Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 22:25
Static task
static1
Behavioral task
behavioral1
Sample
a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe
Resource
win10v2004-20241007-en
General
-
Target
a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe
-
Size
75KB
-
MD5
6b5286a12d2277003d4e89d71da6aa10
-
SHA1
6cbfe852040407428811750f393e5e8c3eac5111
-
SHA256
a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0fa
-
SHA512
5584062fad68dc5a6be70db5a152dc3ca3cc6e0f8d29349d99f4fb7657076ed7404fb47a2aaccb6e4c407b5b4f5c66f4c3a8d382ff31db62879977a7c3fa6220
-
SSDEEP
1536:Zx1Qja7luy6y0s4sqfkbnAKBOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3E:DOjWuyt0ZsqsXOKofHfHTXQLzgvnzHPM
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0008000000015d0a-9.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 2216 ctfmen.exe 2804 smnss.exe -
Loads dropped DLL 9 IoCs
pid Process 2460 a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe 2460 a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe 2460 a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe 2216 ctfmen.exe 2216 ctfmen.exe 2804 smnss.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\1 smnss.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\grcopy.dll a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe File opened for modification C:\Windows\SysWOW64\grcopy.dll a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe File opened for modification C:\Windows\SysWOW64\satornas.dll a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File created C:\Windows\SysWOW64\ctfmen.exe a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe File opened for modification C:\Windows\SysWOW64\ctfmen.exe a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe File created C:\Windows\SysWOW64\shervans.dll a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe File opened for modification C:\Windows\SysWOW64\shervans.dll a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe File created C:\Windows\SysWOW64\smnss.exe a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe File created C:\Windows\SysWOW64\satornas.dll a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\fur.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\README.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\de.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\Xusage.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-phonetic.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt smnss.exe File opened for modification C:\Program Files\7-Zip\readme.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\nn.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols.xml smnss.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.VisualElementsManifest.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrl.xml smnss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt smnss.exe File opened for modification C:\Program Files\7-Zip\History.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tk.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\baseAltGr_rtl.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\webbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfin.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\keypadbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml smnss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\ea.xml smnss.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2616 2804 WerFault.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smnss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmen.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2804 smnss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2216 2460 a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe 31 PID 2460 wrote to memory of 2216 2460 a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe 31 PID 2460 wrote to memory of 2216 2460 a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe 31 PID 2460 wrote to memory of 2216 2460 a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe 31 PID 2216 wrote to memory of 2804 2216 ctfmen.exe 32 PID 2216 wrote to memory of 2804 2216 ctfmen.exe 32 PID 2216 wrote to memory of 2804 2216 ctfmen.exe 32 PID 2216 wrote to memory of 2804 2216 ctfmen.exe 32 PID 2804 wrote to memory of 2616 2804 smnss.exe 33 PID 2804 wrote to memory of 2616 2804 smnss.exe 33 PID 2804 wrote to memory of 2616 2804 smnss.exe 33 PID 2804 wrote to memory of 2616 2804 smnss.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe"C:\Users\Admin\AppData\Local\Temp\a0c0b3398d8ef4bdba250e645367c6158ee071cac0c80d514c47ecf7cd8bf0faN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 8524⤵
- Loads dropped DLL
- Program crash
PID:2616
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
183B
MD5ff4ca4fe6621dcae93864dbcfea2d82a
SHA1edfb10902baa01247a749e0ab98a3abdf8aeafef
SHA25654e834bb8a01875a724691e7e38516ba49fc52a5dc64ced50cee13b99482d2c6
SHA5125c0bda13c1ef3c6edaaf73840493043126f2a71114c26893450183ce170f3ef1a3c1ec7ce4915c5097fc9c006575a3298475eb2a3ce277d6199496d5e1caa63c
-
Filesize
4KB
MD5dc29998ad360df5847c83c4b0df56e9a
SHA1b5e82f9f0f67710b0d2142c389010b93b2abf4da
SHA25655f8574a16cb8338b83c5ccaf5886ac425c6cf91066663c4853d1e81a8c978ad
SHA51298bd1b82efaf164468c2619b9330fefe91e7f3bb54df27fdf4d79e57cd9b1c79c16c820aaa4eb7ee45106ec593640f44297c47b067ab988cfc7d929b8da61fa9
-
Filesize
8KB
MD5d00879f5c6a3699708cbe90e548d86be
SHA15c1ebc3c7cd9e49180dd2e25dc2308d94bb460db
SHA25690266c6d41f5e5014920490fecbf65a4f76c87501e4def4c7c80561689d34843
SHA5120643d2dd7bcfc5f04837c37787b8d8f8339fa99a427061edd21fdb5f87ce07a364d15e1675e5697e4e391305d71341b619c3e9a4c61b798dbb1c5b26a266ade8
-
Filesize
75KB
MD540ded4942d8a5522d0722291c0bb4097
SHA1dae5d68052d8089371734590a705ad8e8d565037
SHA2563b8626a4cbc1a557760f688a8288182e8b1c6703f3988e5d6b3141e73a9a2485
SHA512438b2f9b1a8f1633e45879893b482697774ae4098e3b8351a39d416ded997d5f8c5a21c8580ca526c618c91b2f78d4f4571676a3c644f2f1081293a4caf1545f