d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216

Analysis

max time kernel
145s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Size

118KB
MD5

8a9011b139bb8172d0dca427c3f458c8
SHA1

21c2f318f3f0154a70a6582dfbf023127c70fb91
SHA256

d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216
SHA512

63ca6b2ec234cb4e1d1f775c338c8843907a8bb9a2986acecc6ed4bc13ed95dd0bba6eaa918a07fe8c873c88a45cf8e10b5ba692e6fba2505da53c32f830ab6f
SSDEEP

3072:1OjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPb:1Is9OKofHfHTXQLzgvnzHPowYbvrjD/m

Score

7^/10

discovery persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000800000001743a-10.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
1628	ctfmen.exe
2216	smnss.exe

Loads dropped DLL 9 IoCs

pid	Process
2204	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
2204	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
2204	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
1628	ctfmen.exe
1628	ctfmen.exe
2216	smnss.exe
1932	WerFault.exe
1932	WerFault.exe
1932	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
File opened for modification	C:\Windows\SysWOW64\shervans.dll	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
File created	C:\Windows\SysWOW64\smnss.exe	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
File created	C:\Windows\SysWOW64\satornas.dll	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
File created	C:\Windows\SysWOW64\shervans.dll	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
File created	C:\Windows\SysWOW64\grcopy.dll	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\oskmenubase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml	smnss.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\Filters.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	smnss.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\README.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	smnss.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\auxbase.xml	smnss.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml	smnss.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	2216	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smnss.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	smnss.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 1628	2204	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe	30
PID 2204 wrote to memory of 1628	2204	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe	30
PID 2204 wrote to memory of 1628	2204	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe	30
PID 2204 wrote to memory of 1628	2204	d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe	30
PID 1628 wrote to memory of 2216	1628	ctfmen.exe	31
PID 1628 wrote to memory of 2216	1628	ctfmen.exe	31
PID 1628 wrote to memory of 2216	1628	ctfmen.exe	31
PID 1628 wrote to memory of 2216	1628	ctfmen.exe	31
PID 2216 wrote to memory of 1932	2216	smnss.exe	32
PID 2216 wrote to memory of 1932	2216	smnss.exe	32
PID 2216 wrote to memory of 1932	2216	smnss.exe	32
PID 2216 wrote to memory of 1932	2216	smnss.exe	32

C:\Users\Admin\AppData\Local\Temp\d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe
"C:\Users\Admin\AppData\Local\Temp\d6560615ad74ebd6570750b1472326e35d3c84192214d40c4f21d31f0c8ed216.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 844
      4⤵
      Loads dropped DLL
      Program crash
      PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
0e1c4462b04bb97ffcda9a844f8833a3

SHA1
aa5000d828ad332f0db7085e76d7250db2f004e2

SHA256
032ede73a5f622325f693d903919cddf030a7459b200236a3e42f74ae5aa9955

SHA512
fa41a85ee01e6ef1442128e04948e1fca78b668b13c06220ea7cf41595695356fd58530b0c180d10a8972e35f86508c3ff62c0f88be37c28bd9ec9839cdf4320

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
71a136f12c95c3b829a83c8575fb779c

SHA1
c965e17a02d80915d5344e555845d36e82ddfd88

SHA256
40e0e0a2879afe01928931fe0f1a9ae3b03a8eef662f8e4d8e1f9f16ccc71d69

SHA512
92b124263d3e99081aa05d04b55118428cfeb99d54724524f5663d945e12f95dbf33c7aabe07dc0a1b6c60ff8cf6361ee100687874e60b033f502f70ad565051

Download Submit
C:\Windows\SysWOW64\smnss.exe

Filesize
118KB

MD5
31d969f143af884251b7fed5926d2cf1

SHA1
631f7e6b085eb487c3ce45f0b34adea22d1d14a0

SHA256
6c8449f4a460d1ce80d3ed5ee5dbaf2b377c55dd21f8322ab02b3cb6752e2b39

SHA512
7cdf087cb7fb0c31d5a4c05f791dcc7a7f67b6ec9776304ef10e9b22455ad65616c5ee850061f1adf80bc1703e893de8f8884d2ed2782bf05269ecb0e773ea51

Download Submit
\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
4c680dedbf05ee94d16aa2309b1be528

SHA1
4c1a54899f5a07e8267e1faa0ab1c6044055bab3

SHA256
04088aa99d98888a4daa366ea8b6b3a9a147762a6477e079c809b9d814b4087b

SHA512
bee2aad2b3ae7d41cf28aa5c645ee97872f7ae57ba74cddf41cc97000a3647b034786b69478721c4f7f17ce0c64638b727c8abd8b0e32d761afbbd0f8d094dd3

Download Submit
memory/1628-29-0x0000000000320000-0x000000000033F000-memory.dmp

Filesize
124KB

Download
memory/1628-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1628-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2204-24-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2204-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2204-25-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2204-12-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2216-35-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2216-41-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2216-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2216-47-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads