96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224

General

Target

96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
Size

118KB
MD5

c6c66835d21c0def69d12bd90c649d91
SHA1

68d5104e0290c8ca499f42e0c87e841da5585e40
SHA256

96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224
SHA512

f7a8c97c7f5249b6a4b0319ce3abbb8bb549f3834dc30bd8351d92749fffd3823e3ab9970657dbaba573bb53c1a6976f38316add53673812c46c724d2e9b0d1b
SSDEEP

3072:8OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:8Is9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score

7^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000023236-10.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4568	ctfmen.exe
2144	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
3100	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
2144	smnss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
File created	C:\Windows\SysWOW64\smnss.exe	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\shervans.dll	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
File created	C:\Windows\SysWOW64\grcopy.dll	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
File created	C:\Windows\SysWOW64\satornas.dll	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
968	2144	WerFault.exe	96

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2144	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 4568	3100	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe	95
PID 3100 wrote to memory of 4568	3100	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe	95
PID 3100 wrote to memory of 4568	3100	96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe	95
PID 4568 wrote to memory of 2144	4568	ctfmen.exe	96
PID 4568 wrote to memory of 2144	4568	ctfmen.exe	96
PID 4568 wrote to memory of 2144	4568	ctfmen.exe	96

C:\Users\Admin\AppData\Local\Temp\96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe
"C:\Users\Admin\AppData\Local\Temp\96a05ce86593cb66fdbd5c050ebd4172c956e9fce957b451cd7d695b591b5224.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 1348
      4⤵
      Program crash
      PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2144 -ip 2144
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
06ca1433bedf30cfa5c694acdfee0f14

SHA1
b7be79daf00d2e06e7332e99a3fc73f472e252bd

SHA256
a613dd8062ea5a6333ef3d27fd41fc2eb49198e0f5984b3bae1b9804bf5298f1

SHA512
3311eb036a875ce447cf3b179967291df8a55b810b3e2e9935793d90256581bc2e635e51b631b10b4715aed35df73ef49b264a0c48046a5ef985c06e3e72c6c9

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
118KB

MD5
bc8557e3bce974c2103d6ecc6f7c979c

SHA1
bf137dcfe43f0f2e4a2f00e474a2d0e0e5950162

SHA256
2ec1961227539a99cdc889f716d2acecc3cf04ed5c9283b8bd35afa7ed242968

SHA512
b043bdd61068eaf9413eedca277af61d3e21e54880f4a3547ea951a0de217c7221cb98443ec6f79730a34cea302bf68be74561d49ff2d20fc11a6c9e31093da0

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
6bd1bf9d7641c6ec04ced17d1c13f7f7

SHA1
631e0cfca7dca4b81ad89739548c599c6cd73d59

SHA256
e98ba7103c850d1db62434d01ed4400f08e850532726aa58beeab317ee5ead3b

SHA512
b802ef8b0353298fb81cffe5f46d7f1fc472695de51211a3a3a420e63f7bbfec84efe628fa3ab1c7a5d8f8c278b649dd7fdbd39551b740b65666a62666f39526

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
6d061ce01224abccf3eb6f58e3465b43

SHA1
9aac45c698fa66ecb4fbed668517be84c388af4c

SHA256
d70cee3457876eda622ec365bd8193a8c5dc2f559914035b19e7958fd830cfba

SHA512
cd0c329b2a6b706334e6533110d4d2719d7b1df26bb2de0dcbcf5e154739c6bdd62f348f18dd8ed6e96b7702ad07d9aa4d662fea8d0656416b5f8b6d2334b162

Download Submit
memory/2144-27-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2144-35-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2144-37-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3100-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3100-18-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3100-25-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3100-21-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4568-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads