Analysis
- max time kernel
152s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
22/03/2022, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
cpcrs.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cpcrs.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
csrss.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
csrss.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target cpcrs.exe
- Size 419KB
- Sample220322-pfgnwabdgn
- SHA256 3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe
- MD5 7d20fa01a703afa8907e50417d27b0a4
- SHA1 320116162d78afb8e00fd972591479a899d3dfee
- SHA512 0dcebe2598e6ccb51f0609831c93071421049eb924f83871e95c5a280af0d2e76630dfc47c5a2780eb18d55ee9690d6c83aabd8f1043cc2cdc21d9fe5425b892
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\AppvVemgr.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\Synth3dVsc.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\afd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\AppvVfs.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\ksthunk.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\mpsdrv.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\USBSTOR.SYS cpcrs.exe File opened for modification C:\Windows\system32\drivers\volmgrx.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\VerifierExt.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\hidbth.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\ndiscap.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\NdisImPlatform.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\refsv1.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\tsusbhub.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\iaStorV.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\nvdimm.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\volmgrx.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\msgpiowin32.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\raspptp.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\WdiWiFi.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\usbhub.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\wudfpf.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ahcache.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\cht4sx64.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\hidir.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\storport.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\MTConfig.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\pci.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\kbdclass.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\scfilter.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\usbstor.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\fvevol.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\IndirectKmd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\tcpip.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ksecpkg.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\lltdio.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\nsiproxy.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\RfxVmt.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\rteth.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\ufxsynopsys.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\USBHUB3.SYS cpcrs.exe File opened for modification C:\Windows\system32\drivers\dxgmms1.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\MTConfig.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\i8042prt.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\luafv.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\TsUsbGD.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\1394ohci.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\Acx01000.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\amdi2c.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\ItSas35i.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\nvstor.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\rdbss.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\scfilter.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\tunnel.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\pci.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\cdfs.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\HyperVideo.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\ndistapi.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\winhv.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\luafv.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\PEAuth.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\PktMon.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\acpi.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\Dumpstorport.sys cpcrs.exe - Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ConvertToUndo.tiff cpcrs.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\Favorites\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Pictures\Saved Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Desktop\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Libraries\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Pictures\Camera Roll\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Searches\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Recent\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Downloads\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\System Tools\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Maintenance\Desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\SendTo\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini cpcrs.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2403053463-4052593947-3703345493-1000\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\SendTo\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Pictures\Camera Roll\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessibility\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\System Tools\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\StartUp\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Administrative Tools\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\History\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Links\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini cpcrs.exe - Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4584 cpcrs.exe Token: SeBackupPrivilege 4584 cpcrs.exe Token: SeRestorePrivilege 4584 cpcrs.exe Token: SeShutdownPrivilege 4584 cpcrs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cpcrs.exe"C:\Users\Admin\AppData\Local\Temp\cpcrs.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
PID:3256