Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 00:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe
-
Size
239KB
-
MD5
51a957fddf3d3e7ef0fc922c73e34812
-
SHA1
85bbeccbfb6c427d04fa18d963bfaac399ac65ec
-
SHA256
853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f
-
SHA512
4ce17916d3f2c0542fa6be76934a68bb1829e14353bd3c8b6a2b1fe4b96631d098524a1e3e619ae54a558f3096c808f5fdef9ab9b6c12de0edc1d13023ecf827
-
SSDEEP
1536:Qq5VwWDjDkdTRqHFOn8tIbbeYiuZIFS9bc:Qq5ud9qHFO8Kf3rIIbc
Score
9/10
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 24 IoCs
resource yara_rule behavioral2/memory/3588-0-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/files/0x000800000002324f-10.dat UPX behavioral2/memory/3588-12-0x0000000010000000-0x000000001000D000-memory.dmp UPX behavioral2/files/0x0007000000023252-15.dat UPX behavioral2/files/0x000900000002324b-20.dat UPX behavioral2/memory/3120-21-0x0000000000400000-0x0000000000409000-memory.dmp UPX behavioral2/memory/3588-23-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3588-25-0x0000000010000000-0x000000001000D000-memory.dmp UPX behavioral2/memory/3120-29-0x0000000000400000-0x0000000000409000-memory.dmp UPX behavioral2/memory/3972-31-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-38-0x0000000010000000-0x000000001000D000-memory.dmp UPX behavioral2/memory/3972-39-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-41-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-43-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-45-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-47-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-49-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-51-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-53-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-55-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-57-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-59-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-61-0x0000000000400000-0x0000000000420000-memory.dmp UPX behavioral2/memory/3972-63-0x0000000000400000-0x0000000000420000-memory.dmp UPX -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000800000002324f-10.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 3120 ctfmen.exe 3972 smnss.exe -
Loads dropped DLL 2 IoCs
pid Process 3588 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe 3972 smnss.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 smnss.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ctfmen.exe 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe File opened for modification C:\Windows\SysWOW64\grcopy.dll 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe File opened for modification C:\Windows\SysWOW64\shervans.dll 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe File created C:\Windows\SysWOW64\satornas.dll 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe File created C:\Windows\SysWOW64\ctfmen.exe 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe File created C:\Windows\SysWOW64\shervans.dll 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe File created C:\Windows\SysWOW64\grcopy.dll 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe File created C:\Windows\SysWOW64\smnss.exe 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe File opened for modification C:\Windows\SysWOW64\satornas.dll 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL108.XML smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinAddCustomTags.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL103.XML smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\id-ID\View3d\3DViewerProductDescription-universal.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\km-KH\View3d\3DViewerProductDescription-universal.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.onenotemui.msi.16.en-us.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientOSub2019_eula.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL089.XML smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsrus.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Cambria.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Constantia-Franklin Gothic Book.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL022.XML smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lt-LT\View3d\3DViewerProductDescription-universal.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Speech\en-US\tokens_enUS.xml smnss.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\Client.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\ExcelMessageDismissal.txt smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\nl-NL\View3d\3DViewerProductDescription-universal.xml smnss.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OsfInstallerConfig.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ProjectedApi.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Green.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kn-IN\View3d\3DViewerProductDescription-universal.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\View3d\3DViewerProductDescription-universal.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml smnss.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\added.txt smnss.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\pt-PT\View3d\3DViewerProductDescription-universal.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\AppxManifest.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsel.xml smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN001.XML smnss.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml smnss.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\servicing\Editions\ProfessionalEducationEdition.xml smnss.exe File opened for modification C:\Windows\diagnostics\index\NetworkDiagnostics_2_FileShare.xml smnss.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1257.TXT smnss.exe File opened for modification C:\Windows\PLA\Rules\en-US\Rules.System.NetDiagFramework.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\en-US\Rules.System.Summary.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\fr-FR\Rules.System.Disk.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Performance.xml smnss.exe File opened for modification C:\Windows\Panther\unattend.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.NetDiagFramework.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Network.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Common.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\ja-JP\Report.System.Disk.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Finale.xml smnss.exe File opened for modification C:\Windows\PrintDialog\appxmanifest.xml smnss.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.ConfigCI.Commands\v4.0_10.0.0.0__31bf3856ad364e35\AllowMicrosoft.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\es-ES\Report.System.Wireless.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\ja-JP\Report.System.CPU.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\es-ES\Rules.System.Wireless.xml smnss.exe File opened for modification C:\Windows\PLA\Templates\WDAC_Diagnostics.xml smnss.exe File opened for modification C:\Windows\servicing\Editions\IoTEnterpriseEdition.xml smnss.exe File opened for modification C:\Windows\diagnostics\index\AudioPlaybackDiagnostic.xml smnss.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\it-IT\Report.System.Diagnostics.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Configuration.xml smnss.exe File opened for modification C:\Windows\Professional.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\es-ES\Report.System.Disk.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\ja-JP\Report.System.Network.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Wired.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\uk-UA\Report.System.Wireless.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\en-US\Report.System.Disk.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\es-ES\Report.System.CPU.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\ja-JP\Report.System.Configuration.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.NetTrace.xml smnss.exe File opened for modification C:\Windows\servicing\Editions\EducationEdition.xml smnss.exe File opened for modification C:\Windows\diagnostics\index\SearchDiagnostic.xml smnss.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\de-DE\Rules.System.Common.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\it-IT\Rules.System.Finale.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\fr-FR\Rules.System.Wired.xml smnss.exe File opened for modification C:\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Audit.xml smnss.exe File opened for modification C:\Windows\diagnostics\index\NetworkDiagnostics_1_Web.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\en-US\Report.System.Wired.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\es-ES\Report.System.Common.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\en-US\Rules.System.Diagnostics.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\it-IT\Report.System.CPU.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\ja-JP\Report.System.Wired.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\ja-JP\Rules.System.Network.xml smnss.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CP1258.TXT smnss.exe File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.Network.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.Summary.xml smnss.exe File opened for modification C:\Windows\ImmersiveControlPanel\Settings\AllSystemSettings_{253E530E-387D-4BC2-959D-E6F86122E5F2}.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\en-US\Report.System.Performance.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\fr-FR\Report.System.Memory.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\es-ES\Report.System.Summary.xml smnss.exe File opened for modification C:\Windows\PLA\Rules\de-DE\Rules.System.Finale.xml smnss.exe File opened for modification C:\Windows\diagnostics\index\DeviceCenterDiagnostic.xml smnss.exe File opened for modification C:\Windows\Globalization\Time Zone\timezoneMapping.xml smnss.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\UKRAINE.TXT smnss.exe File opened for modification C:\Windows\Panther\diagwrn.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\de-DE\Report.System.Configuration.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\en-US\Report.System.Wireless.xml smnss.exe File opened for modification C:\Windows\PrintDialog\appxblockmap.xml smnss.exe File opened for modification C:\Windows\servicing\Editions\ServerRdshEdition.xml smnss.exe File opened for modification C:\Windows\PLA\Reports\Report.System.Wireless.xml smnss.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3972 smnss.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3588 wrote to memory of 3120 3588 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe 92 PID 3588 wrote to memory of 3120 3588 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe 92 PID 3588 wrote to memory of 3120 3588 853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe 92 PID 3120 wrote to memory of 3972 3120 ctfmen.exe 93 PID 3120 wrote to memory of 3972 3120 ctfmen.exe 93 PID 3120 wrote to memory of 3972 3120 ctfmen.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe"C:\Users\Admin\AppData\Local\Temp\853b131e4801307a5824011c1481f0bc43dcb8769f19fded01ee6fc718f0380f.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵PID:4548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD55346ef085f60f657f6c4bf47547621c9
SHA16109961749680b837ad0eec605dc23919d817cbb
SHA256667af570f1a17816979ead3c65a3e82299a755a2a7567023e25eae05f8b8991d
SHA51263a7d0b25908e477033a6366faeb423947dd596c1f1f0f27db160dd3a80e14d272ba53bb8b82561ebaa7ad82c2f651e607fc6c8f51ddaeba860dd7b2a805b460
-
Filesize
183B
MD51eb574091ee5e02b8bce1b2c31b4c7dd
SHA1fcf0a20b52e1fd7221d51221762d5fc9c7bfbe28
SHA2563d6c3bb9f522602ca0074954e265045297809f45bc0708331f649d4eebb6b447
SHA512bab4228f95b683ad955b84fdd842041db6e8dd0c41b677c4d04ec8fe51eeaa986b1224726b0f0beed314748eae358d7a10393dbfdf9a902ed81b66b77228a96e
-
Filesize
8KB
MD589769428bf37ed65b95ed50f752efb84
SHA17863e03e5eb2149efc6e30b9f231d259250073b5
SHA25676ce8263385394d8e02928200654a970323786e5d8671b2fec60a31772257f6f
SHA512ed035eae7f96918759203a1fa8ef297e1b60a0c410c4f218ea4ba9b09b0e3fe324fc894e132cea46c2fa12e169eadda1f04853e50228a828fd873ea7c6352e71
-
Filesize
239KB
MD5bfbddc4e225e3d4cb54bf4b4c5a2cec5
SHA121eb9d55117d2fa189fe341dbda48421a125468d
SHA256bfcbf1a302daebe0e343c02c1127d43e6c9e9928ac5308060f8dc8753bce9886
SHA5120bd85bd2031c2bb0cf8a8c888d3d5af51fed77ac039cd56d235d69aaafc7b9007a5d9fbdf81d8731a0ea7fe48a9fc581adeee7d69c8bbdf34851059d7a6053cb