Analysis
-
max time kernel
4294120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
27/03/2022, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
cpcrs.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cpcrs.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
csrss.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
csrss.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
cpcrs.exe
-
Size
419KB
-
MD5
7d20fa01a703afa8907e50417d27b0a4
-
SHA1
320116162d78afb8e00fd972591479a899d3dfee
-
SHA256
3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe
-
SHA512
0dcebe2598e6ccb51f0609831c93071421049eb924f83871e95c5a280af0d2e76630dfc47c5a2780eb18d55ee9690d6c83aabd8f1043cc2cdc21d9fe5425b892
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\msrpc.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\WdfLdr.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\winhv.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\wd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\sermouse.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\AGP440.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\parport.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\serscan.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\rdvgkmd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\rdpwd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\ndiscap.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\rdbss.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\modem.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\ws2ifsl.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\cdfs.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\UAGP35.SYS.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\reepzcpxkqkelw.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\mouclass.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\ULIAGPKX.SYS.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\mup.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\rdpbus.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\ULIAGPKX.SYS cpcrs.exe File opened for modification C:\Windows\system32\drivers\usb8023.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\asyncmac.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\umbus.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\BrSerId.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\msdsm.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\tcpip.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fileinfo.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\pci.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\cdrom.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\bthport.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\evbda.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\ipnat.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\msiscsi.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\acpi.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\volmgrx.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\ohci1394.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\RNDISMP.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\BrUsbSer.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\RDPREFMP.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\serscan.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\IPMIDrv.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\UAGP35.SYS.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\HdAudio.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\usbhub.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\vsmraid.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\kbdclass.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\srv.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\serial.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\parport.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\adpu320.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\nsiproxy.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\tsusbflt.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\cdrom.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ndistapi.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\stexstor.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\msdsm.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\hdaudbus.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\vhdmp.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\scsiport.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\i8042prt.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ataport.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\hidusb.sys cpcrs.exe -
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SplitRepair.tiff cpcrs.exe File opened for modification C:\Users\Admin\Pictures\WriteUse.tiff cpcrs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\Content.IE5\JV18Q8B8\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Pictures\Sample Pictures\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\Accessibility\Desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Recent\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Videos\Sample Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\GMEWETP4\desktop.ini cpcrs.exe File opened for modification C:\Windows\assembly\Desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Music\Sample Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\Content.IE5\ZVKSVSRO\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Desktop\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JV18Q8B8\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Pictures\Sample Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Links\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Desktop\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\History\History.IE5\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\DL4J84XN\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\VCDJSRLN\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XIWRAWIU\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Games\Desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Videos\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\History\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Searches\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5ZSPI9ZZ\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini cpcrs.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2199625441-3471261906-229485034-1000\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZVKSVSRO\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\SendTo\Desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Music\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Administrative Tools\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Temporary Internet Files\Content.IE5\XIWRAWIU\desktop.ini cpcrs.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum cpcrs.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\big5.nlp cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\naphlpr\6.1.0.0__31bf3856ad364e35\NAPHLPR.DLL cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_de_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.7.Microsoft.Ink.config cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\mcupdate.exe cpcrs.exe File opened for modification C:\Windows\win.ini cpcrs.exe File opened for modification C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini cpcrs.exe File opened for modification C:\Windows\PFRO.log cpcrs.exe File opened for modification C:\Windows\WMSysPr9.prx cpcrs.exe File opened for modification C:\Windows\AppPatch\AcXtrnal.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp cpcrs.exe File opened for modification C:\Windows\AppPatch\msimain.sdb cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\BDATunePIA\6.1.0.0__31bf3856ad364e35\BDATunePIA.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll cpcrs.exe File opened for modification C:\Windows\AppPatch\AppPatch64\acspecfc.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.0.Microsoft.Ink.config cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\Mcx2Dvcs\6.1.0.0__31bf3856ad364e35\Mcx2Dvcs.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_en_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll cpcrs.exe File opened for modification C:\Windows\AppPatch\AppPatch64\apihex64.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Interop.Security.AzRoles\2.0.0.0__31bf3856ad364e35\Microsoft.Interop.Security.AzRoles.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.BusinessData.Administration.Client.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp cpcrs.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\Microsoft.Ink.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.InteropAdapter.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Office.BusinessData\14.0.0.0__71e9bce111e9429c\microsoft.office.businessdata.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.iTV.Media\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.iTV.Media.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.Ink\1.7.2600.2180__31bf3856ad364e35\Microsoft.Ink.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\Policy.1.2.Microsoft.Interop.Security.AzRoles.config cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll cpcrs.exe File opened for modification C:\Windows\explorer.exe cpcrs.exe File opened for modification C:\Windows\write.exe cpcrs.exe File opened for modification C:\Windows\AppPatch\drvmain.sdb cpcrs.exe File opened for modification C:\Windows\AppPatch\AppPatch64\AcLayers.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\Policy.1.2.Microsoft.Interop.Security.AzRoles.config cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\normidna.nlp cpcrs.exe File opened for modification C:\Windows\mib.bin cpcrs.exe File opened for modification C:\Windows\AppPatch\apihex86.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.Ink\1.0.2201.0__31bf3856ad364e35\__AssemblyInfo__.ini cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_es_31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\Policy.1.0.Microsoft.Interop.Security.AzRoles.dll cpcrs.exe File opened for modification C:\Windows\AppCompat\Programs\RecentFileCache.bcf cpcrs.exe File opened for modification C:\Windows\AppPatch\AcSpecfc.dll cpcrs.exe File opened for modification C:\Windows\AppPatch\AppPatch64\AcGenral.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.1.2.Microsoft.Interop.Security.AzRoles\6.1.7600.16385__31bf3856ad364e35\Policy.1.2.Microsoft.Interop.Security.AzRoles.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\AuditPolicyGPManagedStubs.Interop\6.1.0.0__31bf3856ad364e35\AuditPolicyGPManagedStubs.Interop.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\Policy.6.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.6.0.Microsoft.Ink.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\6.1.0.0__31bf3856ad364e35\Microsoft.GroupPolicy.AdmTmplEditor.dll cpcrs.exe -
Modifies Control Panel 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\0\Sizes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility\Keyboard Response cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\3\Sizes\0 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Mouse cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\2\Sizes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000070 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\International\Geo cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\PowerCfg\GlobalPowerPolicy cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility\Blind Access cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility\SoundSentry cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\3\Sizes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000072 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\PowerCfg\PowerPolicies cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility\HighContrast cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\3 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\4\Sizes\0 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Desktop\LanguageConfiguration cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\PowerCfg\PowerPolicies\1 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\Schemes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\International cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Keyboard cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\1 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Desktop\WindowMetrics cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Desktop cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000201 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\PowerCfg\PowerPolicies\0 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Infrared cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\PowerCfg\PowerPolicies\3 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Sound cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Desktop\Colors cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000202 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Personalization cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\PowerCfg\PowerPolicies\2 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\PowerCfg\PowerPolicies\4 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\PowerCfg cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility\AudioDescription cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility\Keyboard Preference cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\0\Sizes\0 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Infrared\IrTranP cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000012 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Desktop\MuiCached cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000010 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000104 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility\On cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility\ShowSounds cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility\TimeOut cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\1\Sizes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\2 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Cursors cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Infrared\File Transfer cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000071 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000203 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Personalization\Desktop Slideshow cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000011 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Input Method\Hot Keys\00000200 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Accessibility\ToggleKeys cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\0 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\4\Sizes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-2199625441-3471261906-229485034-1000\Control Panel\Appearance\New Schemes\4 cpcrs.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\TimeOut cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Cursors cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\SoundSentry cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\StickyKeys cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\ToggleKeys cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\HighContrast cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Preference cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Appearance\Schemes cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Appearance cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Colors cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\MouseKeys cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\ShowSounds cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Blind Access cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Response cpcrs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1304 cpcrs.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1304 cpcrs.exe Token: SeBackupPrivilege 1304 cpcrs.exe Token: SeRestorePrivilege 1304 cpcrs.exe Token: SeShutdownPrivilege 1304 cpcrs.exe Token: SeDebugPrivilege 1304 cpcrs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cpcrs.exe"C:\Users\Admin\AppData\Local\Temp\cpcrs.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Maps connected drives based on registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304