3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70

Analysis

max time kernel
146s
max time network
127s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
Size

2.4MB
MD5

34e4c0ebfed6615737ccd161ffe256b9
SHA1

f7fa94b9735c6d53f67b4081aa620f522f0c3cbe
SHA256

3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70
SHA512

21876710043bf725eab3c869e0c1ab3b4015de25722e6320a9f3512b544b33021358eb06eb9fbdcd60b99142ab063749df6d5f2070d6787c53e27efebc20b82d
SSDEEP

49152:PR/laMbYAp7s5nceEv7MuGOe4jPyTmE7ZIIKR01GSM8prnoo:PRNvpAceMjGL4jaCE7ZGCxh

Score

7^/10

discovery persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00080000000162ed-11.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
2744	ctfmen.exe
2860	smnss.exe

Loads dropped DLL 9 IoCs

pid	Process
3060	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
3060	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
3060	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
2744	ctfmen.exe
2744	ctfmen.exe
2860	smnss.exe
2568	WerFault.exe
2568	WerFault.exe
2568	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
File created	C:\Windows\SysWOW64\satornas.dll	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
File created	C:\Windows\SysWOW64\shervans.dll	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
File created	C:\Windows\SysWOW64\grcopy.dll	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
File created	C:\Windows\SysWOW64\smnss.exe	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3060	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
2860	smnss.exe
2860	smnss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\symbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2568	2860	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smnss.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	smnss.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3060	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
2860	smnss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2744	3060	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe	30
PID 3060 wrote to memory of 2744	3060	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe	30
PID 3060 wrote to memory of 2744	3060	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe	30
PID 3060 wrote to memory of 2744	3060	3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe	30
PID 2744 wrote to memory of 2860	2744	ctfmen.exe	31
PID 2744 wrote to memory of 2860	2744	ctfmen.exe	31
PID 2744 wrote to memory of 2860	2744	ctfmen.exe	31
PID 2744 wrote to memory of 2860	2744	ctfmen.exe	31
PID 2860 wrote to memory of 2568	2860	smnss.exe	32
PID 2860 wrote to memory of 2568	2860	smnss.exe	32
PID 2860 wrote to memory of 2568	2860	smnss.exe	32
PID 2860 wrote to memory of 2568	2860	smnss.exe	32

C:\Users\Admin\AppData\Local\Temp\3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe
"C:\Users\Admin\AppData\Local\Temp\3014af1530f835ae748ca0ee65c4f155d02d61a8b2fdc24088b0a1c7320d7a70.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2860 -s 896
      4⤵
      Loads dropped DLL
      Program crash
      PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
dd5efe4a18cd745be20e114cc5c5ceec

SHA1
88dd35648696cc2d2b098a0d518cb9fa55887542

SHA256
3f9f8f744a68d7e002572a4b20c08162f04ecac4ed3f65a1df0ba5645b034674

SHA512
96c32f64dadc45a067cbfcca6cef0b53410a9e1696f935189106ae623c329a7ba5b430e94936e76962db916fc293ff2c6fd465e61f853fc7d9687c09ab2bf768

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
2.4MB

MD5
abc07867b3bf38948d382d986bea3401

SHA1
596e001d8b217d0d411ce132e195ccb2b37cdc48

SHA256
109a6966b54dd59fb980c70fb74bd9c7d02e2c8d7be331709e0eebe004ea50b9

SHA512
78365f634fe4723be4e27dfe72de7c03ba1f781d456a72db015b41903a9e835dcf07a0e377f18eee9929b700acb7842e50825ce1101254344ac4818ecdcea759

Download Submit
\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
0d56740ee0caa17023e78da07ecead47

SHA1
47eecfd552067dd87959b959b2ea62c7f6070dde

SHA256
5fba24e4a336a52669c26d1e39e3dfebd4bf2fb3e4eb1dca2ed09a3f77d09bc2

SHA512
cb309a9491b6271644bb8d2d95c7236ddf78fefd6671da526000bdba20deb6ff3dd676446a288262dc7dac28628e8a73e2e38d4e21bcfc6e5c3a5d582d9ae67e

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
bebb277bd8456d947039bd649a19ad6f

SHA1
19e2ad1fa6c41d544ab2988e34ec006243862500

SHA256
b70044f8861daaaf58e022680e86e58a56381b3ecb282960a7e6248e15fc988c

SHA512
fabbdc27309d87b8c16df9a4514a47be42ea7f3f47b20dc6e0e89fa5751734d774901854f0648d5b1ac35cb818366d9af504990ebe164145ad05a769ff86f713

Download Submit
memory/2744-37-0x0000000000510000-0x0000000000EDC000-memory.dmp

Filesize
9.8MB

Download
memory/2744-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2860-45-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2860-38-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2860-53-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2860-50-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2860-51-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2860-47-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/2860-42-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/3060-28-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/3060-13-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/3060-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/3060-0-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/3060-26-0x00000000003F0000-0x00000000003F9000-memory.dmp

Filesize
36KB

Download
memory/3060-30-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/3060-31-0x0000000000400000-0x0000000000DCC000-memory.dmp

Filesize
9.8MB

Download
memory/3060-29-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads