Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/10/2024, 21:08
Static task
static1
Behavioral task
behavioral1
Sample
3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe
Resource
win10v2004-20241007-en
General
-
Target
3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe
-
Size
119KB
-
MD5
8df3c43e9ae0714a620a4f22c8169810
-
SHA1
47dcddf24b66f2299c846342d186bccf58d87b79
-
SHA256
3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436ad
-
SHA512
c840b325018eef8c32018d3121824db480b6bd8a601630b12697d1a891f041c95acbfc3f2fb2e82e4c0e3ecf098b9ee6fe192fe5c7b561d17ed32be45adff3f8
-
SSDEEP
3072:zOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPh:zIs9OKofHfHTXQLzgvnzHPowYbvrjD/E
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00070000000195d6-10.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 1908 ctfmen.exe 2964 smnss.exe -
Loads dropped DLL 9 IoCs
pid Process 2296 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe 2296 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe 2296 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe 1908 ctfmen.exe 1908 ctfmen.exe 2964 smnss.exe 2664 WerFault.exe 2664 WerFault.exe 2664 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 smnss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\satornas.dll 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe File opened for modification C:\Windows\SysWOW64\ctfmen.exe 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe File opened for modification C:\Windows\SysWOW64\grcopy.dll 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe File created C:\Windows\SysWOW64\smnss.exe 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe File created C:\Windows\SysWOW64\satornas.dll 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe File created C:\Windows\SysWOW64\ctfmen.exe 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe File created C:\Windows\SysWOW64\shervans.dll 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe File created C:\Windows\SysWOW64\grcopy.dll 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe File opened for modification C:\Windows\SysWOW64\shervans.dll 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt smnss.exe File opened for modification C:\Program Files\7-Zip\readme.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-changjei.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml smnss.exe File opened for modification C:\Program Files\Internet Explorer\Timeline.cpu.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\kor-kor.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ko-kr.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ba.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt smnss.exe File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt smnss.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2664 2964 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smnss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmen.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2964 smnss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2296 wrote to memory of 1908 2296 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe 30 PID 2296 wrote to memory of 1908 2296 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe 30 PID 2296 wrote to memory of 1908 2296 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe 30 PID 2296 wrote to memory of 1908 2296 3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe 30 PID 1908 wrote to memory of 2964 1908 ctfmen.exe 31 PID 1908 wrote to memory of 2964 1908 ctfmen.exe 31 PID 1908 wrote to memory of 2964 1908 ctfmen.exe 31 PID 1908 wrote to memory of 2964 1908 ctfmen.exe 31 PID 2964 wrote to memory of 2664 2964 smnss.exe 32 PID 2964 wrote to memory of 2664 2964 smnss.exe 32 PID 2964 wrote to memory of 2664 2964 smnss.exe 32 PID 2964 wrote to memory of 2664 2964 smnss.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe"C:\Users\Admin\AppData\Local\Temp\3308c4ccc6d47897e9f8ac4b351aabec981af60571d6080a72c84609fcb436adN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 8284⤵
- Loads dropped DLL
- Program crash
PID:2664
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD530384658d847da3590d43332ab9c90cc
SHA1afe4e21ed3baeefff3cef52f32254465110bdd9e
SHA256cd68b719f738ab817579ef32a3afa869b14799650130980b27123a45be5c0788
SHA5127fa5c9c240ce74865be6b118acce8b67b3221d140c9031dbc40335230dcea453c246e208513169413fd23ed2568795ef382772f35abe97e1be8e9e49d79ceede
-
Filesize
4KB
MD57821db314a373a73422d7429b61dd23b
SHA19b690b7218236605e45acd8c59dcba2d1945cd18
SHA2562823942569dd8b045285dd6b5ce19e27667d612370dacfd83839b0304f6c89e4
SHA512c4447686b3ac86a1b0a14f35fc677b9029da1232b46f2503653206bc3e003921efcb5332011617095da239312e96927633b3658a64cd2a2ac7fcb8ca8400ad11
-
Filesize
8KB
MD558fbe2526566b1769b8f0c3705d0423a
SHA1c3be619130af63082100c902314e8c58d04725cd
SHA256b4c66eba0be4fc7a7f6134d098ec826058f5aaf4ca86531759afb0da26e33965
SHA5129c43449e7fea27971c5f28cf5ade64a79533c17c2e5211c79fb39daf0ddf995642e768e01d9547bb7c32458039592e236afe9b58c20dcc6bc548c3c4989ea3a7
-
Filesize
119KB
MD56fc66f655fa04ac8fe3df70aca71c3ec
SHA1b1a678f943e52fbce6bf6f08d7d27264516eb077
SHA256b7611397b66a72c04c834bec49d1665a36d8a73a6d18e73c6dc8c44cac5e6816
SHA51282f44504a2ad338b37c223a8e1169f5e35f22ec08f3b5778bee914b8b65845cd730f8532686782112e356b9626aa1829250f4bce5ef0808a9f03cbc182f23957