ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7

General

Target

ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe
Size

184KB
MD5

659c38aad170a7d29a516b807244e840
SHA1

9823512d70156715f56cea96e6bed7790a64c3c1
SHA256

ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7
SHA512

2a368ae2e9df1bacadd1217ebb2e51c091e697f95b76a51ca0e2b29342e9dd35c5c556c8edfcd0e3a3eb0ecc10eb130a51223c36565a0e2b2b7be4ee372bc646
SSDEEP

3072:TnqZlhI3FYvYLGWpujes1mDlMWmJ5reksN6j+VLH+B:TgI30YHUes1Ylchj+VL

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

Deletes itself 1 IoCs

pid	Process
1128	cmd.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1504 set thread context of 1128	1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe
1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe
1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe
1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe
336	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe
Token: SeDebugPrivilege	1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1376	Explorer.EXE
1376	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1376	Explorer.EXE
1376	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1376	1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe	7
PID 1504 wrote to memory of 336	1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe	25
PID 1504 wrote to memory of 1128	1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe	28
PID 1504 wrote to memory of 1128	1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe	28
PID 1504 wrote to memory of 1128	1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe	28
PID 1504 wrote to memory of 1128	1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe	28
PID 1504 wrote to memory of 1128	1504	ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe	28
PID 336 wrote to memory of 872	336	csrss.exe	19

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1376
- C:\Users\Admin\AppData\Local\Temp\ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe
  "C:\Users\Admin\AppData\Local\Temp\ce1e02df0b453f0ffcc26c3bff79898a8305ce9656c344e0ddff7ffeef0727d7.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:872

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
981cb19063f30c6b01e53ccb1ad01987

SHA1
27185d39fadd2e7f6727b452764909c0e89a44d7

SHA256
80c07ed9cc5922b6a5d176c1a45af2b94418598d1f5e1739e1fde4f33d253b8d

SHA512
8a5151437c4a4d60eddbd3f8233e642a8607c3a9bd173c09e982147a79264fd7ef64af2fedda832c942b4a89c3a22fb705fffc5bc072d24c2440199ac811ccb0

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/336-69-0x00000000008B0000-0x00000000008C1000-memory.dmp

Filesize
68KB

Download
memory/872-78-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/872-80-0x00000000008B0000-0x00000000008B8000-memory.dmp

Filesize
32KB

Download
memory/872-83-0x00000000008E0000-0x00000000008EB000-memory.dmp

Filesize
44KB

Download
memory/872-82-0x00000000008B0000-0x00000000008B8000-memory.dmp

Filesize
32KB

Download
memory/872-81-0x00000000008E0000-0x00000000008EB000-memory.dmp

Filesize
44KB

Download
memory/872-70-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/872-74-0x00000000008C0000-0x00000000008CB000-memory.dmp

Filesize
44KB

Download
memory/1376-59-0x0000000002730000-0x0000000002736000-memory.dmp

Filesize
24KB

Download
memory/1376-63-0x0000000002730000-0x0000000002736000-memory.dmp

Filesize
24KB

Download
memory/1376-55-0x0000000002730000-0x0000000002736000-memory.dmp

Filesize
24KB

Download
memory/1504-54-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1504-67-0x0000000000220000-0x0000000000246000-memory.dmp

Filesize
152KB

Download
memory/1504-68-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing