f44ea5109b380e8bdedc44930b4a7b43df8a5e5c4fb9bb81163e44097c7a78d3

Analysis

max time kernel
122s
max time network
159s
platform
windows7_x64
resource
win7-20220331-en
submitted
05/04/2022, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be27c2351c45b75a4226338bf92a8ff9.exe
Size 1.4MB
Sample220405-tkl7dadbaq
SHA256 f44ea5109b380e8bdedc44930b4a7b43df8a5e5c4fb9bb81163e44097c7a78d3
MD5 be27c2351c45b75a4226338bf92a8ff9
SHA1 aa765268796902e40c31eb2eeefd571c7971a18f
SHA512 a7d3894d76bfb1304f2543a8c814e2f3b887142fe29cb7a482ddf1aa513477afade1e6805ba0779215b991a7552cde54915869283982ed2ec175f493fcb2a1ac
MD5 SHA1 SHA512

Score

10^/10

persistence spyware stealer suricata

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\winlogon.exe\", \"C:\\Users\\Default User\\taskhost.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\winlogon.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\services.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\winlogon.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsass.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\winlogon.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsass.exe\", \"C:\\Documents and Settings\\explorer.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\winlogon.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsass.exe\", \"C:\\Documents and Settings\\explorer.exe\", \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\smss.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\winlogon.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\services.exe\", \"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsass.exe\", \"C:\\Documents and Settings\\explorer.exe\", \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\smss.exe\", \"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\csrss.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\winlogon.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe

Process spawned unexpected child process 28 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	676	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	596	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	436	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	284	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	876	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1816	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1664	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1560	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1528	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1356	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	320	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1072	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1540	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1404	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	744	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	564	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1552	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1060	964	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1844	964	schtasks.exe	28

suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
suricata

Executes dropped EXE 1 IoCs

pid	Process
1504	csrss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\smss.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\csrss.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\winlogon.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default User\\taskhost.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Recovery\\8527ddc2-b14c-11ec-8e62-c6f775f41f63\\services.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\lsass.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Documents and Settings\\explorer.exe\""	be27c2351c45b75a4226338bf92a8ff9.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	ipinfo.io
7	ipinfo.io

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsass.exe	be27c2351c45b75a4226338bf92a8ff9.exe
File created	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\6203df4a6bafc7	be27c2351c45b75a4226338bf92a8ff9.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\csrss.exe	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\RCX677A.tmp	be27c2351c45b75a4226338bf92a8ff9.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\886983d96e3d3e	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCX410F.tmp	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\RCX446A.tmp	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsass.exe	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\RCX641F.tmp	be27c2351c45b75a4226338bf92a8ff9.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\csrss.exe	be27c2351c45b75a4226338bf92a8ff9.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_circlass.inf_31bf3856ad364e35_6.1.7600.16385_none_fd65696e44277672\taskhost.exe	be27c2351c45b75a4226338bf92a8ff9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 28 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
320	schtasks.exe
744	schtasks.exe
1844	schtasks.exe
560	schtasks.exe
1560	schtasks.exe
1540	schtasks.exe
1060	schtasks.exe
1664	schtasks.exe
1700	schtasks.exe
564	schtasks.exe
676	schtasks.exe
596	schtasks.exe
1552	schtasks.exe
284	schtasks.exe
1404	schtasks.exe
1004	schtasks.exe
1816	schtasks.exe
1368	schtasks.exe
1528	schtasks.exe
1744	schtasks.exe
1356	schtasks.exe
1492	schtasks.exe
1116	schtasks.exe
1824	schtasks.exe
436	schtasks.exe
1552	schtasks.exe
876	schtasks.exe
1072	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
1200	be27c2351c45b75a4226338bf92a8ff9.exe
1504	csrss.exe
1504	csrss.exe
1504	csrss.exe
1504	csrss.exe
1504	csrss.exe
1504	csrss.exe
1504	csrss.exe
1504	csrss.exe
1504	csrss.exe
1504	csrss.exe
1504	csrss.exe
1504	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	be27c2351c45b75a4226338bf92a8ff9.exe
Token: SeDebugPrivilege	1504	csrss.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1504	1200	be27c2351c45b75a4226338bf92a8ff9.exe	57
PID 1200 wrote to memory of 1504	1200	be27c2351c45b75a4226338bf92a8ff9.exe	57
PID 1200 wrote to memory of 1504	1200	be27c2351c45b75a4226338bf92a8ff9.exe	57

C:\Users\Admin\AppData\Local\Temp\be27c2351c45b75a4226338bf92a8ff9.exe
"C:\Users\Admin\AppData\Local\Temp\be27c2351c45b75a4226338bf92a8ff9.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\csrss.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "FvMXwinlogon" /sc MINUTE /mo 10 /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hNSNwinlogon" /sc ONLOGON /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AECJwinlogon" /sc ONSTART /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc MINUTE /mo 13 /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "q9dqtaskhost" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "i30utaskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "F0Tktaskhost" /sc ONSTART /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc MINUTE /mo 7 /tr "'C:\Users\Default User\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1816

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "S43uservices" /sc MINUTE /mo 6 /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "NepIservices" /sc ONLOGON /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "39Urservices" /sc ONSTART /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc MINUTE /mo 7 /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cZoKlsass" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "irorlsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "UhVrlsass" /sc ONSTART /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1356

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "W8ZJexplorer" /sc MINUTE /mo 11 /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rWRVexplorer" /sc ONLOGON /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "s6D3explorer" /sc ONSTART /tr "'C:\Documents and Settings\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc MINUTE /mo 5 /tr "'C:\Documents and Settings\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IvBssmss" /sc MINUTE /mo 8 /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Gmxdsmss" /sc ONLOGON /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fgBqsmss" /sc ONSTART /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc MINUTE /mo 6 /tr "'C:\Recovery\8527ddc2-b14c-11ec-8e62-c6f775f41f63\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "b66Wcsrss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "vCpZcsrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sk3Zcsrss" /sc ONSTART /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Winlogon Helper DLL

T1004

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrss.exe

Path C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\csrss.exe
Size 1.4MB
SHA256 0a6454a2a670e365bcbeb0792408c4371400d1e924069c19a9b63e949853d1ee
MD5 9976a68fa511deb853c420e2b32abb13
SHA1 78cd38789784c096cf14c953432c92a7c4913911
SHA512 9200b100ea6524b374f074d2d6d1326141d4d9d7cfa000623b17a0c224f0854ba74251b680c5726456ee32b574d9c48ace629c1ed0903e8ff1a510e1f9293097
SSDEEP 24576:AICiUhm9BTWb+y6N6UlEY4JM75ekAypVTKsYqBrSntP0P:EiBIMVyM75ekAUxzSn2
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Program Files (x86)\Microsoft Visual Studio 8\SDK\csrss.exe
Size 1.4MB
SHA256 0a6454a2a670e365bcbeb0792408c4371400d1e924069c19a9b63e949853d1ee
MD5 9976a68fa511deb853c420e2b32abb13
SHA1 78cd38789784c096cf14c953432c92a7c4913911
SHA512 9200b100ea6524b374f074d2d6d1326141d4d9d7cfa000623b17a0c224f0854ba74251b680c5726456ee32b574d9c48ace629c1ed0903e8ff1a510e1f9293097
SSDEEP 24576:AICiUhm9BTWb+y6N6UlEY4JM75ekAypVTKsYqBrSntP0P:EiBIMVyM75ekAUxzSn2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1200-62-0x0000000000640000-0x000000000064C000-memory.dmp

Download

memory/1200-63-0x0000000000650000-0x0000000000658000-memory.dmp

Download

memory/1200-58-0x00000000003E0000-0x00000000003F0000-memory.dmp

Download

memory/1200-59-0x00000000003F0000-0x0000000000402000-memory.dmp

Download

memory/1200-60-0x0000000000620000-0x0000000000630000-memory.dmp

Download

memory/1200-61-0x0000000000610000-0x0000000000618000-memory.dmp

Download

memory/1200-54-0x0000000000B00000-0x0000000000C70000-memory.dmp

Download

memory/1200-57-0x00000000003D0000-0x00000000003E0000-memory.dmp

Download

memory/1200-64-0x0000000000A00000-0x0000000000A0A000-memory.dmp

Download

memory/1200-65-0x0000000000A10000-0x0000000000A1C000-memory.dmp

Download

memory/1200-55-0x000000001AFB0000-0x000000001AFB2000-memory.dmp

Download

memory/1200-56-0x00000000003B0000-0x00000000003CC000-memory.dmp

Download

memory/1504-69-0x0000000000AC0000-0x0000000000C30000-memory.dmp

Download

memory/1504-70-0x0000000000280000-0x0000000000292000-memory.dmp

Download

memory/1504-71-0x0000000002270000-0x0000000002272000-memory.dmp

Download