Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-05-2021 19:31
Static task
static1
Behavioral task
behavioral1
Sample
boost-fps.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
boost-fps.exe
Resource
win10v20210410
General
-
Target
boost-fps.exe
-
Size
1.3MB
-
MD5
92fc1129af30ba08a79113624f51bcb7
-
SHA1
b68388c46a78d262fcdedbaea09372785fb6786c
-
SHA256
121dec5bd279daf16e683e472949a269bb9751d6ceae4274875e36abe8871946
-
SHA512
3c1b7f326e717e0ed6cc435647598ec37ce0c2b90a942317f8d4b2c2ac8d3bd4f6c94ec86ad5af4ded8bf31a25485590b03549e0cd5e3509308e04e066efc12c
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
csrss.execsrss.exepid process 2660 csrss.exe 3676 csrss.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
boost-fps.execsrss.exedescription pid process target process PID 3968 set thread context of 1540 3968 boost-fps.exe boost-fps.exe PID 2660 set thread context of 3676 2660 csrss.exe csrss.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4028 schtasks.exe 500 schtasks.exe 2620 schtasks.exe 1848 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exeboost-fps.exepid process 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 1540 boost-fps.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 2060 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskmgr.exeboost-fps.execsrss.exedescription pid process Token: SeDebugPrivilege 2060 taskmgr.exe Token: SeSystemProfilePrivilege 2060 taskmgr.exe Token: SeCreateGlobalPrivilege 2060 taskmgr.exe Token: SeDebugPrivilege 1540 boost-fps.exe Token: SeDebugPrivilege 3676 csrss.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid process 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe 2060 taskmgr.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
boost-fps.exeboost-fps.execsrss.exedescription pid process target process PID 3968 wrote to memory of 1540 3968 boost-fps.exe boost-fps.exe PID 3968 wrote to memory of 1540 3968 boost-fps.exe boost-fps.exe PID 3968 wrote to memory of 1540 3968 boost-fps.exe boost-fps.exe PID 3968 wrote to memory of 1540 3968 boost-fps.exe boost-fps.exe PID 3968 wrote to memory of 1540 3968 boost-fps.exe boost-fps.exe PID 3968 wrote to memory of 1540 3968 boost-fps.exe boost-fps.exe PID 3968 wrote to memory of 1540 3968 boost-fps.exe boost-fps.exe PID 3968 wrote to memory of 1540 3968 boost-fps.exe boost-fps.exe PID 1540 wrote to memory of 4028 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 4028 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 4028 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 500 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 500 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 500 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 2620 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 2620 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 2620 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 1848 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 1848 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 1848 1540 boost-fps.exe schtasks.exe PID 1540 wrote to memory of 2660 1540 boost-fps.exe csrss.exe PID 1540 wrote to memory of 2660 1540 boost-fps.exe csrss.exe PID 1540 wrote to memory of 2660 1540 boost-fps.exe csrss.exe PID 2660 wrote to memory of 3676 2660 csrss.exe csrss.exe PID 2660 wrote to memory of 3676 2660 csrss.exe csrss.exe PID 2660 wrote to memory of 3676 2660 csrss.exe csrss.exe PID 2660 wrote to memory of 3676 2660 csrss.exe csrss.exe PID 2660 wrote to memory of 3676 2660 csrss.exe csrss.exe PID 2660 wrote to memory of 3676 2660 csrss.exe csrss.exe PID 2660 wrote to memory of 3676 2660 csrss.exe csrss.exe PID 2660 wrote to memory of 3676 2660 csrss.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\boost-fps.exe"C:\Users\Admin\AppData\Local\Temp\boost-fps.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\boost-fps.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "boost-fps" /sc ONLOGON /tr "'C:\Boot\fr-CA\boost-fps.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\Documents and Settings\csrss.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\fontdrvhost.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "csrss" /sc ONLOGON /tr "'C:\ProgramData\Application Data\csrss.exe'" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\ProgramData\Application Data\csrss.exe"C:\ProgramData\Application Data\csrss.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Application Data\csrss.exe"{path}"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Application Data\csrss.exeMD5
92fc1129af30ba08a79113624f51bcb7
SHA1b68388c46a78d262fcdedbaea09372785fb6786c
SHA256121dec5bd279daf16e683e472949a269bb9751d6ceae4274875e36abe8871946
SHA5123c1b7f326e717e0ed6cc435647598ec37ce0c2b90a942317f8d4b2c2ac8d3bd4f6c94ec86ad5af4ded8bf31a25485590b03549e0cd5e3509308e04e066efc12c
-
C:\ProgramData\csrss.exeMD5
92fc1129af30ba08a79113624f51bcb7
SHA1b68388c46a78d262fcdedbaea09372785fb6786c
SHA256121dec5bd279daf16e683e472949a269bb9751d6ceae4274875e36abe8871946
SHA5123c1b7f326e717e0ed6cc435647598ec37ce0c2b90a942317f8d4b2c2ac8d3bd4f6c94ec86ad5af4ded8bf31a25485590b03549e0cd5e3509308e04e066efc12c
-
C:\ProgramData\csrss.exeMD5
92fc1129af30ba08a79113624f51bcb7
SHA1b68388c46a78d262fcdedbaea09372785fb6786c
SHA256121dec5bd279daf16e683e472949a269bb9751d6ceae4274875e36abe8871946
SHA5123c1b7f326e717e0ed6cc435647598ec37ce0c2b90a942317f8d4b2c2ac8d3bd4f6c94ec86ad5af4ded8bf31a25485590b03549e0cd5e3509308e04e066efc12c
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\boost-fps.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\csrss.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/500-134-0x0000000000000000-mapping.dmp
-
memory/1540-130-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/1540-131-0x0000000004EB0000-0x00000000053AE000-memory.dmpFilesize
5.0MB
-
memory/1540-124-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1540-125-0x0000000000465BEE-mapping.dmp
-
memory/1848-136-0x0000000000000000-mapping.dmp
-
memory/2620-135-0x0000000000000000-mapping.dmp
-
memory/2660-137-0x0000000000000000-mapping.dmp
-
memory/2660-147-0x0000000005E00000-0x00000000062FE000-memory.dmpFilesize
5.0MB
-
memory/3676-158-0x0000000005500000-0x00000000059FE000-memory.dmpFilesize
5.0MB
-
memory/3676-151-0x0000000000465BEE-mapping.dmp
-
memory/3968-121-0x0000000005770000-0x0000000005775000-memory.dmpFilesize
20KB
-
memory/3968-120-0x0000000008A10000-0x0000000008A11000-memory.dmpFilesize
4KB
-
memory/3968-114-0x0000000000A70000-0x0000000000A71000-memory.dmpFilesize
4KB
-
memory/3968-119-0x00000000053A0000-0x000000000589E000-memory.dmpFilesize
5.0MB
-
memory/3968-118-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/3968-123-0x000000000B460000-0x000000000B4D6000-memory.dmpFilesize
472KB
-
memory/3968-122-0x0000000008DD0000-0x0000000008E6C000-memory.dmpFilesize
624KB
-
memory/3968-117-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/3968-116-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/4028-133-0x0000000000000000-mapping.dmp