ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976

General

Target

ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe
Size

688KB
MD5

99f7aea316dece629041e7774d3728cc
SHA1

ed8ce50f94bf28e57c4ebb2fe28cb1c5d5fecc9e
SHA256

ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976
SHA512

ed5afa452b845029e723a863c59e34e789f364749fad1fc30733b1a4adf41f454d0a9fa6d42b9bf4b90834e86f140b1f61f03dfd8318f10d7c08cb9864ba81d9
SSDEEP

6144:GTHFHnDMIH9fJWPnSlRtz+RMpepNFMTHFHnDMIH9fJWPnSlRtz+RMpepNF:GRdBWPmSIeDFMRdBWPmSIeDF

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe

Executes dropped EXE 1 IoCs

Processes:

PO_16652.exe

pid process

800 PO_16652.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

4584 netsh.exe

pid	process
800	PO_16652.exe

pid	process
4584	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exePO_16652.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	PO_16652.exe

Adds Run key to start application 2 TTPs 36 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Security Essentials = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrss.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe

description	ioc	process
File created	C:\Windows\assembly\Desktop.ini	ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe

Drops file in Windows directory 3 IoCs

Processes:

ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe
File created	C:\Windows\assembly\Desktop.ini	ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

PO_16652.exe

description pid process

Token: SeDebugPrivilege 800 PO_16652.exe

description	pid	process
Token: SeDebugPrivilege	800	PO_16652.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exePO_16652.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 3488 wrote to memory of 800	3488	ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe	PO_16652.exe
PID 3488 wrote to memory of 800	3488	ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe	PO_16652.exe
PID 3488 wrote to memory of 800	3488	ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe	PO_16652.exe
PID 800 wrote to memory of 4584	800	PO_16652.exe	netsh.exe
PID 800 wrote to memory of 4584	800	PO_16652.exe	netsh.exe
PID 800 wrote to memory of 4584	800	PO_16652.exe	netsh.exe
PID 800 wrote to memory of 4444	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 4444	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 4444	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1996	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1996	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1996	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2664	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2664	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2664	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3068	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3068	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3068	800	PO_16652.exe	cmd.exe
PID 4444 wrote to memory of 4432	4444	cmd.exe	reg.exe
PID 4444 wrote to memory of 4432	4444	cmd.exe	reg.exe
PID 4444 wrote to memory of 4432	4444	cmd.exe	reg.exe
PID 800 wrote to memory of 4532	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 4532	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 4532	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3836	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3836	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3836	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2396	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2396	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2396	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1036	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1036	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1036	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 4656	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 4656	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 4656	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1756	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1756	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1756	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2392	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2392	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2392	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3148	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3148	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3148	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2652	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2652	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 2652	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 560	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 560	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 560	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1828	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1828	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 1828	800	PO_16652.exe	cmd.exe
PID 3068 wrote to memory of 2460	3068	cmd.exe	reg.exe
PID 3068 wrote to memory of 2460	3068	cmd.exe	reg.exe
PID 3068 wrote to memory of 2460	3068	cmd.exe	reg.exe
PID 1996 wrote to memory of 648	1996	cmd.exe	reg.exe
PID 1996 wrote to memory of 648	1996	cmd.exe	reg.exe
PID 1996 wrote to memory of 648	1996	cmd.exe	reg.exe
PID 800 wrote to memory of 3924	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3924	800	PO_16652.exe	cmd.exe
PID 800 wrote to memory of 3924	800	PO_16652.exe	cmd.exe
PID 3836 wrote to memory of 3704	3836	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe
"C:\Users\Admin\AppData\Local\Temp\ccb6ffd78c778b272dd45387bad11dff4507b204c062fceef98d17601e396976.exe"
1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3488

C:\Users\Admin\AppData\Roaming\mpack\PO_16652.exe
"C:\Users\Admin\AppData\Roaming\mpack\PO_16652.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\mpack\PO_16652.exe" "PO_16652.exe" ENABLE
3⤵
- Modifies Windows Firewall
PID:4584

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"C:\Users\Admin\AppData\Local\Temp\csrss.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4444

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"C:\Users\Admin\AppData\Local\Temp\csrss.exe"
4⤵
- Modifies WinLogon for persistence
PID:4432

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:648

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:2664

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:4852

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:2460

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:4532

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:1712

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:3836

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:3704

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:2396

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:1844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:1036

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:1808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:4656

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:2072

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:1756

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:1376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:2392

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:1320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:3148

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:4268

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:2652

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:1328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:560

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:1028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:1828

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:1864

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:3924

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:3092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:972

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:4172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:2244

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:2464

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
3⤵
PID:2360

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Microsoft Security Essentials" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\csrss.exe
4⤵
- Adds Run key to start application
PID:2400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\mpack\PO_16652.exe

Filesize
188KB

MD5
5bac79bd35b79431d6082cb5fda280ed

SHA1
11cf970b8b24aa08fe4e343a355691bbaf9294b7

SHA256
e4195c1581d92a6fe8a0b7626c99387d274b028be563e3816b9544b3f73153f0

SHA512
a525da368d7987a1fd50fe1c4d0f83ad4e12601cfaf4b697086c1ff624b8ef03588a3dcb1bdfb1b7f9f29cb10b521d258793f892b6cd3dccc70b79906f3a0593

Download Submit
C:\Users\Admin\AppData\Roaming\mpack\PO_16652.exe

Filesize
188KB

MD5
5bac79bd35b79431d6082cb5fda280ed

SHA1
11cf970b8b24aa08fe4e343a355691bbaf9294b7

SHA256
e4195c1581d92a6fe8a0b7626c99387d274b028be563e3816b9544b3f73153f0

SHA512
a525da368d7987a1fd50fe1c4d0f83ad4e12601cfaf4b697086c1ff624b8ef03588a3dcb1bdfb1b7f9f29cb10b521d258793f892b6cd3dccc70b79906f3a0593

Download Submit
memory/560-154-0x0000000000000000-mapping.dmp

Download
memory/648-157-0x0000000000000000-mapping.dmp

Download
memory/800-133-0x0000000000000000-mapping.dmp

Download
memory/800-137-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/800-138-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/972-160-0x0000000000000000-mapping.dmp

Download
memory/1028-171-0x0000000000000000-mapping.dmp

Download
memory/1036-148-0x0000000000000000-mapping.dmp

Download
memory/1320-168-0x0000000000000000-mapping.dmp

Download
memory/1328-170-0x0000000000000000-mapping.dmp

Download
memory/1376-167-0x0000000000000000-mapping.dmp

Download
memory/1712-165-0x0000000000000000-mapping.dmp

Download
memory/1756-150-0x0000000000000000-mapping.dmp

Download
memory/1808-169-0x0000000000000000-mapping.dmp

Download
memory/1828-155-0x0000000000000000-mapping.dmp

Download
memory/1844-163-0x0000000000000000-mapping.dmp

Download
memory/1864-172-0x0000000000000000-mapping.dmp

Download
memory/1996-141-0x0000000000000000-mapping.dmp

Download
memory/2072-166-0x0000000000000000-mapping.dmp

Download
memory/2244-161-0x0000000000000000-mapping.dmp

Download
memory/2360-162-0x0000000000000000-mapping.dmp

Download
memory/2392-151-0x0000000000000000-mapping.dmp

Download
memory/2396-147-0x0000000000000000-mapping.dmp

Download
memory/2400-177-0x0000000000000000-mapping.dmp

Download
memory/2460-156-0x0000000000000000-mapping.dmp

Download
memory/2464-174-0x0000000000000000-mapping.dmp

Download
memory/2652-153-0x0000000000000000-mapping.dmp

Download
memory/2664-142-0x0000000000000000-mapping.dmp

Download
memory/3068-143-0x0000000000000000-mapping.dmp

Download
memory/3092-176-0x0000000000000000-mapping.dmp

Download
memory/3148-152-0x0000000000000000-mapping.dmp

Download
memory/3488-136-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3488-132-0x0000000074B50000-0x0000000075101000-memory.dmp

Filesize
5.7MB

Download
memory/3704-159-0x0000000000000000-mapping.dmp

Download
memory/3836-146-0x0000000000000000-mapping.dmp

Download
memory/3924-158-0x0000000000000000-mapping.dmp

Download
memory/4172-175-0x0000000000000000-mapping.dmp

Download
memory/4268-173-0x0000000000000000-mapping.dmp

Download
memory/4432-144-0x0000000000000000-mapping.dmp

Download
memory/4444-140-0x0000000000000000-mapping.dmp

Download
memory/4532-145-0x0000000000000000-mapping.dmp

Download
memory/4584-139-0x0000000000000000-mapping.dmp

Download
memory/4656-149-0x0000000000000000-mapping.dmp

Download
memory/4852-164-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads