21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c

Analysis

max time kernel
152s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Size

265KB
MD5

90e6e21a313f6fcaf43be0d8187db02c
SHA1

15c7508874fc5211198cbf089775f63a50ff23e7
SHA256

21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c
SHA512

e35b296d30b3ab0de74767c3b94dc24a47d6af6d7c1bf6f04b51748ef296c930be29a8d0b9184ac8b3847c31ec49d776890a155b8eeb732a6dc3111fb2d1340a
SSDEEP

1536:ysHGQLphzQHUyRPkN2HpuP7HIPe5MQVgd54vZwkvH7p1Nh5mTox8qGYqKnN8KTRQ:QQL/bCrwIPe5ML7KwkvH71aorGOXR

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe

Executes dropped EXE 2 IoCs

pid	Process
1732	cssrs.exe
1744	cssrs.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\TINTIMG = "C:\\Users\\Admin\\AppData\\Roaming\\cssrs.exe"	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://www.114116.info"	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\Tabs = "http://www.114116.info"	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.114116.info"	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.114116.info"	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\AboutURLs	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\blank = "http://www.114116.info"	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\AboutURLs	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\AboutURLs\blank = "http://www.114116.info"	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.114116.info"	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.114116.info"	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe
1744	cssrs.exe
1744	cssrs.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
1732	cssrs.exe
1732	cssrs.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1732	1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe	84
PID 1932 wrote to memory of 1732	1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe	84
PID 1932 wrote to memory of 1732	1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe	84
PID 1932 wrote to memory of 1744	1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe	85
PID 1932 wrote to memory of 1744	1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe	85
PID 1932 wrote to memory of 1744	1932	21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe	85

C:\Users\Admin\AppData\Local\Temp\21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe
"C:\Users\Admin\AppData\Local\Temp\21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Drops startup file
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Users\Admin\AppData\Roaming\cssrs.exe
  C:\Users\Admin\AppData\Roaming\cssrs.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe

Filesize
265KB

MD5
90e6e21a313f6fcaf43be0d8187db02c

SHA1
15c7508874fc5211198cbf089775f63a50ff23e7

SHA256
21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c

SHA512
e35b296d30b3ab0de74767c3b94dc24a47d6af6d7c1bf6f04b51748ef296c930be29a8d0b9184ac8b3847c31ec49d776890a155b8eeb732a6dc3111fb2d1340a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cssrs.exe

Filesize
265KB

MD5
90e6e21a313f6fcaf43be0d8187db02c

SHA1
15c7508874fc5211198cbf089775f63a50ff23e7

SHA256
21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c

SHA512
e35b296d30b3ab0de74767c3b94dc24a47d6af6d7c1bf6f04b51748ef296c930be29a8d0b9184ac8b3847c31ec49d776890a155b8eeb732a6dc3111fb2d1340a

Download Submit
C:\Users\Admin\AppData\Roaming\cssrs.exe

Filesize
265KB

MD5
90e6e21a313f6fcaf43be0d8187db02c

SHA1
15c7508874fc5211198cbf089775f63a50ff23e7

SHA256
21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c

SHA512
e35b296d30b3ab0de74767c3b94dc24a47d6af6d7c1bf6f04b51748ef296c930be29a8d0b9184ac8b3847c31ec49d776890a155b8eeb732a6dc3111fb2d1340a

Download Submit
C:\Users\Admin\AppData\Roaming\cssrs.exe

Filesize
265KB

MD5
90e6e21a313f6fcaf43be0d8187db02c

SHA1
15c7508874fc5211198cbf089775f63a50ff23e7

SHA256
21a51808af7e25e5c4cad004940fb9314b1417dfe9ef9903da25dc2eaaa4572c

SHA512
e35b296d30b3ab0de74767c3b94dc24a47d6af6d7c1bf6f04b51748ef296c930be29a8d0b9184ac8b3847c31ec49d776890a155b8eeb732a6dc3111fb2d1340a

Download Submit
memory/1732-139-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1744-140-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1932-132-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1932-141-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download