Analysis

  • max time kernel
    162s
  • max time network
    173s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 09:49

General

  • Target

    NET Reactor v6.9.0.0_fu11/Help/REACTOR_HELP.exe

  • Size

    2.6MB

  • MD5

    db1c91c8d1d7573371cac6a51bf3a1b9

  • SHA1

    291fe96baeeca49fd4271f06b885477de284bf9c

  • SHA256

    a3f0cebda251dcf4ccb5915d8ead90771f76e0df9fbb35193b74e4687852d473

  • SHA512

    da066b919316ce98255562c41c4267dd3059695028d8c8b19ed1303a57b909efe0a333bb2d7a5020c5c0c88824e233242548d3673d7f8a01db11a393b92da3ca

  • SSDEEP

    49152:7REPdRPWz0aXp8YttmYTnPFVpqW3LPDt78wqqRL9q2mhUdot8fsgL6WnWNM:72I0opZfTnPJVPDt78wqqlrm6St8fYWz

Score
5/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NET Reactor v6.9.0.0_fu11\Help\REACTOR_HELP.exe
    "C:\Users\Admin\AppData\Local\Temp\NET Reactor v6.9.0.0_fu11\Help\REACTOR_HELP.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Roaming\Eziriz\.NET Reactor\Help\1_0_0_38\REACTOR_HELP.exe
      "C:\Users\Admin\AppData\Roaming\Eziriz\.NET Reactor\Help\1_0_0_38\REACTOR_HELP.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:56068/help/
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd2f546f8,0x7ffcd2f54708,0x7ffcd2f54718
          4⤵
            PID:2560
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:3572
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
            4⤵
              PID:4788
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
              4⤵
                PID:5096
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
                4⤵
                  PID:4272
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
                  4⤵
                    PID:1432
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
                    4⤵
                      PID:2780
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3760
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
                      4⤵
                        PID:4200
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                        4⤵
                          PID:3796
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
                          4⤵
                            PID:4924
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
                            4⤵
                              PID:3708
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,17277724139095299746,1935878031379788658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3088 /prefetch:2
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:896
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:4844
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:2948

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\REACTOR_HELP.exe.log

                            Filesize

                            226B

                            MD5

                            916851e072fbabc4796d8916c5131092

                            SHA1

                            d48a602229a690c512d5fdaf4c8d77547a88e7a2

                            SHA256

                            7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                            SHA512

                            07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            16c2a9f4b2e1386aab0e353614a63f0d

                            SHA1

                            6edd3be593b653857e579cbd3db7aa7e1df3e30f

                            SHA256

                            0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

                            SHA512

                            aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            96B

                            MD5

                            6559331e278dfaadeca8b5ce6885f8a3

                            SHA1

                            fc544c52e3a6dc875d6a75d4ca1a909f990c3756

                            SHA256

                            945c0141c0f20abfa6f4f2f1d476d6aaf5084dab651948fe212d120c1c798aa7

                            SHA512

                            3694cff494f6d23f047caa96ce1a6abd135aec656908888cdb07814502f7f7cf9951b841c1ca6154e86e252d39d244375b0ed437271527a7731414402518f5b6

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                            Filesize

                            111B

                            MD5

                            285252a2f6327d41eab203dc2f402c67

                            SHA1

                            acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                            SHA256

                            5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                            SHA512

                            11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            2a9cff7a9afec30e58dd21e1c06cfd27

                            SHA1

                            0dd83dedd08cd9b790ea2f6f8115072c720496fa

                            SHA256

                            5dcf9f0d3095aec508447fed127d80f23835cb0d1f1cffc46f7e901c236ecdc5

                            SHA512

                            234d02dd63c362bdfe7a33126c35b0a23d0e47fb36839d7490fb494ed7983a2202b79762cba488f865acb93ad0d967563d9ed60ce390d14f49fcdb752fa26679

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            ded78e40bbcd58dd641f86bcca2c0667

                            SHA1

                            30bb01a3e28909aefc143904144ba73318b1ca90

                            SHA256

                            3120a0cd1afc0eb22c6bfdfb4b247a3458d9e90c9570509731cc9c414707408d

                            SHA512

                            95427ae7dd2646d587e2ed3cf3469df563ac0cbcc6cff79eb6e72d99ffc0455cf7dd4010c5f7d3ebd718b7fe223e7bd130822c987763836a39dea05178d261b7

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            9326a57fda75d5c6c62a023260f40da2

                            SHA1

                            53ba9ac11055d5476ea1a239188e7b2cb928bf3e

                            SHA256

                            ad53e85e4f6e44aada1a6dfc9b225c7b658f7330abce08b3124a7ce8adb8cab0

                            SHA512

                            f6d47065b250dde892dbf600c1874e30121561f46392442c9da60ffc54799e5053ec23d83a3b3075f00c398ae244e3d8e2c49b0d482f813db26bccc94a1411df

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                            Filesize

                            24KB

                            MD5

                            699e3636ed7444d9b47772e4446ccfc1

                            SHA1

                            db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

                            SHA256

                            9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

                            SHA512

                            d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            10KB

                            MD5

                            9b32b049bb58cb2b32b507040bc45a4d

                            SHA1

                            7c3f6590ee58743bfd929d55c02958f11079643c

                            SHA256

                            01ae05194da32e0384f66784ae6fdbaa3593af0e28e8b54a36c2e77351b6dd65

                            SHA512

                            a7d84c3a9e7e2aafcb36328719a64c4e72eb6b44d4bfedb4bc8cf9a8213e1408c88facf6838d9db54bc0ec0a0a0ae017b8c19c8e0c0ebb5108825e751dae4a68

                          • C:\Users\Admin\AppData\Roaming\Eziriz\.NET Reactor\Help\1_0_0_38\REACTOR_HELP.exe

                            Filesize

                            2.6MB

                            MD5

                            db1c91c8d1d7573371cac6a51bf3a1b9

                            SHA1

                            291fe96baeeca49fd4271f06b885477de284bf9c

                            SHA256

                            a3f0cebda251dcf4ccb5915d8ead90771f76e0df9fbb35193b74e4687852d473

                            SHA512

                            da066b919316ce98255562c41c4267dd3059695028d8c8b19ed1303a57b909efe0a333bb2d7a5020c5c0c88824e233242548d3673d7f8a01db11a393b92da3ca

                          • C:\Users\Admin\AppData\Roaming\Eziriz\.NET Reactor\Help\1_0_0_38\REACTOR_HELP.exe

                            Filesize

                            2.6MB

                            MD5

                            db1c91c8d1d7573371cac6a51bf3a1b9

                            SHA1

                            291fe96baeeca49fd4271f06b885477de284bf9c

                            SHA256

                            a3f0cebda251dcf4ccb5915d8ead90771f76e0df9fbb35193b74e4687852d473

                            SHA512

                            da066b919316ce98255562c41c4267dd3059695028d8c8b19ed1303a57b909efe0a333bb2d7a5020c5c0c88824e233242548d3673d7f8a01db11a393b92da3ca

                          • C:\Users\Admin\AppData\Roaming\Eziriz\.NET Reactor\Help\1_0_0_38\REACTOR_HELP.exe

                            Filesize

                            2.6MB

                            MD5

                            db1c91c8d1d7573371cac6a51bf3a1b9

                            SHA1

                            291fe96baeeca49fd4271f06b885477de284bf9c

                            SHA256

                            a3f0cebda251dcf4ccb5915d8ead90771f76e0df9fbb35193b74e4687852d473

                            SHA512

                            da066b919316ce98255562c41c4267dd3059695028d8c8b19ed1303a57b909efe0a333bb2d7a5020c5c0c88824e233242548d3673d7f8a01db11a393b92da3ca

                          • memory/2028-15-0x0000000074CC0000-0x0000000075470000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/2028-1-0x0000000000B90000-0x0000000000E32000-memory.dmp

                            Filesize

                            2.6MB

                          • memory/2028-0-0x0000000074CC0000-0x0000000075470000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4824-19-0x00000000029C0000-0x00000000029D2000-memory.dmp

                            Filesize

                            72KB

                          • memory/4824-17-0x0000000004E80000-0x0000000004E90000-memory.dmp

                            Filesize

                            64KB

                          • memory/4824-70-0x0000000074CC0000-0x0000000075470000-memory.dmp

                            Filesize

                            7.7MB

                          • memory/4824-71-0x0000000004E80000-0x0000000004E90000-memory.dmp

                            Filesize

                            64KB

                          • memory/4824-16-0x0000000074CC0000-0x0000000075470000-memory.dmp

                            Filesize

                            7.7MB