Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 07:34
Behavioral task
behavioral1
Sample
c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe
Resource
win10v2004-20220812-en
General
-
Target
c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe
-
Size
386KB
-
MD5
8b7a4c06d8fda99099e8a11c8273b8e9
-
SHA1
9f60b2cee08ff473a9d8e50838857e0ee09be8ea
-
SHA256
c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d
-
SHA512
3443dd21fc81fc30c92ec3240a8f0e09531774f7c0a80bf1b2e5f698cd783e509accfdaa64972f46c52ae57dc0c6417f1117220d240308c276b07c70d50831fe
-
SSDEEP
12288:y2SaqAob212fQj5dmKVxp3pl2nT3gpC5+vkhpoHh:y2SMoRIVdmkp3pIgpKp4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 784 cssrs.exe -
resource yara_rule behavioral1/memory/2036-55-0x0000000000400000-0x00000000004D1000-memory.dmp upx behavioral1/memory/2036-58-0x0000000000400000-0x00000000004D1000-memory.dmp upx behavioral1/files/0x000800000001231a-59.dat upx behavioral1/files/0x000800000001231a-62.dat upx behavioral1/files/0x000800000001231a-60.dat upx behavioral1/memory/784-63-0x0000000000400000-0x00000000004D1000-memory.dmp upx behavioral1/memory/2036-64-0x0000000000400000-0x00000000004D1000-memory.dmp upx behavioral1/memory/784-65-0x0000000000400000-0x00000000004D1000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\JavaUpdatecda9 = "c:\\programfiles\\reaction\\cssrs.exe" reg.exe -
Kills process with taskkill 2 IoCs
pid Process 952 taskkill.exe 936 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 936 taskkill.exe Token: SeDebugPrivilege 952 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1852 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 28 PID 2036 wrote to memory of 1852 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 28 PID 2036 wrote to memory of 1852 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 28 PID 2036 wrote to memory of 1852 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 28 PID 2036 wrote to memory of 952 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 30 PID 2036 wrote to memory of 952 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 30 PID 2036 wrote to memory of 952 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 30 PID 2036 wrote to memory of 952 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 30 PID 2036 wrote to memory of 936 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 31 PID 2036 wrote to memory of 936 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 31 PID 2036 wrote to memory of 936 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 31 PID 2036 wrote to memory of 936 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 31 PID 2036 wrote to memory of 784 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 35 PID 2036 wrote to memory of 784 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 35 PID 2036 wrote to memory of 784 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 35 PID 2036 wrote to memory of 784 2036 c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe"C:\Users\Admin\AppData\Local\Temp\c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v JavaUpdatecda9 /d "c:\programfiles\reaction\cssrs.exe" /f2⤵
- Adds Run key to start application
PID:1852
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /im cssrs.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /im cssrs.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
C:\programfiles\reaction\cssrs.exeC:\programfiles\reaction\cssrs.exe2⤵
- Executes dropped EXE
PID:784
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
386KB
MD58b7a4c06d8fda99099e8a11c8273b8e9
SHA19f60b2cee08ff473a9d8e50838857e0ee09be8ea
SHA256c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d
SHA5123443dd21fc81fc30c92ec3240a8f0e09531774f7c0a80bf1b2e5f698cd783e509accfdaa64972f46c52ae57dc0c6417f1117220d240308c276b07c70d50831fe
-
Filesize
386KB
MD58b7a4c06d8fda99099e8a11c8273b8e9
SHA19f60b2cee08ff473a9d8e50838857e0ee09be8ea
SHA256c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d
SHA5123443dd21fc81fc30c92ec3240a8f0e09531774f7c0a80bf1b2e5f698cd783e509accfdaa64972f46c52ae57dc0c6417f1117220d240308c276b07c70d50831fe
-
Filesize
386KB
MD58b7a4c06d8fda99099e8a11c8273b8e9
SHA19f60b2cee08ff473a9d8e50838857e0ee09be8ea
SHA256c5495c5abe79e618ad6b6a7b18436b6a484fbaa6824e1d3109c7d1dbb6b4702d
SHA5123443dd21fc81fc30c92ec3240a8f0e09531774f7c0a80bf1b2e5f698cd783e509accfdaa64972f46c52ae57dc0c6417f1117220d240308c276b07c70d50831fe