Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 01:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
The Injector lol made with c# ReIn2ct1.zip
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
The Injector lol made with c# ReIn2ct1.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
The Injector lol made with c# ReIn2ct1.zip
-
Size
14.1MB
-
MD5
d0785a1784a9904f6a716618f4e8f878
-
SHA1
df211857a3a310d1762b27b36c78af905636f2a5
-
SHA256
213720c1d351d7ba4796a645e08b086fa309423e519d57dd15ad570f3301661a
-
SHA512
2a50dc542ec9f8bc7006cec3072aa71d643e95afd8eb9b74bb3906571b4d32030d42530ccab17f47c4d115bce78948168f63fb54e2996ecb6b3ae13e29cc3143
-
SSDEEP
393216:6rj5GryEtqLlVh4Jl8G/10GDO40KVQlifi9AfU/jp8bGhsvQJ:6rnVai8Gw6Kfgj8ssvQJ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2692 ReIn2ct.exe -
Loads dropped DLL 2 IoCs
pid Process 2724 7zFM.exe 2528 Process not Found -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe -
Modifies registry class 24 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000102054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 taskmgr.exe Set value (int) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell taskmgr.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 2724 7zFM.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2724 7zFM.exe 1900 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1900 taskmgr.exe Token: SeRestorePrivilege 2724 7zFM.exe Token: 35 2724 7zFM.exe Token: SeSecurityPrivilege 2724 7zFM.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 2724 7zFM.exe 1900 taskmgr.exe 1900 taskmgr.exe 2724 7zFM.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe 1900 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2692 2724 7zFM.exe 34 PID 2724 wrote to memory of 2692 2724 7zFM.exe 34 PID 2724 wrote to memory of 2692 2724 7zFM.exe 34
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\The Injector lol made with c# ReIn2ct1.zip"1⤵PID:2520
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1900
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\The Injector lol made with c# ReIn2ct1.zip"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\7zO4AAD55D7\ReIn2ct.exe"C:\Users\Admin\AppData\Local\Temp\7zO4AAD55D7\ReIn2ct.exe"2⤵
- Executes dropped EXE
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD5d84aaca1a705738bb6793fadf35487f5
SHA12fec4ba481036efbbdf5eeaeab27eeef689e795f
SHA2565264694a8c8dc7f2366f89c8b29fd7bd876fb7761dd81dffb8d640ec1fed599f
SHA512599c3bb7a635814b8cb2647360abe942cbf83e25a25c129c229ac836481eb49ba1185fbe3e0ae3f1282e97ccc593aa79a93c08e299c189d9062594b7c3c757ff