e6398b0d823005edfd169c1cbe21ba5bf67978205a81e5aa510421e89a00672f

Analysis

max time kernel
115s
max time network
21s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae27d89c768aa120e8d07ad842e8ebc0N.exe
Size

226KB
MD5

ae27d89c768aa120e8d07ad842e8ebc0
SHA1

25b106ef9600d6d0449c4e1ef74596fc17bd5070
SHA256

e6398b0d823005edfd169c1cbe21ba5bf67978205a81e5aa510421e89a00672f
SHA512

877586df14d936e3ceff656084ced1d051da8fbd74229a65e5a1daca6cfc12d99c8f5675fbf67815a3eac8c4660ec03b71e84f4cac89176b57b3acb76c67c398
SSDEEP

6144:6Is9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCtZ0:3KofHfHTXQLzgvnzHPowYbvrjD/L7QPS

Score

7^/10

discovery persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000015fcc-10.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
1444	ctfmen.exe
2684	smnss.exe

Loads dropped DLL 9 IoCs

pid	Process
1712	ae27d89c768aa120e8d07ad842e8ebc0N.exe
1712	ae27d89c768aa120e8d07ad842e8ebc0N.exe
1712	ae27d89c768aa120e8d07ad842e8ebc0N.exe
1444	ctfmen.exe
1444	ctfmen.exe
2684	smnss.exe
2604	WerFault.exe
2604	WerFault.exe
2604	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	ae27d89c768aa120e8d07ad842e8ebc0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	ae27d89c768aa120e8d07ad842e8ebc0N.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	ae27d89c768aa120e8d07ad842e8ebc0N.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	ae27d89c768aa120e8d07ad842e8ebc0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	ae27d89c768aa120e8d07ad842e8ebc0N.exe
File created	C:\Windows\SysWOW64\grcopy.dll	ae27d89c768aa120e8d07ad842e8ebc0N.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	ae27d89c768aa120e8d07ad842e8ebc0N.exe
File created	C:\Windows\SysWOW64\smnss.exe	ae27d89c768aa120e8d07ad842e8ebc0N.exe
File created	C:\Windows\SysWOW64\satornas.dll	ae27d89c768aa120e8d07ad842e8ebc0N.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	ae27d89c768aa120e8d07ad842e8ebc0N.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	ae27d89c768aa120e8d07ad842e8ebc0N.exe
File created	C:\Windows\SysWOW64\shervans.dll	ae27d89c768aa120e8d07ad842e8ebc0N.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	ae27d89c768aa120e8d07ad842e8ebc0N.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-snaptracer.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-swing-plaf.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\feature.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-heapwalker.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\artifacts.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-common.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-sampler.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-awt.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\license.html	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-api.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-api.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-filesystems.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-multiview.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-attach.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-execution.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-lib-uihandler.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-threaddump.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-spi-actions.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-heapdump.xml	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	2684	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ae27d89c768aa120e8d07ad842e8ebc0N.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	ae27d89c768aa120e8d07ad842e8ebc0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	ae27d89c768aa120e8d07ad842e8ebc0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	ae27d89c768aa120e8d07ad842e8ebc0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	ae27d89c768aa120e8d07ad842e8ebc0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	ae27d89c768aa120e8d07ad842e8ebc0N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	smnss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1444	1712	ae27d89c768aa120e8d07ad842e8ebc0N.exe	30
PID 1712 wrote to memory of 1444	1712	ae27d89c768aa120e8d07ad842e8ebc0N.exe	30
PID 1712 wrote to memory of 1444	1712	ae27d89c768aa120e8d07ad842e8ebc0N.exe	30
PID 1712 wrote to memory of 1444	1712	ae27d89c768aa120e8d07ad842e8ebc0N.exe	30
PID 1444 wrote to memory of 2684	1444	ctfmen.exe	31
PID 1444 wrote to memory of 2684	1444	ctfmen.exe	31
PID 1444 wrote to memory of 2684	1444	ctfmen.exe	31
PID 1444 wrote to memory of 2684	1444	ctfmen.exe	31
PID 2684 wrote to memory of 2604	2684	smnss.exe	33
PID 2684 wrote to memory of 2604	2684	smnss.exe	33
PID 2684 wrote to memory of 2604	2684	smnss.exe	33
PID 2684 wrote to memory of 2604	2684	smnss.exe	33

C:\Users\Admin\AppData\Local\Temp\ae27d89c768aa120e8d07ad842e8ebc0N.exe
"C:\Users\Admin\AppData\Local\Temp\ae27d89c768aa120e8d07ad842e8ebc0N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 852
      4⤵
      Loads dropped DLL
      Program crash
      PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
dd6c130f5e03e8a078d5fe19be0e72d8

SHA1
977aae1de15b3d9511230dc73f8506957f713780

SHA256
fa80e795072c524f0d981c01cf45e4fcf818dd9c3be5b8a5f890f04d0ca0e46a

SHA512
b0de3ac94cf8f609bf187f545b693872ab0558c1f7933b928b637c9f46771c6368074fec1bf7658fe766890e50b6ccda5dc9ba72639486242ed8e53215d2e3d9

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
31ef69b9f5f47269df089b67d69b754c

SHA1
31f7cd1d0f717d41578b2c1f0e752a3d68a5da86

SHA256
ee26b377134a3d72b7b600d97bd1ac4718932d2ff7171af720de60a8629e9129

SHA512
4d33abfeb829e3ba8c911d96c0a950499076595f15fbd272fc25a2470f16f07e9a9abb72d161a23865fac2cbebbb57120116b9d0e848c7cc4c8daf06efbeb849

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
e29043d5cf840c3c5c6aa1f8988eca34

SHA1
a4361d48a728cdaed2bcdcc3d231e57f8dde14e3

SHA256
e1d55be5f1878cd7f632686c5148729171623233e745c49defe990ee1475896a

SHA512
34654d7a2a9fd65b9ee81259426a7def3826e2f513752beb561fb7b06aad160845eb9f24cf38da4056cdd0e2af403b0d982bc20f771ca78dfd3631cc9dac3001

Download Submit
\Windows\SysWOW64\smnss.exe

Filesize
226KB

MD5
ae7fefb71bd5620758fa9a45363f2136

SHA1
448a883e7a397c126c9631679163b1bc3691f41d

SHA256
b49e69046023e335cbaa6dce53c72d5472e5d6768c4c818d136acc684bed56c1

SHA512
3b3ab699de869d5fb4c878ed7eb3629a07220f606ebd19050d8f6992c167409cd539e4fe42848ecf659e62b29a6ba11aa8c88727a6b27ae6631a450aee207c4c

Download Submit
memory/1444-33-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1444-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1444-29-0x0000000000350000-0x0000000000382000-memory.dmp

Filesize
200KB

Download
memory/1712-26-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1712-25-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1712-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1712-12-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2684-39-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2684-41-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2684-42-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads