Analysis
- max time kernel
150s - max time network
155s - platform
windows10_x64 - resource
win10 - submitted
26/10/2020, 20:15
Static task
static1
Behavioral task
behavioral1
Sample
5fihkJ86.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5fihkJ86.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 5fihkJ86.exe
- Size 32KB
- Sample201026-ysfk6yeffe
- SHA256 a8f7563c99b15e437837d480481906ddd026bb63e1c25bb61edd9cb20d72a413
- MD5 ef1c6b90282b53ee6348590de2d30730
- SHA1 4018514b8ee5edb6a855d5ce6cd1d5b7870c2c15
- SHA512 c7b50df2aeab65d18221cf5eda7aec4e37adea72b69cd331e0a18eb29e08e33f35bb72966ae34eb0b0a6456c0197d53d1cd26f7274e144e4db6209d51ecc3b58
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4176 csrss.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1c3b640b5abb4b39436864ddec0d801.exe csrss.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\a1c3b640b5abb4b39436864ddec0d801.exe csrss.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\a1c3b640b5abb4b39436864ddec0d801 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe\" .." csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\a1c3b640b5abb4b39436864ddec0d801 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe\" .." csrss.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe Token: 33 4176 csrss.exe Token: SeIncBasePriorityPrivilege 4176 csrss.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4756 wrote to memory of 4176 4756 5fihkJ86.exe 77 PID 4756 wrote to memory of 4176 4756 5fihkJ86.exe 77 PID 4756 wrote to memory of 4176 4756 5fihkJ86.exe 77 PID 4176 wrote to memory of 772 4176 csrss.exe 78 PID 4176 wrote to memory of 772 4176 csrss.exe 78 PID 4176 wrote to memory of 772 4176 csrss.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fihkJ86.exe"C:\Users\Admin\AppData\Local\Temp\5fihkJ86.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\csrss.exe"C:\Users\Admin\AppData\Local\Temp\csrss.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\csrss.exe" "csrss.exe" ENABLE3⤵PID:772
-
-