Analysis
-
max time kernel
74s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
22/03/2022, 12:16
Static task
static1
Behavioral task
behavioral1
Sample
cpcrs.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cpcrs.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
csrss.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
csrss.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
cpcrs.exe
-
Size
419KB
-
MD5
7d20fa01a703afa8907e50417d27b0a4
-
SHA1
320116162d78afb8e00fd972591479a899d3dfee
-
SHA256
3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe
-
SHA512
0dcebe2598e6ccb51f0609831c93071421049eb924f83871e95c5a280af0d2e76630dfc47c5a2780eb18d55ee9690d6c83aabd8f1043cc2cdc21d9fe5425b892
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\mrxdav.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\CAD.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\csc.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\EhStorClass.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\nvstor.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\sisraid2.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\rasl2tp.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\srv2.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\buttonconverter.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\UMDF\RdpIdd.dll cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\processr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\bttflt.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\intelide.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\ipfltdrv.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\storqosflt.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\spaceport.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\sermouse.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\pacer.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\luafv.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\tcpip.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\wacompen.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\tdx.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\UcmTcpciCx.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\tsusbhub.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\mssmbios.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\cxwmbclass.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\winnat.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\srv2.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\VerifierExt.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\iaLPSS2i_GPIO2.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\sdbus.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\mup.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\pdc.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\refs.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\UMDF\ja-JP\WUDFUsbccidDriver.dll.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\acpipagr.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\iorate.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\lltdio.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\dmvsc.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\UMDF\SensorsCx.dll cpcrs.exe File opened for modification C:\Windows\system32\drivers\usbhub.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\Microsoft.Bluetooth.AvrcpTransport.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\pci.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\bthenum.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\hidbth.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\battc.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\IPMIDrv.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\vms3cap.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\scfilter.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\CAD.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\amdsata.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\pacer.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\scmbus.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\mslldp.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\hidclass.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\disk.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\pdc.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\WpdUpFltr.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\partmgr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\UMDF\it-IT\Microsoft.Bluetooth.Profiles.HidOverGatt.dll.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\kbldfltr.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\SpatialGraphFilter.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\srv2.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\storufs.sys cpcrs.exe -
Modifies Installed Components in the registry 2 TTPs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\ProgramData\Start Menu\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\SendTo\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Desktop\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Recent\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Downloads\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\StartUp\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Pictures\Camera Roll\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Pictures\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Pictures\Camera Roll\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Pictures\Saved Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Searches\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\History\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Desktop\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Pictures\Saved Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Links\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessibility\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\System Tools\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Windows PowerShell\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Maintenance\Desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Libraries\desktop.ini cpcrs.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum cpcrs.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\apppatch\AcRes.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.PowerPoint.config cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Access.Dao\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Access.Dao.config cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\980fa3ed3ab5c8682ba89accfb74e0c7\TaskScheduler.ni.dll cpcrs.exe File opened for modification C:\Windows\explorer.exe cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.D0ff51f83#\4de3858b9394861311e54b68def9b9f1\Microsoft.Dtc.PowerShell.ni.dll cpcrs.exe File opened for modification C:\Windows\apppatch\sysmain.sdb cpcrs.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Sa56e3556#\28e8136efc0106917929dfc00d97eacd\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_ja_31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\00194bf840ef92b2565b539f29704dc8\AuditPolicyGPManagedStubs.Interop.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P9de5a786#\1caf21ddd9d36b549ff0ac875be2b8b4\Microsoft.PowerShell.Management.Activities.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatioaec034ca#\085cda9eebdee4ba67ebbcfb4dfa8c85\PresentationFramework.Aero2.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\c4a96325490751c8606894bbe3306589\PresentationCore.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\MMCEx.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Excel.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P6f9a5e83#\687a0140ccc03a6ccf55dc3b9cb08148\Microsoft.PowerShell.Security.Activities.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\f265296f3cbf5114818388ec01d3f658\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\980fa3ed3ab5c8682ba89accfb74e0c7\TaskScheduler.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\f11cacda118fe5e85f977a5cbe9b8646\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\winhlp32.exe cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0\10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\Microsoft.WSMan.Management.resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_fr_31bf3856ad364e35\MMCFxCommon.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Word\15.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Word.config cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.A26c32abb#\3a302112bfa45c1f317cff0b8fb156d8\Microsoft.ApplicationId.RuleWizard.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.M870d558a#\d8c6c061391afad5d08eeee96bda9e8f\Microsoft.Management.Infrastructure.Native.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\EventViewer\e7dd774251db1abf49179f2d4e109684\EventViewer.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_es_31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Graph.config cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\System.Management.Automation.Resources\1.0.0.0_ja_31bf3856ad364e35\System.Management.Automation.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\c9081834712b521d8ae96ab1c004cb82\WindowsBase.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pefb7a36b#\35e71ddd80b7908e1a8311173ffd6ff1\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S88747207#\5e073df11da3c6f6db909d22b928cfc9\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\8335c7a6cac9c2a3a77da9f4a1817282\System.Runtime.Serialization.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\appcompat\Programs\Amcache.hve.LOG2 cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\srmlib\1.0.0.0__31bf3856ad364e35\srmlib.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\1.0.0.0_es_31bf3856ad364e35\Microsoft.PowerShell.Commands.Diagnostics.resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_fr_31bf3856ad364e35\MMCEx.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\c22867030e5bfe64cd2f01ea2a121306\Microsoft.PowerShell.Utility.Activities.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf5ac9168#\f11cacda118fe5e85f977a5cbe9b8646\Microsoft.Management.Infrastructure.CimCmdlets.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\38720ac5ef14845a9be0c2386ce0436f\Microsoft.PowerShell.Commands.Utility.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Wed3937f9#\9e1be8aebe4ad662b0eab9d59b87b087\Microsoft.Windows.Diagnosis.SDCommon.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\appcompat\Programs\Amcache.hve.LOG1 cpcrs.exe File opened for modification C:\Windows\apppatch\frxmain.sdb cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_ja_31bf3856ad364e35\Microsoft.ManagementConsole.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_fr_31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_en_31bf3856ad364e35\Microsoft.WSMan.Management.resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\MMCFxCommon.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.D0ff51f83#\43665f9aaca15fa115fc03eb3e946324\Microsoft.Dtc.PowerShell.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P1706cafe#\ba094d32157d7acfed89b01413f8effb\Microsoft.PowerShell.Commands.Diagnostics.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Microsoft.Ink.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.SmartTag.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_es_31bf3856ad364e35\Microsoft.PowerShell.Security.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W79a81d80#\3baadacb9af97508e821559b2b24c448\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\445e1976593e6b3b2072e606af9be0ae\System.Xml.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\d0d5ef42c0e8cf225d6f02493cafd965\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S88747207#\5e073df11da3c6f6db909d22b928cfc9\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.ni.dll.aux cpcrs.exe -
Program crash 3 IoCs
pid pid_target Process procid_target 3016 4624 WerFault.exe 87 2468 3396 WerFault.exe 18 2632 2468 WerFault.exe 133 -
Checks SCSI registry key(s) 3 TTPs 31 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cpcrs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK cpcrs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM cpcrs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cpcrs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters cpcrs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cpcrs.exe -
Modifies Control Panel 60 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\SoundSentry cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\StickyKeys cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000012 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\User Profile cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Mouse cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\5 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\On cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Bluetooth cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000010 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000202 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Quick Actions cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\SlateLaunch cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000203 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\User Profile System Backup cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\AudioDescription cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Bluetooth\FileSquirtInstalled cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Cursors cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\1 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\TimeOut cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Appearance\Schemes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\Keyboard Response cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000011 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Personalization\Desktop Slideshow cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Personalization cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\4 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\ToggleKeys cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Appearance\New Schemes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000200 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\User Profile System Backup\en-US cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\2 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Sound cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\Keyboard Preference cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000070 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000072 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\MouseKeys cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Appearance cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\User Profile\en-US cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\Blind Access cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\HighContrast cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\ShowSounds cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\Colors cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Quick Actions\Pinned cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\WindowMetrics cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Keyboard cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\0 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000104 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\GlobalPowerPolicy cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\3 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\MuiCached cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000201 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Colors cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000071 cpcrs.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IETld\LowMic cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\11 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\35 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Settings cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Setup cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IETld cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\8 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\LinksBar cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\PageSetup cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ms-powerpoint cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Help_Menu_URLs cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\13 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\16 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\17 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ms-word cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\39 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\powerpoint cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\word cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\28 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\37 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\34 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\24 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\cc176cd7_0 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Download cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\36 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\38 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\7 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\DOMStorage cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ms-excel cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\22 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\26 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\3 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Suggested Sites cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Zoom cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\27 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\29 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry cpcrs.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4c5ed6b63\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Cryptography\CertificateTemplateCache cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\AppData\S-1-15-2-536077884-713174666-1066051701-3219990555-339840825-1966734348-1611281757 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Call8 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Default cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call5\.Default cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4d7e93ff7 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace464ee1ce8\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\SecurityBand cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\SystemNotification cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm7\.Current cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000010 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.People_10.1902.633.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AsyncTextService_8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-1346565761-3498240568-4147300184-1000\02sqtnbctcqplble cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Alarm7 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm10 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm3\.Default cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Response cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\EUDC\936 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.People_10.1902.633.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace471abffd4 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-95739096-486727260-2033287795-3853587803-1685597119-444378811-2746676523\Children cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4dcd9f954 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Cryptography cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02zpnophidannvuh cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\WindowsUAC cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CImmersiveControlPanel%5Cresources.pri\1d5acde2d018dbc cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\DeviceFail cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\FaxBeep cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Close\.Current cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\.Current cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.FileExplorer_cw5n1h2txyewy%5Cresources.pri\1d7e53699ece954\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\SlateLaunch cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4cf7b9220\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.creddialoghost_cw5n1h2txyewy%5Cresources.pri\1d5acddee21b7ec cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Maximize cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\EUDC\950 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\Software\Microsoft\Windows cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.SMS\.Default cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Cursors cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace48672e4e2\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.creddialoghost_cw5n1h2txyewy%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{76236E1A-74C6-4CC0-93CB-9D3E85E5138F} cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm8\.Current cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1584 cpcrs.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1584 cpcrs.exe Token: SeBackupPrivilege 1584 cpcrs.exe Token: SeRestorePrivilege 1584 cpcrs.exe Token: SeShutdownPrivilege 1584 cpcrs.exe Token: SeDebugPrivilege 1584 cpcrs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cpcrs.exe"C:\Users\Admin\AppData\Local\Temp\cpcrs.exe"1⤵
- Drops file in Drivers directory
- Drops desktop.ini file(s)
- Maps connected drives based on registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 412 -p 4624 -ip 46241⤵PID:1856
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4624 -s 18681⤵
- Program crash
PID:3016
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 536 -p 3396 -ip 33961⤵PID:1888
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3396 -s 30361⤵
- Program crash
PID:2468 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2468 -s 5442⤵
- Program crash
PID:2632
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 520 -p 2468 -ip 24681⤵PID:4004
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 580 -p 2632 -ip 26321⤵PID:4520