Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-01-2025 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
120 seconds
General
-
Target
5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe
-
Size
127KB
-
MD5
5cea0594d8f2182442ce40d6933543c0
-
SHA1
441d79a32e498c90c6e54296a2311d39a0161299
-
SHA256
5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782c
-
SHA512
6c7c0b8dac97f4f0edb03bb33fe35ac917fa69b406251a82705cfdef5e05388f60b30bb69d02d3a23b8e3cabbbcb0d6b98d44e3368e898d1edc223b39241cf62
-
SSDEEP
3072:9OjWuyt0ZHqsXOKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPPz:9IH9OKofHfHTXQLzgvnzHPowYbvrjD/e
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000a000000023b75-10.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 100 ctfmen.exe 2228 smnss.exe -
Loads dropped DLL 2 IoCs
pid Process 3668 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe 2228 smnss.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ctfmen = "C:\\Windows\\system32\\ctfmen.exe" smnss.exe -
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 smnss.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\1 smnss.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe -
Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\ctfmen.exe 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe File created C:\Windows\SysWOW64\shervans.dll 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe File opened for modification C:\Windows\SysWOW64\grcopy.dll 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe File opened for modification C:\Windows\SysWOW64\shervans.dll 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe File created C:\Windows\SysWOW64\smnss.exe 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe File created C:\Windows\SysWOW64\satornas.dll 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe File opened for modification C:\Windows\SysWOW64\satornas.dll 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe File created C:\Windows\SysWOW64\zipfi.dll smnss.exe File opened for modification C:\Windows\SysWOW64\ctfmen.exe 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe File created C:\Windows\SysWOW64\grcopy.dll 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe File created C:\Windows\SysWOW64\zipfiaq.dll smnss.exe File created C:\Windows\SysWOW64\smnss.exe smnss.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt smnss.exe File opened for modification C:\Program Files\7-Zip\History.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Gothic-Palatino Linotype.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-dayi.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml smnss.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\server\Xusage.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Word.Word.x-none.msi.16.x-none.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml smnss.exe File opened for modification C:\Program Files\Java\jdk-1.8\jmc.txt smnss.exe File opened for modification C:\Program Files\Java\jdk-1.8\jvisualvm.txt smnss.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jvm.hprof.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\readme.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Arial.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\oskpredbase.xml smnss.exe File opened for modification C:\Program Files\Java\jre-1.8\README.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Orange.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Excel.Excel.x-none.msi.16.x-none.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.HTM smnss.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsjpn.xml smnss.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\README.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.office32mui.msi.16.en-us.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\client_eula.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\keypadbase.xml smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ko-kr.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt smnss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml smnss.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Century Schoolbook.xml smnss.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt smnss.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3284 2228 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctfmen.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language smnss.exe -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32\ = "C:\\Windows\\SysWow64\\shervans.dll" smnss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InprocServer32 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2228 smnss.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3668 wrote to memory of 100 3668 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe 84 PID 3668 wrote to memory of 100 3668 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe 84 PID 3668 wrote to memory of 100 3668 5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe 84 PID 100 wrote to memory of 2228 100 ctfmen.exe 85 PID 100 wrote to memory of 2228 100 ctfmen.exe 85 PID 100 wrote to memory of 2228 100 ctfmen.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe"C:\Users\Admin\AppData\Local\Temp\5211b9bce9b1f4c5d396ece3d525ea2790b4d2ef2d2f47577d0b36b782af782cN.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:100 -
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 16724⤵
- Program crash
PID:3284
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2228 -ip 22281⤵PID:1480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5f9424a403b859f316a5bcf80c79be13a
SHA18ac1fb6cf67d381742b597936a3e30cbcb936692
SHA25675b1f0188e8761472a4abc8f841526d05c5534963eb6880cc452176afc85ef0e
SHA512fd4dc32d14f6946e7d1d698b263658e72fc4f5718aa1d504b647e2276df9ddd60b44940bbca67dc1ecb8ef72e5c5b2b3c54a7eae5c6a44d9721034f27e0d36f7
-
Filesize
127KB
MD5618e58874e021008abee68a480d6c1b1
SHA1e8ff196b85eb47d6c13665a9df193b37ef9035d7
SHA256b569771811fd1d69421667f3912c93248e71d75021604ed613d58e9c177dba9d
SHA512d2230ab50abae4fcb056d08b1933727085e15fb20f63761fa76b843bed216b3a145b2fa430c263005be3199f0495c44612c37e3fc5066f2a56ad0adb21ced20b
-
Filesize
183B
MD5087d9a9aca608cd67401697bccda45a8
SHA1f7b4930a53c3ff73f33c1b99b742ebb8d137a9ed
SHA25662bd5e432169be6dbb5c61cd7a60a2196d3107136739b63ea6ed8c1aba4b0928
SHA51295aec0f84177791d60f20a73df50f3e623b665db38d9a3e40efb6086df09c2ef277e9ef787f2c76704d7b07dde04c90a3809b8a65afd58c3ac796d7dcc23e531
-
Filesize
8KB
MD50e4b980434396b5f5215fc34bf0529f0
SHA1fb8df60395cde356ea223d4ea690989144aabbf3
SHA256ec96a8aefabba50247bf7c1567610ea157cd398e570ba01ddee0e312311d8412
SHA51246e2411dfdc53ee0a7b8a728dc7a564c78f25ca2bba929e790670634cea4b30ccb7ae8c34f2aeaf97b793589e4851695752bba6d505cb274e005bf0b2c9edb8d