darkcomet | ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6

Processes:

ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\csrss.exe"	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

Modify Existing Service

T1031

Processes:

csrss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1"	csrss.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	csrss.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Modify Existing Service
T1031

Processes:

csrss.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" csrss.exe
Windows security bypass 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

csrss.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" csrss.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	csrss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	csrss.exe

Drops file in Drivers directory 1 IoCs

Processes:

ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

Executes dropped EXE 3 IoCs

Processes:

csrss.execsrss.execsrss.exe

pid process

3652 csrss.exe
4984 csrss.exe
3580 csrss.exe

pid	process
3652	csrss.exe
4984	csrss.exe
3580	csrss.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

csrss.execsrss.exeba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exeba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	csrss.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

csrss.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" csrss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	csrss.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

csrss.exeba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	csrss.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SYSTEM = "C:\\Windows\\csrss.exe"	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.execsrss.exe

description	pid	process	target process
PID 1612 set thread context of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 4984 set thread context of 3580	4984	csrss.exe	csrss.exe

Drops file in Windows directory 4 IoCs

Processes:

ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.execsrss.exe

description	ioc	process
File created	C:\Windows\csrss.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
File opened for modification	C:\Windows\csrss.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
File opened for modification	C:\Windows\	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
File opened for modification	C:\Windows\csrss.exe	csrss.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.execsrss.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

csrss.exeba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

Modifies registry class 8 IoCs

Processes:

ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exeba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.execsrss.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InprocServer32	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InprocServer32\ = "%SystemRoot%\\SysWow64\\Speech\\Engines\\SR\\spsrx.dll"	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\InprocServer32\ThreadingModel = "Both"	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\Programmable	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C266174-2C26-6174-2C26-61742C266174}\ = "MsasrUI Class"	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

csrss.exe

pid process

3580 csrss.exe

pid	process
3580	csrss.exe

Suspicious use of AdjustPrivilegeToken 52 IoCs

Processes:

ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exeba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.execsrss.execsrss.exe

description	pid	process
Token: 33	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeIncBasePriorityPrivilege	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeIncreaseQuotaPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeSecurityPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeTakeOwnershipPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeLoadDriverPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeSystemProfilePrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeSystemtimePrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeProfSingleProcessPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeIncBasePriorityPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeCreatePagefilePrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeBackupPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeRestorePrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeShutdownPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeDebugPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeSystemEnvironmentPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeChangeNotifyPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeRemoteShutdownPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeUndockPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeManageVolumePrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeImpersonatePrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: SeCreateGlobalPrivilege	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: 33	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: 34	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: 35	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: 36	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
Token: 33	4984	csrss.exe
Token: SeIncBasePriorityPrivilege	4984	csrss.exe
Token: SeIncreaseQuotaPrivilege	3580	csrss.exe
Token: SeSecurityPrivilege	3580	csrss.exe
Token: SeTakeOwnershipPrivilege	3580	csrss.exe
Token: SeLoadDriverPrivilege	3580	csrss.exe
Token: SeSystemProfilePrivilege	3580	csrss.exe
Token: SeSystemtimePrivilege	3580	csrss.exe
Token: SeProfSingleProcessPrivilege	3580	csrss.exe
Token: SeIncBasePriorityPrivilege	3580	csrss.exe
Token: SeCreatePagefilePrivilege	3580	csrss.exe
Token: SeBackupPrivilege	3580	csrss.exe
Token: SeRestorePrivilege	3580	csrss.exe
Token: SeShutdownPrivilege	3580	csrss.exe
Token: SeDebugPrivilege	3580	csrss.exe
Token: SeSystemEnvironmentPrivilege	3580	csrss.exe
Token: SeChangeNotifyPrivilege	3580	csrss.exe
Token: SeRemoteShutdownPrivilege	3580	csrss.exe
Token: SeUndockPrivilege	3580	csrss.exe
Token: SeManageVolumePrivilege	3580	csrss.exe
Token: SeImpersonatePrivilege	3580	csrss.exe
Token: SeCreateGlobalPrivilege	3580	csrss.exe
Token: 33	3580	csrss.exe
Token: 34	3580	csrss.exe
Token: 35	3580	csrss.exe
Token: 36	3580	csrss.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.execsrss.exe

pid process

1612 ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
4984 csrss.exe

pid	process
1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
4984	csrss.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exeba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exeba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.execsrss.execsrss.exe

description	pid	process	target process
PID 2356 wrote to memory of 1612	2356	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 2356 wrote to memory of 1612	2356	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 2356 wrote to memory of 1612	2356	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 1612 wrote to memory of 3092	1612	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
PID 3092 wrote to memory of 3652	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	csrss.exe
PID 3092 wrote to memory of 3652	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	csrss.exe
PID 3092 wrote to memory of 3652	3092	ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe	csrss.exe
PID 3652 wrote to memory of 4984	3652	csrss.exe	csrss.exe
PID 3652 wrote to memory of 4984	3652	csrss.exe	csrss.exe
PID 3652 wrote to memory of 4984	3652	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe
PID 4984 wrote to memory of 3580	4984	csrss.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
"C:\Users\Admin\AppData\Local\Temp\ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
"C:\Users\Admin\AppData\Local\Temp\ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe"
2⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612

C:\Users\Admin\AppData\Local\Temp\ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
C:\Users\Admin\AppData\Local\Temp\ba8efd1c3b16d2324a24b74decbd3cf18c1c810ccb6b26713c7dbea9586c74b6.exe
3⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092

C:\Windows\csrss.exe
"C:\Windows\csrss.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652

C:\Windows\csrss.exe
"C:\Windows\csrss.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4984

C:\Windows\csrss.exe
C:\Windows\csrss.exe
6⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Checks BIOS information in registry
- Windows security modification
- Adds Run key to start application
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Modify Existing Service

2

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

6

Disabling Security Tools

2

T1089

Credential Access

Discovery

Query Registry

4

System Information Discovery

5