Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c658cf720eb3d7cde0ba1d5e631f510N.exe
Resource
win7-20240705-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
1c658cf720eb3d7cde0ba1d5e631f510N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
11 signatures
120 seconds
General
-
Target
1c658cf720eb3d7cde0ba1d5e631f510N.exe
-
Size
75KB
-
MD5
1c658cf720eb3d7cde0ba1d5e631f510
-
SHA1
dc5ac3d4f6d76d9c2fd1302363ff7c91780c9e4f
-
SHA256
fdcbe2bcb080aab88ab953a637f13ee45489ddb9cf8d4858fc3116bd6722ba51
-
SHA512
e7cb4a3cd30266b9948ce95f8664917dcc4ef4c2e6c2345d93e5445053bfc3a9ee7d685dd3c38a8a4647f9fead522c725f5e81b5ff72c625e98bf53c1c7b9666
-
SSDEEP
1536:Ax1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3v:oOjWuyt0ZsqsXOKofHfHTXQLzgvnzHP3
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000016d02-9.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 2636 ctfmen.exe 2796 smnss.exe -
Loads dropped DLL 9 IoCs
pid Process 3032 1c658cf720eb3d7cde0ba1d5e631f510N.exe 3032 1c658cf720eb3d7cde0ba1d5e631f510N.exe 3032 1c658cf720eb3d7cde0ba1d5e631f510N.exe 2636 ctfmen.exe 2636 ctfmen.exe 2796 smnss.exe 1100 WerFault.exe 1100 WerFault.exe 1100 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" 1c658cf720eb3d7cde0ba1d5e631f510N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 smnss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 1c658cf720eb3d7cde0ba1d5e631f510N.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 1c658cf720eb3d7cde0ba1d5e631f510N.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 1c658cf720eb3d7cde0ba1d5e631f510N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 smnss.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\ctfmen.exe 1c658cf720eb3d7cde0ba1d5e631f510N.exe File opened for modification C:\Windows\SysWOW64\ctfmen.exe 1c658cf720eb3d7cde0ba1d5e631f510N.exe File opened for modification C:\Windows\SysWOW64\shervans.dll 1c658cf720eb3d7cde0ba1d5e631f510N.exe File created C:\Windows\SysWOW64\smnss.exe 1c658cf720eb3d7cde0ba1d5e631f510N.exe File created C:\Windows\SysWOW64\satornas.dll 1c658cf720eb3d7cde0ba1d5e631f510N.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File created C:\Windows\SysWOW64\shervans.dll 1c658cf720eb3d7cde0ba1d5e631f510N.exe File created C:\Windows\SysWOW64\grcopy.dll 1c658cf720eb3d7cde0ba1d5e631f510N.exe File opened for modification C:\Windows\SysWOW64\grcopy.dll 1c658cf720eb3d7cde0ba1d5e631f510N.exe File opened for modification C:\Windows\SysWOW64\satornas.dll 1c658cf720eb3d7cde0ba1d5e631f510N.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ja.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml smnss.exe File opened for modification C:\Program Files\7-Zip\History.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uz.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\README.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt smnss.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1100 2796 WerFault.exe 31 -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 1c658cf720eb3d7cde0ba1d5e631f510N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 1c658cf720eb3d7cde0ba1d5e631f510N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" 1c658cf720eb3d7cde0ba1d5e631f510N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 1c658cf720eb3d7cde0ba1d5e631f510N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 1c658cf720eb3d7cde0ba1d5e631f510N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2796 smnss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2636 3032 1c658cf720eb3d7cde0ba1d5e631f510N.exe 30 PID 3032 wrote to memory of 2636 3032 1c658cf720eb3d7cde0ba1d5e631f510N.exe 30 PID 3032 wrote to memory of 2636 3032 1c658cf720eb3d7cde0ba1d5e631f510N.exe 30 PID 3032 wrote to memory of 2636 3032 1c658cf720eb3d7cde0ba1d5e631f510N.exe 30 PID 2636 wrote to memory of 2796 2636 ctfmen.exe 31 PID 2636 wrote to memory of 2796 2636 ctfmen.exe 31 PID 2636 wrote to memory of 2796 2636 ctfmen.exe 31 PID 2636 wrote to memory of 2796 2636 ctfmen.exe 31 PID 2796 wrote to memory of 1100 2796 smnss.exe 32 PID 2796 wrote to memory of 1100 2796 smnss.exe 32 PID 2796 wrote to memory of 1100 2796 smnss.exe 32 PID 2796 wrote to memory of 1100 2796 smnss.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c658cf720eb3d7cde0ba1d5e631f510N.exe"C:\Users\Admin\AppData\Local\Temp\1c658cf720eb3d7cde0ba1d5e631f510N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 8284⤵
- Loads dropped DLL
- Program crash
PID:1100
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD50b32ec0aeca45c0321bc6abef7e9532a
SHA19836a512b0ecee5538ea0460f662b9dc0e5e70b8
SHA256957e5d8d457ffff13e075f1f54f05744fcf5d90588028e37f5ca6944ff9c1638
SHA512d44d1b969ec1417f8b6ca768eae4fa6659a1e2b07fcb206a3e7997522430b2df5a9da965b96975561d76352f495d2e7fc53ead618ce072a3a377c3aeddd8c000
-
Filesize
75KB
MD5a2d448c1faa36fae890b1f95c57df1cd
SHA1ac46bf4f5b9f2d20cd757bff21d9c2b83a580dc4
SHA256a01011b58958b4f4f640bf081bbe21ce8691ac2f1913be396d7fcd81514ba355
SHA512752edcd9b52fa05f26ea8602b963eff92fa9f9683e458781ebcdf9391a3559687da0562474c1a672cde504d023bbfb330eed0ccfac42e206aefe5029393e86c5
-
Filesize
4KB
MD58df7ade1cdfc85b8e971caebbad7bdfa
SHA110994bc42293f7b6873a15e3d9240795a0d03f03
SHA25687e50d6cdad7723049ed5e3ba729cc1b5cf7a34084ce701b4eebca438bade936
SHA512fa596855a4456b53ce4ceca360a651fb2f82738196e4d98e578dc76ca9488e4f16b2de2e08d95d9ae5737aadf1bf041a338c2f965322f2512c96c5cae1960b08
-
Filesize
8KB
MD5614060d1694caa7e10c8f4a3c746912d
SHA12ba2b75c8f6846f150df4b588c18b069e2dc8ced
SHA256752e11ec0c033db0cf3bc1928c84cfd60a2a5e73c81fce4359adf2c9138d818a
SHA512c103573b43a753b9ab5ac1b115f80c9e14510d5fca7eec85e54a825f0340805f0dd7112349fc3d49ad654d8f879a8b124b87cd54648586dbf41e1491f35cb9e4