Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 02:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe
-
Size
127KB
-
MD5
e402995b09c2c475a274ee11c8e52f87
-
SHA1
5a8d8fa6628f8fa1356825a79f8b619dce178934
-
SHA256
1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba
-
SHA512
ef480d1cbd84ff43f668b283623930c852820041093431751ed0a001223694cef982bdb256f725a6a821a3384f6550cb35080f745524e9ee3ce895de2ee62f3d
-
SSDEEP
3072:vOjguyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPr:vSs9OKofHfHTXQLzgvnzHPowYbvrjD/2
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000c00000001470b-10.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 2588 ctfmen.exe 2548 smnss.exe -
Loads dropped DLL 9 IoCs
pid Process 2292 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe 2292 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe 2292 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe 2588 ctfmen.exe 2588 ctfmen.exe 2548 smnss.exe 2160 WerFault.exe 2160 WerFault.exe 2160 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 smnss.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\satornas.dll 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe File created C:\Windows\SysWOW64\ctfmen.exe 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe File opened for modification C:\Windows\SysWOW64\ctfmen.exe 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe File created C:\Windows\SysWOW64\grcopy.dll 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe File opened for modification C:\Windows\SysWOW64\grcopy.dll 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe File created C:\Windows\SysWOW64\shervans.dll 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe File opened for modification C:\Windows\SysWOW64\shervans.dll 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe File created C:\Windows\SysWOW64\smnss.exe 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe File created C:\Windows\SysWOW64\satornas.dll 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\nl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\README.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt smnss.exe File opened for modification C:\Program Files\7-Zip\readme.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt smnss.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2160 2548 WerFault.exe 29 -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2548 smnss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2588 2292 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe 28 PID 2292 wrote to memory of 2588 2292 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe 28 PID 2292 wrote to memory of 2588 2292 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe 28 PID 2292 wrote to memory of 2588 2292 1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe 28 PID 2588 wrote to memory of 2548 2588 ctfmen.exe 29 PID 2588 wrote to memory of 2548 2588 ctfmen.exe 29 PID 2588 wrote to memory of 2548 2588 ctfmen.exe 29 PID 2588 wrote to memory of 2548 2588 ctfmen.exe 29 PID 2548 wrote to memory of 2160 2548 smnss.exe 30 PID 2548 wrote to memory of 2160 2548 smnss.exe 30 PID 2548 wrote to memory of 2160 2548 smnss.exe 30 PID 2548 wrote to memory of 2160 2548 smnss.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe"C:\Users\Admin\AppData\Local\Temp\1e9b54990ba261cfb72a10be3edcdb7f44e4edb4c323ade91357d813f99d1aba.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 8364⤵
- Loads dropped DLL
- Program crash
PID:2160
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD506e65e69dc4c8990ab0620ff0729bb15
SHA1855dac320285a8c9d4a0b7b5c92cfb1503b6af99
SHA256d23eef2c49cf683d44f99c12bf45549b7366fbeebe1dff6348548c9dbd0ecc0c
SHA512caa64e603c45e9b2a446f8acd709c9c083c672a4a1bf93e099f3765ed023f4de42ddae8c8b4b9b73c879b921e11e18ba28d262df8ad3b23887d3a94c1fd08e23
-
Filesize
127KB
MD5adace7168f6a1c00735b93c70413e8e2
SHA1082da9c12090e0023ec0dddc7e832b8e29dfc868
SHA25698a3496512419f65e7440e25582cf1ffdf6c463566edb184d719230c6220abe3
SHA512c6628b079164cbb5d33cb0a3cb027135d488ccb559fd8bd5322ba04eb4e56e6dd42fb260b81793cde9cd0ceaf7c39c5c1aab4a5a45a5c55be49a496f7e23901a
-
Filesize
4KB
MD575b18876396c4f990d207a9ecb9a1af2
SHA145aa6d836138efe88c631818d044321cdf91efbc
SHA2561b907cd1c7a7f584b7bcd93d12ab5cc44dce474b97787d59c1fbf6055576f9ed
SHA51245e91d545dea0fa3c3671bc9068839f88cbb413028192bc1943a61f50db51262ccc7da7f2d2f2fa8a8d5465f290c38444ba4ab5cd1a99039cf183367f07402b3
-
Filesize
8KB
MD530ce74e02d9cd9f9b1cec817cd9de603
SHA1d8978067bb9e71ab334338d620d9f0a364e6358c
SHA256c373945f1d74a5f361b2c9145f02b4a2cf7430502d490d102b557528f0b73bb5
SHA5124a75a0ad4099505acd1af33e6bfcc170692a85d8fb78898a700a33ad63568ce20f8c7710e8dddb6ca2d9a9469957e4da9a7b684794f79f2ae3d4a0c72bdf0c0f