7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a

General

Target

7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
Size

119KB
MD5

180176a8b7f136eb06915339c37f041e
SHA1

c1b97c38056389eb6aa6cd57cce4540eb02c1b0e
SHA256

7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a
SHA512

2a810854f7c4eaa43a8cadd266659cae7bef3a51ae44ab3649d82950a2fe80b68f7dd3c19406e6a18fb146fbb6409ff16fc66e619d151cb07f2c465e74474b4b
SSDEEP

3072:ROjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:RIs9OKofHfHTXQLzgvnzHPowYbvrjD/E

Score

7^/10

discovery persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000b000000023b7b-10.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
220	ctfmen.exe
2712	smnss.exe

Loads dropped DLL 2 IoCs

pid	Process
1788	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
2712	smnss.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe"	smnss.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	smnss.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	smnss.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\shervans.dll	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
File created	C:\Windows\SysWOW64\smnss.exe	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
File created	C:\Windows\SysWOW64\satornas.dll	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
File created	C:\Windows\SysWOW64\zipfiaq.dll	smnss.exe
File created	C:\Windows\SysWOW64\ctfmen.exe	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
File opened for modification	C:\Windows\SysWOW64\ctfmen.exe	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
File created	C:\Windows\SysWOW64\shervans.dll	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
File created	C:\Windows\SysWOW64\zipfi.dll	smnss.exe
File created	C:\Windows\SysWOW64\smnss.exe	smnss.exe
File created	C:\Windows\SysWOW64\grcopy.dll	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
File opened for modification	C:\Windows\SysWOW64\grcopy.dll	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
File opened for modification	C:\Windows\SysWOW64\satornas.dll	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5100	2712	WerFault.exe	89

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smnss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmen.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll"	smnss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	smnss.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 220	1788	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe	88
PID 1788 wrote to memory of 220	1788	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe	88
PID 1788 wrote to memory of 220	1788	7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe	88
PID 220 wrote to memory of 2712	220	ctfmen.exe	89
PID 220 wrote to memory of 2712	220	ctfmen.exe	89
PID 220 wrote to memory of 2712	220	ctfmen.exe	89

C:\Users\Admin\AppData\Local\Temp\7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe
"C:\Users\Admin\AppData\Local\Temp\7ac8fc19f2aaf4f7383c270336f2437b6e88d8c4dcb7d6027be052e3ff44ff7a.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\SysWOW64\ctfmen.exe
  ctfmen.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\SysWOW64\smnss.exe
    C:\Windows\system32\smnss.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2712 -s 1340
      4⤵
      Program crash
      PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2712 -ip 2712
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ctfmen.exe

Filesize
4KB

MD5
ba868149b35a8cb79bc631447f6d1e50

SHA1
b26df637522e9ad6670d34847910b89d91d75cd6

SHA256
73323b06f671c3c579cd4fc00e530ae603317b1773d173263abc255a5c9fcb38

SHA512
25bb321fd0236734e17b8fa5c7c36a213699b41b9c086c3d58e8e575c4484cab47d9290a66954ea883733821d71a4f6182d9c0187929dcfdcd77cc05a9dd253a

Download Submit
C:\Windows\SysWOW64\grcopy.dll

Filesize
119KB

MD5
0baf92abe636bf7ddf509e00a741fb85

SHA1
4e5bd27b474d79b90c01ced49a238038dcddcdd5

SHA256
f6b7841213e9d6dfc3abf65ceb944d758efa04713661e46ccda3d294a4713193

SHA512
ae78cbbe87ccb4c4f74e84bbfa106f0aa0a7ade097c0e4091c83bdfab513d6b93a724484ec4519594739550c8c0f0a270f8d3df1d9ce4bc67b2ca73c8fca9a0b

Download Submit
C:\Windows\SysWOW64\satornas.dll

Filesize
183B

MD5
62134b93a9ef40803f579caca9e4594f

SHA1
f1b680b693fb6a00d1e349bce19c3f515db26401

SHA256
01544430cf0851fef8ef5c0e0f2693e84079ae04415f2a1744736c9ccc36fede

SHA512
57a84c47670c8dfeb907466d39e1d603ddfae939294a8709607d5516fb11703a07c8388a2e450dcdf22bb8eafb8d39660aab35278376ff278d215d632a75d1f3

Download Submit
C:\Windows\SysWOW64\shervans.dll

Filesize
8KB

MD5
ac0f9c27e6afef02332dedcfd6bda524

SHA1
a0e4821aa7e111fe98f212e31de76cc64c69da60

SHA256
7a3e0fed99cb17c611f2fe3bf6f9a763f929d14452157b16451b11ad8c31b4ea

SHA512
f180feb126d47293ebedbfe7d07953d4991d01ca6d341fafdc5de7147119e870aaa008bbba6a5abb28530a95bdd96915c2a8f792d28e331594b3cbf1044acf05

Download Submit
memory/220-31-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/220-21-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1788-24-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/1788-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1788-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1788-13-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2712-28-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2712-37-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2712-39-0x0000000010000000-0x000000001000D000-memory.dmp

Filesize
52KB

Download
memory/2712-40-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads