Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 23:48
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe
-
Size
70KB
-
MD5
514f151fef2051a1e0f97dd98e9a9f88
-
SHA1
39849c53fbfb58dc31a6e15c76360ba6616a74aa
-
SHA256
86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36
-
SHA512
942e919d1c8f0090f2549a39a3896180ca95828bbc80812d36b42b8d703188f70da2d6c239599db7d03e0b6bd3c39c70514471225edef59f300826133e3d6077
-
SSDEEP
1536:Gq5VwWDjDkdTRqHFOn8tIbbeYiuZIFS9b1YTjipvF2a:Gq5ud9qHFO8Kf3rIIb1YvQd2a
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 11 IoCs
resource yara_rule behavioral2/memory/1212-0-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/files/0x0009000000023413-10.dat UPX behavioral2/files/0x0007000000023418-15.dat UPX behavioral2/memory/1212-18-0x0000000010000000-0x000000001000D000-memory.dmp UPX behavioral2/files/0x00070000000232a4-20.dat UPX behavioral2/memory/412-26-0x0000000000400000-0x0000000000409000-memory.dmp UPX behavioral2/memory/1212-25-0x0000000010000000-0x000000001000D000-memory.dmp UPX behavioral2/memory/1212-23-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3304-31-0x0000000000400000-0x000000000041F000-memory.dmp UPX behavioral2/memory/3304-38-0x0000000010000000-0x000000001000D000-memory.dmp UPX behavioral2/memory/3304-39-0x0000000000400000-0x000000000041F000-memory.dmp UPX -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0009000000023413-10.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 412 ctfmen.exe 3304 smnss.exe -
Loads dropped DLL 2 IoCs
pid Process 1212 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe 3304 smnss.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 smnss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 smnss.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\grcopy.dll 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe File opened for modification C:\Windows\SysWOW64\shervans.dll 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe File created C:\Windows\SysWOW64\smnss.exe 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe File created C:\Windows\SysWOW64\ctfmen.exe 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe File created C:\Windows\SysWOW64\shervans.dll 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe File opened for modification C:\Windows\SysWOW64\grcopy.dll 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe File created C:\Windows\SysWOW64\satornas.dll 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe File opened for modification C:\Windows\SysWOW64\satornas.dll 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe File opened for modification C:\Windows\SysWOW64\ctfmen.exe 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ky.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsrom.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsesp.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Content.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt smnss.exe File opened for modification C:\Program Files\7-Zip\License.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt smnss.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 900 3304 WerFault.exe 86 -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3304 smnss.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1212 wrote to memory of 412 1212 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe 85 PID 1212 wrote to memory of 412 1212 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe 85 PID 1212 wrote to memory of 412 1212 86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe 85 PID 412 wrote to memory of 3304 412 ctfmen.exe 86 PID 412 wrote to memory of 3304 412 ctfmen.exe 86 PID 412 wrote to memory of 3304 412 ctfmen.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe"C:\Users\Admin\AppData\Local\Temp\86fa6bd07087f16774328a8944a0eb7771d3868816bbe1503d6d1d9daa71fa36.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3304 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 15124⤵
- Program crash
PID:900
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3304 -ip 33041⤵PID:3296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f389c20e9fee6595245f3b7b0481c3a1
SHA16a4fde92acb8e615a5d0563a1991e30387153ce8
SHA256df0d29618bd35ff8e1f75a00f528550934bed8d422af89a7951178f498621975
SHA5124d133c217c9f4c750bfd0c6ef1c3f65af7d8f15f1a57df23ede63275a89cf6e315930abcbf578e080ce222b37b3527ff2987d6cdf7ed6f932e86789e63383126
-
Filesize
70KB
MD583ffd6df5b4e8c77be9df9de86577edd
SHA1c315e0363560de373447defff43b56e027f77c5f
SHA2569666f77e1885e297b77fd9d52459565435df4b0f33522246fa5a19ce9d3689d8
SHA5120a562b0e6ed9b719b4355cb825c0e025c8f016195bc1321894d3618ee10a77cbe4f761d02d21f25e427547924b65f1e64a26cd97db999b98d3c478dce5aa5c60
-
Filesize
183B
MD550f1283e65b8b7114c1e19733354c61e
SHA1c06d9d26791077b9ecc2c8d172af7a5ceeacfcb4
SHA2569c2280dcf9945d0e476189e4810c08a9da7d7b870c05f4a2cc4bc6468aba3d7b
SHA512e5447d177442b3d05bb66e6ceda25eb1501d4a9837ca746f5afb554ef073e118ab9ca6e2898f8ee9db45a13fb62b0b139119bceecef1ed71186eaebe12fb3a57
-
Filesize
8KB
MD50891a707f1d5cd38b22ea7dd8f89121e
SHA16ded567ac915cacd530b67bda78833fb5fbb2fca
SHA2561a2da98dcc939d67864780a18141fceead1247592b847c662ca9c899e2beaa08
SHA512d9eee9b647bd0a639099ddb6e8a76f3316816874786cb42b963e9d196ced0bb39d64f20697127a63e15d13327a47d519956f0e27970ac32649f52d0ca2810908