Analysis
-
max time kernel
4294170s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20220310-en -
submitted
22/03/2022, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
cpcrs.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cpcrs.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
csrss.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
csrss.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
cpcrs.exe
-
Size
419KB
-
MD5
7d20fa01a703afa8907e50417d27b0a4
-
SHA1
320116162d78afb8e00fd972591479a899d3dfee
-
SHA256
3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe
-
SHA512
0dcebe2598e6ccb51f0609831c93071421049eb924f83871e95c5a280af0d2e76630dfc47c5a2780eb18d55ee9690d6c83aabd8f1043cc2cdc21d9fe5425b892
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\compbatt.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\bfe.dll.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\BrUsbSer.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\RDPENCDD.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\ipnat.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\processr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\bthpan.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ntfs.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\isapnp.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\parport.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\Dot4usb.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\IPMIDrv.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\msfs.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\vwififlt.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\rdvgkmd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\ULIAGPKX.SYS.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\http.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\ndis.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\bthpan.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\NV_AGP.SYS.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\processr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\parport.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\umbus.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\afd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\vsmraid.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\fltmgr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\pacer.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\kbdhid.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\null.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\GAGP30KX.SYS.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\rdbss.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\RNDISMP.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\ndis.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\wacompen.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\fltmgr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\umbus.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\fvevol.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\fltmgr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\wd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\afd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\scfilter.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\Classpnp.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\NV_AGP.SYS.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\rndismpx.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\Dot4usb.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\tunnel.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\ws2ifsl.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\ndisuio.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\vms3cap.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\mssmbios.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\BrSerIb.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\udfs.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\pacer.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\ws2ifsl.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\vgapnp.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\usbport.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\RNDISMP.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\ipnat.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\mspqm.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\sermouse.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\kbdclass.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\mouclass.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\ntfs.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\modem.sys.mui cpcrs.exe -
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\PopInitialize.tiff cpcrs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\ProgramData\Documents\My Pictures\Sample Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Links\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Recent\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Pictures\Sample Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Videos\Sample Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Downloads\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Desktop\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Administrative Tools\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\318MUB20\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Searches\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\SendTo\Desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\Desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Startup\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\History\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\9Z3MD1WX\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Videos\Sample Videos\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Maintenance\Desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Libraries\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Games\Desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\Content.IE5\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\Accessibility\Desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\9H7KS8W3\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\Content.IE5\9WQZNFH4\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\Content.IE5\X35V0ZKL\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\Content.IE5\YXYDN81Q\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9WQZNFH4\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YXYDN81Q\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Desktop\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Music\Sample Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini cpcrs.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum cpcrs.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.7.Microsoft.Ink.config cpcrs.exe File opened for modification C:\Windows\setupact.log cpcrs.exe File opened for modification C:\Windows\twunk_32.exe cpcrs.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\__AssemblyInfo__.ini cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.InteropAdapter.dll cpcrs.exe File opened for modification C:\Windows\explorer.exe cpcrs.exe File opened for modification C:\Windows\hh.exe cpcrs.exe File opened for modification C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe.config cpcrs.exe File opened for modification C:\Windows\notepad.exe cpcrs.exe File opened for modification C:\Windows\AppPatch\ja-JP\AcRes.dll.mui cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\naphlpr\6.1.0.0__31bf3856ad364e35\NAPHLPR.DLL cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.Ink.config cpcrs.exe File opened for modification C:\Windows\setuperr.log cpcrs.exe File opened for modification C:\Windows\system.ini cpcrs.exe File opened for modification C:\Windows\winhlp32.exe cpcrs.exe File opened for modification C:\Windows\AppPatch\AppPatch64\AcXtrnal.dll cpcrs.exe File opened for modification C:\Windows\AppPatch\it-IT\AcRes.dll.mui cpcrs.exe File opened for modification C:\Windows\twain_32.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Microsoft.Ink.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\bopomofo.nlp cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.0.Microsoft.Ink.config cpcrs.exe File opened for modification C:\Windows\bfsvc.exe cpcrs.exe File opened for modification C:\Windows\AppPatch\apihex86.dll cpcrs.exe File opened for modification C:\Windows\fveupdate.exe cpcrs.exe File opened for modification C:\Windows\Ultimate.xml cpcrs.exe File opened for modification C:\Windows\win.ini cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.Interop\2.0.0.0__31bf3856ad364e35\Microsoft.GroupPolicy.Interop.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.7.Microsoft.Ink.dll cpcrs.exe File opened for modification C:\Windows\write.exe cpcrs.exe File opened for modification C:\Windows\AppPatch\AppPatch64\AcGenral.dll cpcrs.exe File opened for modification C:\Windows\AppPatch\AppPatch64\acspecfc.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\Policy.1.2.Microsoft.Interop.Security.AzRoles.dll cpcrs.exe File opened for modification C:\Windows\msdfmap.ini cpcrs.exe File opened for modification C:\Windows\TSSysprep.log cpcrs.exe File opened for modification C:\Windows\AppPatch\de-DE\AcRes.dll.mui cpcrs.exe File opened for modification C:\Windows\AppPatch\fr-FR\AcRes.dll.mui cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\AuditPolicyGPManagedStubs.Interop.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\Microsoft.Ink.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\xjis.nlp cpcrs.exe File opened for modification C:\Windows\AppPatch\AcSpecfc.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkd.nlp cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.0.Microsoft.Ink.dll cpcrs.exe File opened for modification C:\Windows\splwow64.exe cpcrs.exe File opened for modification C:\Windows\AppPatch\AcLayers.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\Microsoft.Ink.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\MSCOMCTL.DLL cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\BDATunePIA.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll cpcrs.exe File opened for modification C:\Windows\AppPatch\AppPatch64\apihex64.dll cpcrs.exe File opened for modification C:\Windows\AppPatch\es-ES\AcRes.dll.mui cpcrs.exe File opened for modification C:\Windows\assembly\PublisherPolicy.tme cpcrs.exe File opened for modification C:\Windows\assembly\pubpol37.dat cpcrs.exe File opened for modification C:\Windows\assembly\pubpol4.dat cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp cpcrs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 304 cpcrs.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 304 cpcrs.exe Token: SeBackupPrivilege 304 cpcrs.exe Token: SeRestorePrivilege 304 cpcrs.exe Token: SeShutdownPrivilege 304 cpcrs.exe Token: SeDebugPrivilege 304 cpcrs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cpcrs.exe"C:\Users\Admin\AppData\Local\Temp\cpcrs.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Maps connected drives based on registry
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:304