Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 07:34

General

  • Target

    c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe

  • Size

    386KB

  • MD5

    8b7a4c06d8fda99099e8a11c8273b8e9

  • SHA1

    9f60b2cee08ff473a9d8e50838857e0ee09be8ea

  • SHA256

    c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d

  • SHA512

    3443dd21fc81fc30c92ec3240a8f0e09531774f7c0a80bf1b2e5f698cd783e509accfdaa64972f46c52ae57dc0c6417f1117220d240308c276b07c70d50831fe

  • SSDEEP

    12288:y2SaqAob212fQj5dmKVxp3pl2nT3gpC5+vkhpoHh:y2SMoRIVdmkp3pIgpKp4

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Kills process with taskkill 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe
    "C:\Users\Admin\AppData\Local\Temp\c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\SysWOW64\reg.exe
      reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v JavaUpdatecda9 /d "c:\programfiles\reaction\cssrs.exe" /f
      2⤵
      • Adds Run key to start application
      PID:1852
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill -f /im cssrs.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:952
    • C:\Windows\SysWOW64\taskkill.exe
      taskkill -f /im cssrs.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:936
    • C:\programfiles\reaction\cssrs.exe
      C:\programfiles\reaction\cssrs.exe
      2⤵
      • Executes dropped EXE
      PID:784

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\programfiles\reaction\cssrs.exe

    Filesize

    386KB

    MD5

    8b7a4c06d8fda99099e8a11c8273b8e9

    SHA1

    9f60b2cee08ff473a9d8e50838857e0ee09be8ea

    SHA256

    c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d

    SHA512

    3443dd21fc81fc30c92ec3240a8f0e09531774f7c0a80bf1b2e5f698cd783e509accfdaa64972f46c52ae57dc0c6417f1117220d240308c276b07c70d50831fe

  • \programfiles\reaction\cssrs.exe

    Filesize

    386KB

    MD5

    8b7a4c06d8fda99099e8a11c8273b8e9

    SHA1

    9f60b2cee08ff473a9d8e50838857e0ee09be8ea

    SHA256

    c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d

    SHA512

    3443dd21fc81fc30c92ec3240a8f0e09531774f7c0a80bf1b2e5f698cd783e509accfdaa64972f46c52ae57dc0c6417f1117220d240308c276b07c70d50831fe

  • \programfiles\reaction\cssrs.exe

    Filesize

    386KB

    MD5

    8b7a4c06d8fda99099e8a11c8273b8e9

    SHA1

    9f60b2cee08ff473a9d8e50838857e0ee09be8ea

    SHA256

    c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d

    SHA512

    3443dd21fc81fc30c92ec3240a8f0e09531774f7c0a80bf1b2e5f698cd783e509accfdaa64972f46c52ae57dc0c6417f1117220d240308c276b07c70d50831fe

  • memory/784-63-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

  • memory/784-65-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

  • memory/2036-55-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

  • memory/2036-58-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB

  • memory/2036-64-0x0000000000400000-0x00000000004D1000-memory.dmp

    Filesize

    836KB