54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9

General

Target

54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
Size

2.3MB
MD5

1f7b6a1f43c7c4299faf24c7480a4eb5
SHA1

ccb6d620dfcf58bae0b80a576bf8430dacb511fe
SHA256

54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9
SHA512

eb70e1dd83b8633873370f4175ef33ca1deee8fa618184b67b18227c666a06f8e75b0ceb67fc91676b2829a5fdf71c7d005ff01dd0877c9a343dd9494b753010
SSDEEP

49152:98F4GBYEFMfVrt0HdZyZUKIKp9/bIA3e63wDknToN58zkfwHuVfcu5ZJFKsnfKUn:98F4GBY3dR0HHyZ9p9DIAvADkQ8gfwOj

Score

7^/10

discovery persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002344a-11.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
1160	ctfmen.exe
4620	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
4828	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
4620	smnss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shervans.dll	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
File created	C:\Windows\SysWOW64\smnss.exe	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
File created	C:\Windows\SysWOW64\satornas.dll	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\grcopy.dll	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4828	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
4620	smnss.exe
4620	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4840	4620	WerFault.exe	92

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmen.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	smnss.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4828	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
4620	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 1160	4828	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe	91
PID 4828 wrote to memory of 1160	4828	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe	91
PID 4828 wrote to memory of 1160	4828	54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe	91
PID 1160 wrote to memory of 4620	1160	ctfmen.exe	92
PID 1160 wrote to memory of 4620	1160	ctfmen.exe	92
PID 1160 wrote to memory of 4620	1160	ctfmen.exe	92

C:\Users\Admin\AppData\Local\Temp\54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe
"C:\Users\Admin\AppData\Local\Temp\54437f6764d016db6908faefaee56f7eb2f7bafeb2cb6de34474ea580d9957e9.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4620
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4620 -s 1492
      4⤵
      Program crash
      PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4620 -ip 4620
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
fc9f692b33555816273f539093c3063d

SHA1
7b35a31b6715ab48380b62fc84856a8aa6abdeb1

SHA256
1f13c99f7cd5cc4e26ae4bf6ea061a1a15b95eebcaf63f58d80e8928f48b8efd

SHA512
9ed21bfd5910074d99437863cbec17308747805b063d8a3c853b6f378908e7ca1ffe2411c438c6f21792c88788df9e78024cfbc42c5455917c346be153537f28

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
2.3MB

MD5
d91cd985c04c303fd46669cdc47795e3

SHA1
004d48c82a1d60bbee627b7460bc7ee82943bc51

SHA256
f5389f329487556e4965eb97becc8960539daa0ea1ebacd81544e6ce438585ae

SHA512
14a8235e00088d254433193ea02fc11850e216d19dad0b1f704c8df69ff7f34c4e812f92285b64c5c033f5d53c26601890a93fc3614c09571ffaca951dca2f72

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
baf17cf2951693dc3666befc23b6bdfe

SHA1
d86838d8bef559d794a164e286a7ba222d3dcb8b

SHA256
21902165eeb998b6b981bab93d8d111ecd9eb8278ca94c1386eccb7ea2544508

SHA512
8e8b3051a1b449c8e0e165838e208cd85eeed1942c82fcc4041d7f61bbec051e5e2230ef8d5e4cb369c34e3701d6e9ed1737ce29084ddcfabf8c329a207fe56b

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
735added0b4ad50982182cc2b8dd6960

SHA1
5e7c3b4a646f5d316282645c00d279257b80f69f

SHA256
86ffc38962659673bd70da0e95c2ebe0eb435b3cd407bccf87bef59dfb0b35c5

SHA512
d07bb2c7fed7a97f5780caaf7ab06f83d0f86ad3a9161c464ecc0858aac5631e596dc376287b342a7b714010b35616d7e4ecb5be74eb40da5fa7064c3f6e0408

Download Submit
memory/1160-30-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1160-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4620-40-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4620-44-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/4620-43-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4620-33-0x0000000000400000-0x0000000000DC2000-memory.dmp

Filesize
9.8MB

Download
memory/4620-34-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/4620-42-0x0000000000400000-0x0000000000DC2000-memory.dmp

Filesize
9.8MB

Download
memory/4828-32-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/4828-27-0x0000000000400000-0x0000000000DC2000-memory.dmp

Filesize
9.8MB

Download
memory/4828-1-0x000000007FA70000-0x000000007FE41000-memory.dmp

Filesize
3.8MB

Download
memory/4828-14-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/4828-0-0x0000000000400000-0x0000000000DC2000-memory.dmp

Filesize
9.8MB

Download
memory/4828-25-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads