Analysis
-
max time kernel
69s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
27/03/2022, 07:19
Static task
static1
Behavioral task
behavioral1
Sample
cpcrs.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cpcrs.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
csrss.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
csrss.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
cpcrs.exe
-
Size
419KB
-
MD5
7d20fa01a703afa8907e50417d27b0a4
-
SHA1
320116162d78afb8e00fd972591479a899d3dfee
-
SHA256
3b2e708eaa4744c76a633391cf2c983f4a098b46436525619e5ea44e105355fe
-
SHA512
0dcebe2598e6ccb51f0609831c93071421049eb924f83871e95c5a280af0d2e76630dfc47c5a2780eb18d55ee9690d6c83aabd8f1043cc2cdc21d9fe5425b892
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\wgvgs5cbvzaobg.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\afd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\tcpip.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\IPMIDRV.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\UMDF\es-ES\UsbccidDriver.dll.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\iaLPSS2i_I2C_GLK.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\i8042prt.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\ndiscap.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\bthmodem.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\dmvsc.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\partmgr.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\dumpsd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\smbdirect.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\winnat.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\ndiscap.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\smbdirect.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\synth3dvsc.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\UMDF\it-IT\UsbccidDriver.dll.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\atapi.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\ndiscap.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\disk.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\spaceport.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\ndis.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\volsnap.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\cdrom.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\lsi_sas3i.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\volmgrx.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\dumpsd.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\mssmbios.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\bthenum.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\modem.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\processr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\netbt.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\vhdmp.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\refs.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\adp80xx.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\msgpiowin32.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\PktMon.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\es-ES\pdc.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\usbhub.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ipt.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\mpsdrv.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\tdi.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\fltmgr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\isapnp.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\rdpdr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\evbda.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\percsas3i.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\SpatialGraphFilter.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\mouhid.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\storqosflt.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\pmem.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fvevol.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\mspclock.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\IPMIDRV.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\de-DE\winnat.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\UMDF\it-IT\idtsec.dll.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\en-US\ws2ifsl.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\hidbth.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\fr-FR\pmem.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\it-IT\partmgr.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\ja-JP\vhdmp.sys.mui cpcrs.exe File opened for modification C:\Windows\system32\drivers\lsi_sas.sys cpcrs.exe File opened for modification C:\Windows\system32\drivers\Vid.sys cpcrs.exe -
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\RequestUnpublish.tiff cpcrs.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\ProgramData\Start Menu\Programs\Accessibility\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Downloads\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Administrative Tools\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\System Tools\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Pictures\Camera Roll\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\StartUp\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\History\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Links\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\SendTo\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Desktop\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\SendTo\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Accessories\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\System Tools\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Pictures\Saved Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini cpcrs.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1346565761-3498240568-4147300184-1000\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Pictures\Saved Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Music\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\My Documents\My Videos\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Searches\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini cpcrs.exe File opened for modification C:\ProgramData\Start Menu\Programs\Windows PowerShell\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Documents\My Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini cpcrs.exe File opened for modification C:\Users\Public\Pictures\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini cpcrs.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini cpcrs.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini cpcrs.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum cpcrs.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtc259d85b#\3edee8dff35bc9d4cb38e892ca0bf3a0\System.Runtime.WindowsRuntime.UI.Xaml.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\setupact.log cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P047767ce#\07760e3f77c2cd8ca7cfce131f86da95\Microsoft.PowerShell.Core.Activities.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\c4a96325490751c8606894bbe3306589\PresentationCore.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W0bb5dac4#\e340d15b0577ba6f1e950be4a75c873a\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Microsoft.Ink.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\AuditPolicy42d3d2cc#\00194bf840ef92b2565b539f29704dc8\AuditPolicyGPManagedStubs.Interop.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Pefb7a36b#\35e71ddd80b7908e1a8311173ffd6ff1\Microsoft.PowerShell.Workflow.ServiceCore.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.I0cd65b90#\0c671454f3bec22322ca78eade5d677c\Microsoft.Isam.Esent.Interop.Wsa.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\bfdaea28d1c61b8d6ebb102bbf468c49\Microsoft.ManagementConsole.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W708fc392#\09b91f03d16fc39bc49c0ed85b6903a2\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\twain_32.dll cpcrs.exe File opened for modification C:\Windows\apppatch\drvmain.sdb cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S356e1ba0#\d0d5ef42c0e8cf225d6f02493cafd965\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.ni.dll cpcrs.exe File opened for modification C:\Windows\winhlp32.exe cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_es_31bf3856ad364e35\MMCEx.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P34f388c1#\e973d5bd29c030458489be8e83909001\Microsoft.PowerShell.Diagnostics.Activities.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.PowerPoint.config cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\20b221b2aa56b5604f519dcf81704999\System.Xml.Linq.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Kd58820a5#\c5fa38bfe4dcc7609a932de565e0902d\Microsoft.KeyDistributionService.Cmdlets.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_de_31bf3856ad364e35\Microsoft.WSMan.Management.resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.config cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\285f79ebfbbdb039fc9607065b17587f\Microsoft.GroupPolicy.AdmTmplEditor.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\Microsoft.ManagementConsole.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\15.0.0.0__71e9bce111e9429c\Policy.11.0.office.config cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W69ef49d2#\69042cc33a9bcc563ab9ff90a7276b2c\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Graph\15.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Graph.config cpcrs.exe File opened for modification C:\Windows\explorer.exe cpcrs.exe File opened for modification C:\Windows\appcompat\Programs\Amcache.hve cpcrs.exe File opened for modification C:\Windows\apppatch\de-DE\AcRes.dll.mui cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.C26a36d2b#\cc60c54c3dde798a43317ec502c0ca47\Microsoft.CertificateServices.PKIClient.Cmdlets.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Runtime\1.0.0.0__31bf3856ad364e35\Microsoft.WSMan.Runtime.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\MMCEx.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Excel.config cpcrs.exe File opened for modification C:\Windows\WMSysPr9.prx cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\TaskScheduler\980fa3ed3ab5c8682ba89accfb74e0c7\TaskScheduler.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.WSMan.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\Microsoft.WSMan.Management.resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.14.0.office\15.0.0.0__71e9bce111e9429c\Policy.14.0.Office.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Mff1be75b#\4364afb08a160ec916d9ec14a6f5b435\Microsoft.ManagementConsole.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\0ab6364a0211b746d41492b243bdfdfb\Microsoft.PowerShell.Commands.Diagnostics.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_es_31bf3856ad364e35\Microsoft.Ink.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_fr_31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.14.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\Policy.14.0.Microsoft.Office.Interop.Excel.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Mff1be75b#\bfdaea28d1c61b8d6ebb102bbf468c49\Microsoft.ManagementConsole.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.S0f8e494c#\f265296f3cbf5114818388ec01d3f658\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\SrpUxSnapIn\f615f628433cab34a98f99334931a2a3\SrpUxSnapIn.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ab4e1169d06499b26dcd454f8e05b3a6\System.Configuration.ni.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_en_31bf3856ad364e35\Microsoft.ManagementConsole.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.Office.Tools.Common.v9.0.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_es_31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.Resources.dll cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ic1a2041b#\c15be34a937f1a0f06596ffb8e106ea0\Microsoft.Isam.Esent.Interop.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\33ddd1d414c8f8d6deceff1a62363c2e\mscorlib.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\8335c7a6cac9c2a3a77da9f4a1817282\System.Runtime.Serialization.ni.dll.aux cpcrs.exe File opened for modification C:\Windows\regedit.exe cpcrs.exe File opened for modification C:\Windows\apppatch\AcRes.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\office\15.0.0.0__71e9bce111e9429c\OFFICE.DLL cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll cpcrs.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\15.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Excel.config cpcrs.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2124 3988 WerFault.exe 88 -
Checks SCSI registry key(s) 3 TTPs 31 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK cpcrs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters cpcrs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 cpcrs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM cpcrs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK cpcrs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 cpcrs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 cpcrs.exe Set key security \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cpcrs.exe Key security queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Device Parameters cpcrs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties cpcrs.exe -
Modifies Control Panel 60 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000011 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\5 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\Keyboard Response cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\MouseKeys cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000104 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\User Profile System Backup\en-US cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\2 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\User Profile System Backup cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\ShowSounds cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Appearance cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Cursors cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000010 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\AudioDescription cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\SoundSentry cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000071 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Mouse cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\SlateLaunch cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\StickyKeys cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\ToggleKeys cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Bluetooth cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Colors cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000200 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\1 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\On cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Sound cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\HighContrast cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Bluetooth\FileSquirtInstalled cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000202 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Quick Actions\Pinned cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\TimeOut cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Appearance\Schemes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\Colors cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\3 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Quick Actions cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000070 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000072 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\User Profile cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\GlobalPowerPolicy cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\0 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000012 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\User Profile\en-US cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\Blind Access cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Appearance\New Schemes cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\MuiCached cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Keyboard cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\PowerCfg\PowerPolicies\4 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000203 cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Personalization\Desktop Slideshow cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Personalization cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility\Keyboard Preference cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Accessibility cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Desktop\WindowMetrics cpcrs.exe Key deleted \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\Input Method\Hot Keys\00000201 cpcrs.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Appearance\Schemes cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000072 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile System Backup\en-US cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Keyboard cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Mouse cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace475a1c57b\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace492361004 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\StickyKeys cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4a450ec0e cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4c5ed6b63\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.People_10.1902.633.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace471abffd4\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000070 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\SoundSentry cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000201 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4d7e93ff7\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\HighContrast cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4f533928b\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4f533928b cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Appearance cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Printers\ConvertUserDevModesCount cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000203 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Blind Access cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WindowMetrics cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000202 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\International cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Console cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\ToggleKeys cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000010 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000104 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\EUDC\932 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Response cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4dcd9f954 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000012 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Environment cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4ed148f50 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4e9324c5f cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Input Method\Hot Keys\00000011 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace492361004\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4c5ed6b63 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4dcd9f954\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.People_10.1902.633.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace471abffd4 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\EUDC\949 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\EUDC\936 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe%5Cresources.pri cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Preference cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Keyboard Layout cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4a450ec0e\a37dfe62 cpcrs.exe Key deleted \REGISTRY\USER\.DEFAULT\Control Panel\International\Geo cpcrs.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3796 cpcrs.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3796 cpcrs.exe Token: SeBackupPrivilege 3796 cpcrs.exe Token: SeRestorePrivilege 3796 cpcrs.exe Token: SeShutdownPrivilege 3796 cpcrs.exe Token: SeDebugPrivilege 3796 cpcrs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cpcrs.exe"C:\Users\Admin\AppData\Local\Temp\cpcrs.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Maps connected drives based on registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3796
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 440 -p 3988 -ip 39881⤵PID:2888
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3988 -s 18041⤵
- Program crash
PID:2124