d7f19de8eb2461c635c0170448a58a1ec6e6de014b4410883f87d0b5d7868e65

General

Target

CSRSS.Exe
Size

210KB
MD5

67438e8ddb537ef31fd86c5b046e986b
SHA1

0722038e02681bb4f1312b92bd62cd070476f3d6
SHA256

d7f19de8eb2461c635c0170448a58a1ec6e6de014b4410883f87d0b5d7868e65
SHA512

31ba7615a173c84cd59152ed44d707ef81f37bba9d91bc9afb86d89cb6c99f4346cfdce272224f7c3e00f0b23ff930df7cc4285d63fc2185e50669ad8c5c7c39

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

CSRSS.Exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WindowsUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CSRSS.Exe"	CSRSS.Exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	CSRSS.Exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

CSRSS.Exe

description ioc process

File opened (read-only) \??\Z: CSRSS.Exe

description	ioc	process
File opened (read-only)	\??\Z:	CSRSS.Exe

Drops file in Program Files directory 64 IoCs

Processes:

CSRSS.Exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7z.exe.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\en-US\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-ppd.xrm-ms.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ppd.xrm-ms.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\CollectSignatures.aapp.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-ppd.xrm-ms.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\msvcr110.dll.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ff\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1612.10312.0_x64__8wekyb3d8bbwe\Styling\css\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms.charlie.j0hnson	CSRSS.Exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\GameEnd\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointR_Retail-ul-phn.xrm-ms.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\it\msipc.dll.mui.charlie.j0hnson	CSRSS.Exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\CoreEngine\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File created	C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata_2.2.0.v20131211-1531.jar.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Windows Mail\en-US\msoeres.dll.mui.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\packetizer\libpacketizer_mpeg4audio_plugin.dll.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.jdp_5.5.0.165303.jar.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.nl_zh_4.4.0.v20140623020002.jar.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\policytool.exe.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ul-oob.xrm-ms.charlie.j0hnson	CSRSS.Exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\nl\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_record_plugin.dll.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Mock.Tests.ps1.charlie.j0hnson	CSRSS.Exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.lucene.analysis_3.5.0.v20120725-1805.jar.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnssci.dll.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-80.png.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription2-ul-oob.xrm-ms.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ContemporaryPhotoAlbum.potx.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1702.301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File created	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Common\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Retail-ul-oob.xrm-ms.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\TellMeRuntime.dll.charlie.j0hnson	CSRSS.Exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessDemoR_BypassTrial365-ppd.xrm-ms.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\mscss7cm_es.dub.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2017.203.236.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\AdjacencyReport.dotx.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_srt_plugin.dll.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.help_3.6.0.v20130326-1254.jar.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\comments.win32.tpn.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms.charlie.j0hnson	CSRSS.Exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.15.2003.0_x64__8wekyb3d8bbwe\Assets\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\HOW TO RETURN YOU FILES.exe	CSRSS.Exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.resources.dll.charlie.j0hnson	CSRSS.Exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

CSRSS.Exe

description	pid	process
Token: SeBackupPrivilege	496	CSRSS.Exe
Token: SeRestorePrivilege	496	CSRSS.Exe
Token: SeManageVolumePrivilege	496	CSRSS.Exe
Token: SeTakeOwnershipPrivilege	496	CSRSS.Exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

CSRSS.Exe

description	pid	process	target process
PID 496 wrote to memory of 2696	496	CSRSS.Exe	cmd.exe
PID 496 wrote to memory of 2696	496	CSRSS.Exe	cmd.exe
PID 496 wrote to memory of 2696	496	CSRSS.Exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\CSRSS.Exe
"C:\Users\Admin\AppData\Local\Temp\CSRSS.Exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:496

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c @echo off vssadmin delete shadows /all /quiet sc config browser sc config browser start=enabled sc stop vss sc config vss start=disabled sc stop MongoDB sc config MongoDB start=disabled sc stop SQLWriter sc config SQLWriter start=disabled sc stop MSSQLServerOLAPService sc config MSSQLServerOLAPService start=disabled sc stop MSSQLSERVER sc config MSSQLSERVER start=disabled sc stop MSSQL$SQLEXPRESS sc config MSSQL$SQLEXPRESS start=disabled sc stop ReportServer sc config ReportServer start=disabled sc stop OracleServiceORCL sc config OracleServiceORCL start=disabled sc stop OracleDBConsoleorcl sc config OracleDBConsoleorcl start=disabled sc stop OracleMTSRecoveryService sc config OracleMTSRecoveryService start=disabled sc stop OracleVssWriterORCL sc config OracleVssWriterORCL start=disabled sc stop MySQL sc config MySQL start=disabled
2⤵
PID:2696