Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

19/04/2024, 14:52

240419-r82wmafb32 10

19/04/2024, 14:48

240419-r6mnxsfa59 10

Analysis

  • max time kernel
    147s
  • max time network
    157s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/04/2024, 14:52

General

  • Target

    dotNET_Reactor/Help/REACTOR_HELP.exe

  • Size

    2.6MB

  • MD5

    db1c91c8d1d7573371cac6a51bf3a1b9

  • SHA1

    291fe96baeeca49fd4271f06b885477de284bf9c

  • SHA256

    a3f0cebda251dcf4ccb5915d8ead90771f76e0df9fbb35193b74e4687852d473

  • SHA512

    da066b919316ce98255562c41c4267dd3059695028d8c8b19ed1303a57b909efe0a333bb2d7a5020c5c0c88824e233242548d3673d7f8a01db11a393b92da3ca

  • SSDEEP

    49152:7REPdRPWz0aXp8YttmYTnPFVpqW3LPDt78wqqRL9q2mhUdot8fsgL6WnWNM:72I0opZfTnPJVPDt78wqqlrm6St8fYWz

Score
4/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dotNET_Reactor\Help\REACTOR_HELP.exe
    "C:\Users\Admin\AppData\Local\Temp\dotNET_Reactor\Help\REACTOR_HELP.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Users\Admin\AppData\Roaming\Eziriz\.NET Reactor\Help\1_0_0_38\REACTOR_HELP.exe
      "C:\Users\Admin\AppData\Roaming\Eziriz\.NET Reactor\Help\1_0_0_38\REACTOR_HELP.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4452
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:61196/help/
        3⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:340
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc9eed3cb8,0x7ffc9eed3cc8,0x7ffc9eed3cd8
          4⤵
            PID:2892
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
            4⤵
              PID:3208
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
              4⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:3776
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2616 /prefetch:8
              4⤵
                PID:3064
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
                4⤵
                  PID:3112
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
                  4⤵
                    PID:1612
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:8
                    4⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4580
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
                    4⤵
                      PID:3400
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
                      4⤵
                        PID:492
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
                        4⤵
                          PID:1492
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                          4⤵
                            PID:3484
                          • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 /prefetch:8
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4032
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,8381751505670211259,17225132436557766324,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2736 /prefetch:2
                            4⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1484
                    • C:\Windows\System32\CompPkgSrv.exe
                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                      1⤵
                        PID:4168
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:4740

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\REACTOR_HELP.exe.log

                          Filesize

                          226B

                          MD5

                          1294de804ea5400409324a82fdc7ec59

                          SHA1

                          9a39506bc6cadf99c1f2129265b610c69d1518f7

                          SHA256

                          494398ec6108c68573c366c96aae23d35e7f9bdbb440a4aab96e86fcad5871d0

                          SHA512

                          033905cc5b4d0c0ffab2138da47e3223765146fa751c9f84b199284b653a04874c32a23aae577d2e06ce6c6b34fec62331b5fc928e3baf68dc53263ecdfa10c1

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                          Filesize

                          152B

                          MD5

                          21986fa2280bae3957498a58adf62fc2

                          SHA1

                          d01ad69975b7dc46eba6806783450f987fa2b48d

                          SHA256

                          c91d76b0f27ccea28c4f5f872dee6a98f2d37424ef0b5f188af8c6757090cbb5

                          SHA512

                          ae9ba1abe7def7f6924d486a58427f04a02af7dd82aa3a36c1ed527a23ec7897f00b0e30f22529e9599ae2db88e8abc7ba8013b426885aa3c961ee74678455f1

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                          Filesize

                          152B

                          MD5

                          0fcda4fac8ec713700f95299a89bc126

                          SHA1

                          576a818957f882dc0b892a29da15c4bb71b93455

                          SHA256

                          f7a257742d3a6e6edd16ac8c4c4696d4bdf653041868329461444a0973e71430

                          SHA512

                          ab350ca508c412ff860f82d25ac7492afb3baf4a2827249ebc7ec9632ee444f8f0716389f0623afc0756f395cf00d7a90a0f89b360acdf72b1befe34eecb5986

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          96B

                          MD5

                          9f98dec5e50281520ada18b66fb582f0

                          SHA1

                          5272e876a5f0a741efa3049d201b6e0efaab6af5

                          SHA256

                          a3a733e0d0865ffe129639f08f833459d8fca80abafcef3a272dfb3b97cb2e72

                          SHA512

                          176424eb541be50962bddef8390f3ce6a20f3292a9fbdb13a3e967b462c3d81d6f5f3876cb496fee8d9faa47581cd256171504033018b293589cd24c734f5e16

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          b21803a0ac9894cdb1129be1d94a19a8

                          SHA1

                          386e585c6426b8e50c26dd19630d655f48250e10

                          SHA256

                          736efd189f8c01b110296ce56545ab1171ab3de0431ce8a9427bc3ab40f7dbda

                          SHA512

                          72928f7c8cf4a672398eeae6b7d70d1a3373e922a0797cb957e5ef579848914dbdf5d02fe768dfdd39230462d50c93aa5f62091ff559ab88a807f92effaae47b

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          9642349696ce4f3538e5122c9070f5da

                          SHA1

                          c85fb0e6c16a79f6098365b8839b0997cbf1a868

                          SHA256

                          9ad2688d8309fda5cbf23073f175e89e878e57534de3a56e78b02dabc56c52d5

                          SHA512

                          32079defe7e560f22be4a3fd499b11c5a85be686ccf1a9bbf2ca82d65b3236519e727c11390e9b5440702d28b78678ba6c6ec7f047168d9b363a93e00b92f746

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          c57a976b2827014f97e454a5a33fbd21

                          SHA1

                          c5b37475aa89c2f93222668b03f1f9b8ba613658

                          SHA256

                          d9d4ef9671dad48caca0c915b46bf66a96a440f4bdd6f980aa6567de2ad7ff93

                          SHA512

                          cb9ae6bbbe34ec8f6405f5494373fd064e060f1570ccb6c841d9e10f773040617494769e56e909d490060c9d1761ee7be17273d2b0fb9082d89be39823103f77

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                          Filesize

                          16B

                          MD5

                          206702161f94c5cd39fadd03f4014d98

                          SHA1

                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                          SHA256

                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                          SHA512

                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                          Filesize

                          11KB

                          MD5

                          eed3146f756ad713523f564709ac8169

                          SHA1

                          143f0920e0211af9660a251351e67d2ca5b652e7

                          SHA256

                          b1bf98eaa662168a8cbe9b7b8896b5918629c033af0048e4f56cdf3189d6420c

                          SHA512

                          8f9843b8067b6020868ddda5bc06e0ad131504248a145979569651a8cfba056fda777d1efd2fafe9c75153e3e6174b7c5323d53abe1a7b4d7d2861d8de321159

                        • C:\Users\Admin\AppData\Roaming\Eziriz\.NET Reactor\Help\1_0_0_38\REACTOR_HELP.exe

                          Filesize

                          2.6MB

                          MD5

                          db1c91c8d1d7573371cac6a51bf3a1b9

                          SHA1

                          291fe96baeeca49fd4271f06b885477de284bf9c

                          SHA256

                          a3f0cebda251dcf4ccb5915d8ead90771f76e0df9fbb35193b74e4687852d473

                          SHA512

                          da066b919316ce98255562c41c4267dd3059695028d8c8b19ed1303a57b909efe0a333bb2d7a5020c5c0c88824e233242548d3673d7f8a01db11a393b92da3ca

                        • memory/1160-93-0x0000000074CB0000-0x0000000075461000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/1160-0-0x00000000001B0000-0x0000000000452000-memory.dmp

                          Filesize

                          2.6MB

                        • memory/1160-1-0x0000000074CB0000-0x0000000075461000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4452-18-0x00000000052C0000-0x00000000052D0000-memory.dmp

                          Filesize

                          64KB

                        • memory/4452-17-0x00000000052A0000-0x00000000052B2000-memory.dmp

                          Filesize

                          72KB

                        • memory/4452-94-0x0000000074CB0000-0x0000000075461000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4452-15-0x0000000074CB0000-0x0000000075461000-memory.dmp

                          Filesize

                          7.7MB

                        • memory/4452-100-0x00000000052C0000-0x00000000052D0000-memory.dmp

                          Filesize

                          64KB