772	smnss.exe

Loads dropped DLL 9 IoCs

pid	Process
1940	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
1940	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
1940	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
2580	ctfmen.exe
2580	ctfmen.exe
2772	smnss.exe
2512	WerFault.exe
2512	WerFault.exe
2512	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
File created	C:\Windows\SysWOW64\shervans.dll	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
File created	C:\Windows\SysWOW64\satornas.dll	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
File created	C:\Windows\SysWOW64\smnss.exe	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\grcopy.dll	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	smnss.exe
File opened for modification	C:\Program Files\ImportDebug.php	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	smnss.exe
File opened for modification	C:\Program Files\Internet Explorer\Timeline.cpu.xml	smnss.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\Filters.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2512	2772	WerFault.exe	29

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	smnss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2580	1940	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe	28
PID 1940 wrote to memory of 2580	1940	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe	28
PID 1940 wrote to memory of 2580	1940	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe	28
PID 1940 wrote to memory of 2580	1940	7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe	28
PID 2580 wrote to memory of 2772	2580	ctfmen.exe	29
PID 2580 wrote to memory of 2772	2580	ctfmen.exe	29
PID 2580 wrote to memory of 2772	2580	ctfmen.exe	29
PID 2580 wrote to memory of 2772	2580	ctfmen.exe	29
PID 2772 wrote to memory of 2512	2772	smnss.exe	30
PID 2772 wrote to memory of 2512	2772	smnss.exe	30
PID 2772 wrote to memory of 2512	2772	smnss.exe	30
PID 2772 wrote to memory of 2512	2772	smnss.exe	30

C:\Users\Admin\AppData\Local\Temp\7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe
"C:\Users\Admin\AppData\Local\Temp\7905a8616dc6ebcc1ea1770d3064d9a7347e47fa3d74e3f1a1d14f5cc8c5212e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2772 -s 792
      4⤵
      Loads dropped DLL
      Program crash
      PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
54352209415741d6da32a5d1c19dded4

SHA1
cce74be2942f3334c2d729d34732a63f7dc28b49

SHA256
e51e1d1b23f85a44067e28d759ad9c86ab66816e7db4c9f86ceacae430aaa1e4

SHA512
e2a5d7d246a3fe4db68edee953fdc68086e5a94eacdb2ea043b7d55938eb363d0280a4ede77f6795413928f177f9f9e9c34126f9bac6c5bb73650b43b202807f

Download Submit
C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
54352209415741d6da32a5d1c19dded4

SHA1
cce74be2942f3334c2d729d34732a63f7dc28b49

SHA256
e51e1d1b23f85a44067e28d759ad9c86ab66816e7db4c9f86ceacae430aaa1e4

SHA512
e2a5d7d246a3fe4db68edee953fdc68086e5a94eacdb2ea043b7d55938eb363d0280a4ede77f6795413928f177f9f9e9c34126f9bac6c5bb73650b43b202807f

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
75KB

MD5
562639b6ba1a6f9012a405e5eb2587c5

SHA1
3e1842ff12b96f0698c88c60818798a42c9e7422

SHA256
586a129adca444fcee6eee3b265d059aed9b2356fff846bd23a93b4ca401dfda

SHA512
b54709016a9327bcccf06d5fd0b218cbe49aeb3207b0059ad3d72edcf54bc95649a3f6a3f5d4d83de054118814cf17b691a78d3205a01a91ce5b02ce5133d151

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
61f8d74cf6c1d57aba6e2c6b0c3566de

SHA1
3c489ce2bd6b5881ba608cb5cb29d8294a2f3e4a

SHA256
0a58a2c2dc94a3edd693a0d8e16fa2f56792c68a275c044f9a2ea87eff6d0d69

SHA512
012d432cd60848c7b91b316a17470423b0492a0fba896e3d3a346f941d090b881b6182f71880e2e3d1c4b3d102cb58f3b518a79ed12cf65af656c357319dd3b6

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
18fcb4f7de9bb6051cb37219e45ef3ff

SHA1
a650dd79d0c33def3884d518ef9c3c3015b0f70b

SHA256
b7e0c1e024f9a4a2d1759d79fbfd6da195ec159007c28089f3479db40aefce57

SHA512
eba3e3cf32f5495df8c3824accdd082c6b835c728a8b3904228ac9d85197cb2cacc1f769db8d8bc7c7ccd586494b6fdd8df2eca3df2adc9a703e5f5e39dce173

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
75KB

MD5
562639b6ba1a6f9012a405e5eb2587c5

SHA1
3e1842ff12b96f0698c88c60818798a42c9e7422

SHA256
586a129adca444fcee6eee3b265d059aed9b2356fff846bd23a93b4ca401dfda

SHA512
b54709016a9327bcccf06d5fd0b218cbe49aeb3207b0059ad3d72edcf54bc95649a3f6a3f5d4d83de054118814cf17b691a78d3205a01a91ce5b02ce5133d151

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
75KB

MD5
562639b6ba1a6f9012a405e5eb2587c5

SHA1
3e1842ff12b96f0698c88c60818798a42c9e7422

SHA256
586a129adca444fcee6eee3b265d059aed9b2356fff846bd23a93b4ca401dfda

SHA512
b54709016a9327bcccf06d5fd0b218cbe49aeb3207b0059ad3d72edcf54bc95649a3f6a3f5d4d83de054118814cf17b691a78d3205a01a91ce5b02ce5133d151

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
54352209415741d6da32a5d1c19dded4

SHA1
cce74be2942f3334c2d729d34732a63f7dc28b49

SHA256
e51e1d1b23f85a44067e28d759ad9c86ab66816e7db4c9f86ceacae430aaa1e4

SHA512
e2a5d7d246a3fe4db68edee953fdc68086e5a94eacdb2ea043b7d55938eb363d0280a4ede77f6795413928f177f9f9e9c34126f9bac6c5bb73650b43b202807f

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
54352209415741d6da32a5d1c19dded4

SHA1
cce74be2942f3334c2d729d34732a63f7dc28b49

SHA256
e51e1d1b23f85a44067e28d759ad9c86ab66816e7db4c9f86ceacae430aaa1e4

SHA512
e2a5d7d246a3fe4db68edee953fdc68086e5a94eacdb2ea043b7d55938eb363d0280a4ede77f6795413928f177f9f9e9c34126f9bac6c5bb73650b43b202807f

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
18fcb4f7de9bb6051cb37219e45ef3ff

SHA1
a650dd79d0c33def3884d518ef9c3c3015b0f70b

SHA256
b7e0c1e024f9a4a2d1759d79fbfd6da195ec159007c28089f3479db40aefce57

SHA512
eba3e3cf32f5495df8c3824accdd082c6b835c728a8b3904228ac9d85197cb2cacc1f769db8d8bc7c7ccd586494b6fdd8df2eca3df2adc9a703e5f5e39dce173

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
18fcb4f7de9bb6051cb37219e45ef3ff

SHA1
a650dd79d0c33def3884d518ef9c3c3015b0f70b

SHA256
b7e0c1e024f9a4a2d1759d79fbfd6da195ec159007c28089f3479db40aefce57

SHA512
eba3e3cf32f5495df8c3824accdd082c6b835c728a8b3904228ac9d85197cb2cacc1f769db8d8bc7c7ccd586494b6fdd8df2eca3df2adc9a703e5f5e39dce173

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
75KB

MD5
562639b6ba1a6f9012a405e5eb2587c5

SHA1
3e1842ff12b96f0698c88c60818798a42c9e7422

SHA256
586a129adca444fcee6eee3b265d059aed9b2356fff846bd23a93b4ca401dfda

SHA512
b54709016a9327bcccf06d5fd0b218cbe49aeb3207b0059ad3d72edcf54bc95649a3f6a3f5d4d83de054118814cf17b691a78d3205a01a91ce5b02ce5133d151

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
75KB

MD5
562639b6ba1a6f9012a405e5eb2587c5

SHA1
3e1842ff12b96f0698c88c60818798a42c9e7422

SHA256
586a129adca444fcee6eee3b265d059aed9b2356fff846bd23a93b4ca401dfda

SHA512
b54709016a9327bcccf06d5fd0b218cbe49aeb3207b0059ad3d72edcf54bc95649a3f6a3f5d4d83de054118814cf17b691a78d3205a01a91ce5b02ce5133d151

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
75KB

MD5
562639b6ba1a6f9012a405e5eb2587c5

SHA1
3e1842ff12b96f0698c88c60818798a42c9e7422

SHA256
586a129adca444fcee6eee3b265d059aed9b2356fff846bd23a93b4ca401dfda

SHA512
b54709016a9327bcccf06d5fd0b218cbe49aeb3207b0059ad3d72edcf54bc95649a3f6a3f5d4d83de054118814cf17b691a78d3205a01a91ce5b02ce5133d151

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
75KB

MD5
562639b6ba1a6f9012a405e5eb2587c5

SHA1
3e1842ff12b96f0698c88c60818798a42c9e7422

SHA256
586a129adca444fcee6eee3b265d059aed9b2356fff846bd23a93b4ca401dfda

SHA512
b54709016a9327bcccf06d5fd0b218cbe49aeb3207b0059ad3d72edcf54bc95649a3f6a3f5d4d83de054118814cf17b691a78d3205a01a91ce5b02ce5133d151

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
75KB

MD5
562639b6ba1a6f9012a405e5eb2587c5

SHA1
3e1842ff12b96f0698c88c60818798a42c9e7422

SHA256
586a129adca444fcee6eee3b265d059aed9b2356fff846bd23a93b4ca401dfda

SHA512
b54709016a9327bcccf06d5fd0b218cbe49aeb3207b0059ad3d72edcf54bc95649a3f6a3f5d4d83de054118814cf17b691a78d3205a01a91ce5b02ce5133d151

Download Submit
memory/1940-25-0x00000000002D0000-0x00000000002D9000-memory.dmp

Filesize
36KB

Download
memory/1940-35-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1940-24-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1940-17-0x00000000002D0000-0x00000000002D9000-memory.dmp

Filesize
36KB

Download
memory/1940-15-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2580-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2772-38-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2772-42-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads