4e82c1f7dda02c03d79a3b539271fd5429c1ba7d66d60433398f5e737d076ed4

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/03/2024, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
Size 41KB
Sample240303-mbktmahe33
SHA256 4e82c1f7dda02c03d79a3b539271fd5429c1ba7d66d60433398f5e737d076ed4
MD5 a4766bef6f0260960b0453d09c1e9000
SHA1 ef883c50f3815cf87feddd0105d122648d97c5e4
SHA512 fe89128cd861c5b1e8cfcff339b4d05a4e7e3d66971eb0df9bf3fdf953f9a2e475c99a5b5ac529f713ea8e99f18f1888174844d2ad185e7290fa26973d152fb9
SSDEEP 768:DeMc5VwWt1jDkbXdnTOyQxHFO+IxX2P5LIbbcPYir2lAqcdF0i09CyH:Dq5VwWDjDkdTRqHFOn8tIbbeYiuZIFSD
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral2/memory/5032-0-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral2/files/0x0008000000023266-10.dat	UPX
behavioral2/memory/5032-12-0x0000000010000000-0x000000001000D000-memory.dmp	UPX
behavioral2/files/0x0007000000023267-16.dat	UPX
behavioral2/files/0x0010000000023259-20.dat	UPX
behavioral2/memory/5032-22-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral2/memory/5032-24-0x0000000010000000-0x000000001000D000-memory.dmp	UPX
behavioral2/memory/4580-21-0x0000000000400000-0x0000000000409000-memory.dmp	UPX
behavioral2/memory/4580-26-0x0000000000400000-0x0000000000409000-memory.dmp	UPX
behavioral2/memory/3280-28-0x0000000000400000-0x000000000041F000-memory.dmp	UPX
behavioral2/memory/3280-36-0x0000000010000000-0x000000001000D000-memory.dmp	UPX
behavioral2/memory/3280-37-0x0000000000400000-0x000000000041F000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023266-10.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
4580	ctfmen.exe
3280	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
5032	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
3280	smnss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shervans.dll	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
File created	C:\Windows\SysWOW64\smnss.exe	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
File created	C:\Windows\SysWOW64\grcopy.dll	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
File created	C:\Windows\SysWOW64\satornas.dll	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1848	3280	WerFault.exe	100

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3280	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4580	5032	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe	99
PID 5032 wrote to memory of 4580	5032	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe	99
PID 5032 wrote to memory of 4580	5032	virussign.com_a4766bef6f0260960b0453d09c1e9000.exe	99
PID 4580 wrote to memory of 3280	4580	ctfmen.exe	100
PID 4580 wrote to memory of 3280	4580	ctfmen.exe	100
PID 4580 wrote to memory of 3280	4580	ctfmen.exe	100

C:\Users\Admin\AppData\Local\Temp\virussign.com_a4766bef6f0260960b0453d09c1e9000.exe
"C:\Users\Admin\AppData\Local\Temp\virussign.com_a4766bef6f0260960b0453d09c1e9000.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:3280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3280 -s 1356
      4⤵
      Program crash
      PID:1848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3280 -ip 3280
1⤵
PID:1048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ctfmen.exe

Path C:\Windows\SysWOW64\ctfmen.exe
Size 4KB
SHA256 8e2f55dfc49f503c5ae87b194280dcb780b080d50d0f1c94b2327fb6a92283d9
MD5 b80a57a55a843dfa80de38160e229744
SHA1 41d9237f9e05edf04fd2b55190c42f215c499e25
SHA512 ac033e123f6bc1b48a66fed3d834438be6516ebf4d0796e7722a6da19cec2683694b5ab1bf58cf4735a3544205979df34db7eb0c40b3182a4a753bbc03969003
SSDEEP 96:LLiIdSLQPZARC3dCE8Y0Jw5NL6EVwHHKg2:XiswdRCNCE8YPWowHHK7
MD5 SHA1 SHA512 SSDEEP

Submit Download

grcopy.dll

Path C:\Windows\SysWOW64\grcopy.dll
Size 41KB
SHA256 9d0da8b683353289bec88369c1d6646956cdb9627e1926cfdd6fb295b5b363a8
MD5 9f2095d40edcd89b84226176e313f7fa
SHA1 3ae37121af2a9a09ac7cb1aaad58d8e4793c3044
SHA512 e8db50c7890eebe5ddddb2ae276acb742e7cc817347b1fbbc3c487c98136f52186ce481337db94206ec011cd7dd643228c8e148caa7973cd403b51b189e4ca1b
SSDEEP 768:OeMc5VwWt1jDkbXdnTOyQxHFO+IxX2P5LIbbcPYir2lAqcdF0i09CyH:Oq5VwWDjDkdTRqHFOn8tIbbeYiuZIFSD
MD5 SHA1 SHA512 SSDEEP

Submit Download

satornas.dll

Path C:\Windows\SysWOW64\satornas.dll
Size 183B
SHA256 62682dcddd7c0b132cfe10689594cbb5a1d2f6f8bd661037e97d11e2702c1886
MD5 81a633630d8bc9716b6b44533dfee692
SHA1 6ad7c1f2646b71f147ccde5f206cf2dd263c2178
SHA512 40a3e51c2f1322578534e7522b8310cd770eaa6ce5595e71cfd7579045ad673c4a89c40c65af7fed8d72105d5e49035898d41c752179d821a4747a51cb191b6e
MD5 SHA1 SHA512

Submit Download

shervans.dll

Path C:\Windows\SysWOW64\shervans.dll
Size 8KB
SHA256 6bed675da75dadd64877a9295ae6d4e1ec68c4fbe7805450561e7facf7474870
MD5 39cea051e1c6800ab784f65a6ce16d16
SHA1 abe22b6e23b5bfa9d237f2bf0a8aae4f35db3262
SHA512 6e66dc8f5291c1f2704528bf41a39e83d0dc1f2b9340391bb4d35b5e755a56fb5eeac02328fee80c706293736397a05db0a4a745147fa976f8484ed1a0671d16
SSDEEP 192:ish4SFyvWohE5xf6YUBSL63SUJqtMblWN:VO+ohE2B13NJqtM
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3280-28-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/3280-36-0x0000000010000000-0x000000001000D000-memory.dmp

Download

memory/3280-37-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/4580-21-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4580-26-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5032-22-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5032-24-0x0000000010000000-0x000000001000D000-memory.dmp

Download

memory/5032-0-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/5032-12-0x0000000010000000-0x000000001000D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads