451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821

General

Target

451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Size

417KB
MD5

68f6ce1d165b8c1ee9050a71dc8ba1eb
SHA1

2be3af62f96f6e572f0cb2185d99668098071af5
SHA256

451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821
SHA512

3bcfa67295d71bedb3746211f0fb920b0127b91c10df7ebec2a52df602018b85cefe731329d553239d71cfe7084cee3502773affea5c2914a141e5c17862057c
SSDEEP

1536:NsDGQLphzQHUyRPkN2HpuP7RIPe5HQVgd54v:FQL/bCrWIPe5HL7

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe

Executes dropped EXE 2 IoCs

pid	Process
1924	cssrs.exe
2012	cssrs.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe

Loads dropped DLL 4 IoCs

pid	Process
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TINTIMG = "C:\\Users\\Admin\\AppData\\Roaming\\cssrs.exe"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\AboutURLs	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\AboutURLs\blank = "http://www.114116.info"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://www.114116.info"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.114116.info"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\AboutURLs	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs\blank = "http://www.114116.info"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://www.114116.info"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.114116.info"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Start Page = "http://www.114116.info"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.114116.info"	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2012	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe
2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
1924	cssrs.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1924	2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe	26
PID 2016 wrote to memory of 1924	2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe	26
PID 2016 wrote to memory of 1924	2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe	26
PID 2016 wrote to memory of 1924	2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe	26
PID 2016 wrote to memory of 2012	2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe	27
PID 2016 wrote to memory of 2012	2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe	27
PID 2016 wrote to memory of 2012	2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe	27
PID 2016 wrote to memory of 2012	2016	451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe	27

C:\Users\Admin\AppData\Local\Temp\451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe
"C:\Users\Admin\AppData\Local\Temp\451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Users\Admin\AppData\Roaming\cssrs.exe
  C:\Users\Admin\AppData\Roaming\cssrs.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1924
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

2

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe

Filesize
417KB

MD5
68f6ce1d165b8c1ee9050a71dc8ba1eb

SHA1
2be3af62f96f6e572f0cb2185d99668098071af5

SHA256
451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821

SHA512
3bcfa67295d71bedb3746211f0fb920b0127b91c10df7ebec2a52df602018b85cefe731329d553239d71cfe7084cee3502773affea5c2914a141e5c17862057c

Download Submit
C:\Users\Admin\AppData\Roaming\cssrs.exe

Filesize
417KB

MD5
68f6ce1d165b8c1ee9050a71dc8ba1eb

SHA1
2be3af62f96f6e572f0cb2185d99668098071af5

SHA256
451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821

SHA512
3bcfa67295d71bedb3746211f0fb920b0127b91c10df7ebec2a52df602018b85cefe731329d553239d71cfe7084cee3502773affea5c2914a141e5c17862057c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe

Filesize
417KB

MD5
68f6ce1d165b8c1ee9050a71dc8ba1eb

SHA1
2be3af62f96f6e572f0cb2185d99668098071af5

SHA256
451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821

SHA512
3bcfa67295d71bedb3746211f0fb920b0127b91c10df7ebec2a52df602018b85cefe731329d553239d71cfe7084cee3502773affea5c2914a141e5c17862057c

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe

Filesize
417KB

MD5
68f6ce1d165b8c1ee9050a71dc8ba1eb

SHA1
2be3af62f96f6e572f0cb2185d99668098071af5

SHA256
451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821

SHA512
3bcfa67295d71bedb3746211f0fb920b0127b91c10df7ebec2a52df602018b85cefe731329d553239d71cfe7084cee3502773affea5c2914a141e5c17862057c

Download Submit
\Users\Admin\AppData\Roaming\cssrs.exe

Filesize
417KB

MD5
68f6ce1d165b8c1ee9050a71dc8ba1eb

SHA1
2be3af62f96f6e572f0cb2185d99668098071af5

SHA256
451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821

SHA512
3bcfa67295d71bedb3746211f0fb920b0127b91c10df7ebec2a52df602018b85cefe731329d553239d71cfe7084cee3502773affea5c2914a141e5c17862057c

Download Submit
\Users\Admin\AppData\Roaming\cssrs.exe

Filesize
417KB

MD5
68f6ce1d165b8c1ee9050a71dc8ba1eb

SHA1
2be3af62f96f6e572f0cb2185d99668098071af5

SHA256
451007c29a38ac69020b2c5c663923976f063f62c646c871b1ed2df00ffdc821

SHA512
3bcfa67295d71bedb3746211f0fb920b0127b91c10df7ebec2a52df602018b85cefe731329d553239d71cfe7084cee3502773affea5c2914a141e5c17862057c

Download Submit
memory/1924-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2016-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-66-0x00000000021A0000-0x0000000002215000-memory.dmp

Filesize
468KB

Download
memory/2016-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads