846318c2ce45b7ebd7310e58a3894301ce7399277d3775159c8954873c3e477e

Analysis

max time kernel
115s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 16:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Size

2.4MB
MD5

3d1ef0a6de9e1dfe7365778fd15653b0
SHA1

88fc82d611679e0b2feca492bdee65b0324c2c7c
SHA256

846318c2ce45b7ebd7310e58a3894301ce7399277d3775159c8954873c3e477e
SHA512

d682f6bdd9b2206f39edeb73cf4fb6c8dcaac26eae12f15695ced8ec1dd24c07960065ca83c0c4f298f70c125b8156fa496b32f2af5130682c93f660a54de9d1
SSDEEP

49152:tR/laMbYAp7s5nceEv7MuGOe4jPyTmE7ZIIKR01GSM8prnoo:tRNvpAceMjGL4jaCE7ZGCxh

Score

7^/10

discovery persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023479-11.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
1612	ctfmen.exe
2888	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
1316	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
2888	smnss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\satornas.dll	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\grcopy.dll	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
File created	C:\Windows\SysWOW64\shervans.dll	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
File created	C:\Windows\SysWOW64\smnss.exe	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	3d1ef0a6de9e1dfe7365778fd15653b0N.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1316	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
1316	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
2888	smnss.exe
2888	smnss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\symbase.xml	smnss.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	smnss.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\insertbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\Alphabet.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4856	2888	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smnss.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2888	smnss.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1316	3d1ef0a6de9e1dfe7365778fd15653b0N.exe
2888	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1612	1316	3d1ef0a6de9e1dfe7365778fd15653b0N.exe	88
PID 1316 wrote to memory of 1612	1316	3d1ef0a6de9e1dfe7365778fd15653b0N.exe	88
PID 1316 wrote to memory of 1612	1316	3d1ef0a6de9e1dfe7365778fd15653b0N.exe	88
PID 1612 wrote to memory of 2888	1612	ctfmen.exe	89
PID 1612 wrote to memory of 2888	1612	ctfmen.exe	89
PID 1612 wrote to memory of 2888	1612	ctfmen.exe	89

C:\Users\Admin\AppData\Local\Temp\3d1ef0a6de9e1dfe7365778fd15653b0N.exe
"C:\Users\Admin\AppData\Local\Temp\3d1ef0a6de9e1dfe7365778fd15653b0N.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 1488
      4⤵
      Program crash
      PID:4856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2888 -ip 2888
1⤵
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
67e6e75f70ce268857cb0c20dc2ed05b

SHA1
8879151f208e3ef7da3f123cf9a7e7e5ab79c490

SHA256
363a418392897084f6df856bff4a0d11582a7a40035b0fb107ea950641d79cc1

SHA512
463f54e84d8fc901c3668d8855a207421febf10fb6edda1e8fa1b3edae23c158d0e5edff7536e0d3dcf6e6febf157ea29a5cf5b491b0e57412baabadd0b32e89

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
2.4MB

MD5
b4584048fd0ec1e84f028c1435775a22

SHA1
8ed494721df92a27651537f43caa10e83a7c08d4

SHA256
2c6e6e547d03c90c6bf022a98344c9bef975e75d94ff39098ab51be326517bd1

SHA512
8ddb7c0e43d93545e7623c0c80a3dcc25dee9148f814779785c46807982badba38d5e84211d67a4f4a9b8e196c41d4a57738d54db91fa8cf570e0999756e2f94

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
c65255835ad62a8e3287b1c9d96765d1

SHA1
81775d51b96b20fd637f29c8f96924370cc4741b

SHA256
a647f20cb8146eca81e5a2899e105b954e3ea3452dcc776a54b4b927c612c090

SHA512
5ff86a27327ebac30200f64fe1cc5a5f0814a1145475baba3a23d30c25a5aa3d7540c684fe1ff2a3042629411a86c7635a6569a25bfdd583a21ff2f444fbd1bf

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
e805231f22df2cb86b28e6921eada9fa

SHA1
f5c0b0656160d7e55dd2bdac566cbdd633fb33bc

SHA256
ab5e789ec62b5b36d2a1828839118ea046502d769237e477d60477ae46451911

SHA512
4c32c09c21bfe849e67c43c50a610768373370668b80a9b3d785f0c901322a559df580ba7638758946f6c6dc8d1e682dd106acb1ddf1a1a6122b73c6707cf911

Download Submit
memory/1316-24-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/1316-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/1316-14-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1316-25-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1316-0-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/1316-31-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/1612-30-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2888-32-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2888-33-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/2888-39-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2888-42-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2888-41-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2888-43-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads