3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe
Size

48KB
MD5

ab6a65e2d48d258369327aa19c11d7ff
SHA1

d32bae0b0b65e866cda0a0b803f018e122f87a1a
SHA256

3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f
SHA512

10546faa76512a1ba70b429c998d38535d0fa783ad9997f89f8ddb9683dc75f633aa7b77f98d7bc0d730f3fc425ae292739bd7fb1b981915a896ea35fb75b1ab
SSDEEP

768:tpsPTLQMsj7IU+Ms0LaWeSbTIXMaZ0M+XH4FrQmFntb:tpsrwCSw8W0mF91tb

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\Tasks\\csrss.exe"	3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe

Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

2536 csrss.exe

pid	process
2536	csrss.exe

Drops file in Windows directory 2 IoCs

Processes:

3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe

description	ioc	process
File created	C:\Windows\Tasks\csrss.exe	3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe
File opened for modification	C:\Windows\Tasks\csrss.exe	3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

csrss.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	csrss.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.execsrss.exe

pid	process
1048	3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe
1048	3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe
2536	csrss.exe
2536	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.execsrss.exe

description	pid	process
Token: SeDebugPrivilege	1048	3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe
Token: SeDebugPrivilege	2536	csrss.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe

description	pid	process	target process
PID 1048 wrote to memory of 2536	1048	3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe	csrss.exe
PID 1048 wrote to memory of 2536	1048	3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe	csrss.exe
PID 1048 wrote to memory of 2536	1048	3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe
"C:\Users\Admin\AppData\Local\Temp\3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\Tasks\csrss.exe
C:\Windows\Tasks\csrss.exe
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\csrss.exe

Filesize
48KB

MD5
ab6a65e2d48d258369327aa19c11d7ff

SHA1
d32bae0b0b65e866cda0a0b803f018e122f87a1a

SHA256
3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f

SHA512
10546faa76512a1ba70b429c998d38535d0fa783ad9997f89f8ddb9683dc75f633aa7b77f98d7bc0d730f3fc425ae292739bd7fb1b981915a896ea35fb75b1ab

Download Submit
C:\Windows\Tasks\csrss.exe

Filesize
48KB

MD5
ab6a65e2d48d258369327aa19c11d7ff

SHA1
d32bae0b0b65e866cda0a0b803f018e122f87a1a

SHA256
3d08abda110991aa2e5b8951183fd00c165252a0f0e34e232d6bc81fbb85800f

SHA512
10546faa76512a1ba70b429c998d38535d0fa783ad9997f89f8ddb9683dc75f633aa7b77f98d7bc0d730f3fc425ae292739bd7fb1b981915a896ea35fb75b1ab

Download Submit
memory/2536-132-0x0000000000000000-mapping.dmp

Download