ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4

General

Target

ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
Size

248KB
MD5

453e81cf8fd30e22f5d73ba21f73e21c
SHA1

677d1dad9d914aeefa23d4f0e95d1cb611faa8b2
SHA256

ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4
SHA512

6526e87ae9315280eb2945e2fd97c771f047d76781508911221cf4cec767ff2d5009a2a878e4c8b8c4d8be72e7168f4cf2ade96ca6ee1f5c57ddc7c576db43dd
SSDEEP

6144:w6SEglcg8sX+yFtrqRvV+bslcyn97fG6F4+ECgVuc:JSrlzEyFlqRtUyn9blCYgV

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrss.exe"	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\csrss = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrss.exe"	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\csrss = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrss.exe"	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe

Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

1988 csrss.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1884 netsh.exe

pid	process
1988	csrss.exe

pid	process
1884	netsh.exe

Loads dropped DLL 2 IoCs

Processes:

ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe

pid	process
1900	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
1900	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrss.exe"	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\csrss.exe"	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.execsrss.exe

pid process

1900 ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
1988 csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe

description	pid	process	target process
PID 1900 wrote to memory of 1884	1900	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe	netsh.exe
PID 1900 wrote to memory of 1884	1900	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe	netsh.exe
PID 1900 wrote to memory of 1884	1900	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe	netsh.exe
PID 1900 wrote to memory of 1884	1900	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe	netsh.exe
PID 1900 wrote to memory of 1988	1900	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe	csrss.exe
PID 1900 wrote to memory of 1988	1900	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe	csrss.exe
PID 1900 wrote to memory of 1988	1900	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe	csrss.exe
PID 1900 wrote to memory of 1988	1900	ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
"C:\Users\Admin\AppData\Local\Temp\ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\netsh.exe
  netsh advfirewall firewall add rule name="Nero" dir=in action=allow description="Multimedia suite" program="C:\Users\Admin\AppData\Roaming\Microsoft\csrss.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:1884
- C:\Users\Admin\AppData\Roaming\Microsoft\csrss.exe
  C:\Users\Admin\AppData\Local\Temp\ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\csrss.exe

Filesize
248KB

MD5
453e81cf8fd30e22f5d73ba21f73e21c

SHA1
677d1dad9d914aeefa23d4f0e95d1cb611faa8b2

SHA256
ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4

SHA512
6526e87ae9315280eb2945e2fd97c771f047d76781508911221cf4cec767ff2d5009a2a878e4c8b8c4d8be72e7168f4cf2ade96ca6ee1f5c57ddc7c576db43dd

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\csrss.exe

Filesize
248KB

MD5
453e81cf8fd30e22f5d73ba21f73e21c

SHA1
677d1dad9d914aeefa23d4f0e95d1cb611faa8b2

SHA256
ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4

SHA512
6526e87ae9315280eb2945e2fd97c771f047d76781508911221cf4cec767ff2d5009a2a878e4c8b8c4d8be72e7168f4cf2ade96ca6ee1f5c57ddc7c576db43dd

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\csrss.exe

Filesize
248KB

MD5
453e81cf8fd30e22f5d73ba21f73e21c

SHA1
677d1dad9d914aeefa23d4f0e95d1cb611faa8b2

SHA256
ad955fdc7425dc1f94f780accb5f795ca61170640235a42e460479a7106cf7c4

SHA512
6526e87ae9315280eb2945e2fd97c771f047d76781508911221cf4cec767ff2d5009a2a878e4c8b8c4d8be72e7168f4cf2ade96ca6ee1f5c57ddc7c576db43dd

Download Submit
memory/1884-56-0x0000000000000000-mapping.dmp

Download
memory/1900-57-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1988-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads