Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 03:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
05bb83cb53410af11286d146da1ff140N.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
05bb83cb53410af11286d146da1ff140N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
120 seconds
General
-
Target
05bb83cb53410af11286d146da1ff140N.exe
-
Size
224KB
-
MD5
05bb83cb53410af11286d146da1ff140
-
SHA1
8b912646a5f111f0ce0eed4917f3cfbd06340252
-
SHA256
f30668874aaf68a156d81c54ec00ae65a09624d9c14bf085ab4ecc99846b54f1
-
SHA512
fca6b65b5b9173bd519d6744fd7da39b5494049418d07ce196a58d8b9d3301799bf30254598f96a3873c22b12ef5569f9cb0d7eb91671ebd9271452050bce567
-
SSDEEP
6144:/Is9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCtZy:KKofHfHTXQLzgvnzHPowYbvrjD/L7QPo
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000018bc7-10.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 2368 ctfmen.exe 2744 smnss.exe -
Loads dropped DLL 9 IoCs
pid Process 2628 05bb83cb53410af11286d146da1ff140N.exe 2628 05bb83cb53410af11286d146da1ff140N.exe 2628 05bb83cb53410af11286d146da1ff140N.exe 2368 ctfmen.exe 2368 ctfmen.exe 2744 smnss.exe 2548 WerFault.exe 2548 WerFault.exe 2548 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" 05bb83cb53410af11286d146da1ff140N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 05bb83cb53410af11286d146da1ff140N.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 05bb83cb53410af11286d146da1ff140N.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 05bb83cb53410af11286d146da1ff140N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 smnss.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\grcopy.dll 05bb83cb53410af11286d146da1ff140N.exe File opened for modification C:\Windows\SysWOW64\grcopy.dll 05bb83cb53410af11286d146da1ff140N.exe File opened for modification C:\Windows\SysWOW64\shervans.dll 05bb83cb53410af11286d146da1ff140N.exe File created C:\Windows\SysWOW64\satornas.dll 05bb83cb53410af11286d146da1ff140N.exe File opened for modification C:\Windows\SysWOW64\satornas.dll 05bb83cb53410af11286d146da1ff140N.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File created C:\Windows\SysWOW64\ctfmen.exe 05bb83cb53410af11286d146da1ff140N.exe File opened for modification C:\Windows\SysWOW64\ctfmen.exe 05bb83cb53410af11286d146da1ff140N.exe File created C:\Windows\SysWOW64\shervans.dll 05bb83cb53410af11286d146da1ff140N.exe File created C:\Windows\SysWOW64\smnss.exe 05bb83cb53410af11286d146da1ff140N.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\sl.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnld.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt smnss.exe File opened for modification C:\Program Files\7-Zip\History.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrus.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm smnss.exe File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt smnss.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2548 2744 WerFault.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 05bb83cb53410af11286d146da1ff140N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smnss.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 05bb83cb53410af11286d146da1ff140N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 05bb83cb53410af11286d146da1ff140N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 05bb83cb53410af11286d146da1ff140N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" 05bb83cb53410af11286d146da1ff140N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 05bb83cb53410af11286d146da1ff140N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2744 smnss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2368 2628 05bb83cb53410af11286d146da1ff140N.exe 31 PID 2628 wrote to memory of 2368 2628 05bb83cb53410af11286d146da1ff140N.exe 31 PID 2628 wrote to memory of 2368 2628 05bb83cb53410af11286d146da1ff140N.exe 31 PID 2628 wrote to memory of 2368 2628 05bb83cb53410af11286d146da1ff140N.exe 31 PID 2368 wrote to memory of 2744 2368 ctfmen.exe 32 PID 2368 wrote to memory of 2744 2368 ctfmen.exe 32 PID 2368 wrote to memory of 2744 2368 ctfmen.exe 32 PID 2368 wrote to memory of 2744 2368 ctfmen.exe 32 PID 2744 wrote to memory of 2548 2744 smnss.exe 33 PID 2744 wrote to memory of 2548 2744 smnss.exe 33 PID 2744 wrote to memory of 2548 2744 smnss.exe 33 PID 2744 wrote to memory of 2548 2744 smnss.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\05bb83cb53410af11286d146da1ff140N.exe"C:\Users\Admin\AppData\Local\Temp\05bb83cb53410af11286d146da1ff140N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 8444⤵
- Loads dropped DLL
- Program crash
PID:2548
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD5b7a89a69fc5afcdb54f5534bb299957c
SHA14d6f34b8087c4d61aecb8a07e8c6f0f69f1248e9
SHA25670a1d45701b494171413005be5e4989aff12b0c15be614119c9da7f1fe3e5726
SHA512e5ed0120d05ad9396ffb02e55dc1abb9a4516e281c795cf87cb774c6552b1ef055aff04c99444d75ca4042b4be72f481650e43d9bbdef82643bf83b1268ba44c
-
Filesize
4KB
MD5e29762abd9dc32e3c544d6992f3609ca
SHA1f7bdcc3fbe385ba254bc140b3556b2073d98be0a
SHA2560b72398ed9b11bbd0c10f721ecc111d2d2889ece1eec7a6e9cc8350661cf3441
SHA512be2e88572250117190e2365b42e433c3e5d1d85a5ba3d6bbd8f89c0c6ab26ecdeeecb6b6ae03889a0d8a1cd385552e7566c9321ed3fadb4aa1e030c6a47d2581
-
Filesize
8KB
MD58d44aa8429aebbe405914da587b2217f
SHA12f8b8a80e0db46647282987f58f7e6e73877250b
SHA25610975fe28dfbbc574ae69b0f31c625e3310a3529864b6c4df2bd51ad0bcf2220
SHA5120becc3a75a9464c2c2fc6543f058e856de7cb8a177766cdd0c2af4ff4f56d8658831329845d6b437746863a8d96288b945b9965f0af8aea06bd28aaa405e8188
-
Filesize
224KB
MD520e9590525b4a8c04088bc5a35c53bec
SHA19525a28081d2fb0dcf929359062d41e211b77adc
SHA2566f9d06a5cce9d12be8c12cdd41198e853b15b5dd9aba8587fc7b4c0810cc4a99
SHA51244daf74ca63aea70cc5ed5ea1acacdb0cbed3c7f862307e311f2deeb237df8902fa4cd5179e7ea23426c02014ce52118d898182d54665f241c8ce67cf21f4461