f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab

General

Target

f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
Size

221KB
MD5

e15d8700a8d09296ec064d28d8c6876e
SHA1

679b51d60e6993c269ee04d1c3419be1904740c7
SHA256

f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab
SHA512

c25ee74ec87cd239c9e081a076baca98d8417ff09520ebf57b11d47c91771e2eef6d8f4baf9ddd77c6cf7f5d537437e49e533f7992f666e9906afa42574741d7
SSDEEP

6144:ZAJ9Xg6FQtBClSnDpZM3jItzSiSVo0E9:ZAJJLQtvnVa3ag+

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Deletes itself 1 IoCs

pid	Process
1928	cmd.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 1928	1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
332	csrss.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1276	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
Token: SeDebugPrivilege	1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
Token: SeShutdownPrivilege	1276	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 1276	1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	10
PID 1888 wrote to memory of 332	1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	26
PID 1888 wrote to memory of 1928	1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	28
PID 1888 wrote to memory of 1928	1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	28
PID 1888 wrote to memory of 1928	1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	28
PID 1888 wrote to memory of 1928	1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	28
PID 1888 wrote to memory of 1928	1888	f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe	28
PID 332 wrote to memory of 872	332	csrss.exe	17

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276
- C:\Users\Admin\AppData\Local\Temp\f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe
  "C:\Users\Admin\AppData\Local\Temp\f705939b7ebe5e815d82294e55eff80521bf0f7418b1bb057714fcb7eabe3aab.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:872

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
9ebbfbbac0ac58902607ed24266ffcc5

SHA1
1f048228833eb3ff7b569fe616ee9ebab5a20e9d

SHA256
8fd51471dc761c890d8721db606fc3172d3502f033efcf49098dc737582047cf

SHA512
00dc6ec3e6913df653b2c5ad19f01394489809cde52bc89df824aa51678b6a68e1f54294cf081f6e94ca1c6144f242fa0be369b364c5129dbb9d723df01472bc

Download Submit
\Windows\System32\consrv.dll

Filesize
52KB

MD5
6bf2039986af96d98e08824ac6c383fd

SHA1
0bb6384656a96943cb427baa92446f987219a02e

SHA256
a3e03454ff636f4cdd0a95b856ea9e7857cd3ce0fd2bc6d528ab45781349103f

SHA512
fae378badcd6b45d69705d11fe5feb2d9f93fa444249c13aff9b150359ffdbcfe2b160731e193d3e19b6eef18d2ef01de41549a1c2bbdf59501f901511f9068e

Download Submit
memory/332-70-0x0000000000A90000-0x0000000000AA1000-memory.dmp

Filesize
68KB

Download
memory/872-81-0x00000000002F0000-0x00000000002FB000-memory.dmp

Filesize
44KB

Download
memory/872-83-0x00000000002E0000-0x00000000002E8000-memory.dmp

Filesize
32KB

Download
memory/872-86-0x0000000000300000-0x000000000030B000-memory.dmp

Filesize
44KB

Download
memory/872-85-0x00000000002E0000-0x00000000002E8000-memory.dmp

Filesize
32KB

Download
memory/872-84-0x0000000000300000-0x000000000030B000-memory.dmp

Filesize
44KB

Download
memory/872-73-0x00000000002F0000-0x00000000002FB000-memory.dmp

Filesize
44KB

Download
memory/872-77-0x00000000002F0000-0x00000000002FB000-memory.dmp

Filesize
44KB

Download
memory/1276-61-0x00000000029D0000-0x00000000029D6000-memory.dmp

Filesize
24KB

Download
memory/1276-65-0x00000000029D0000-0x00000000029D6000-memory.dmp

Filesize
24KB

Download
memory/1276-57-0x00000000029D0000-0x00000000029D6000-memory.dmp

Filesize
24KB

Download
memory/1888-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1888-56-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1888-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1888-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1888-67-0x0000000000250000-0x0000000000290000-memory.dmp

Filesize
256KB

Download
memory/1888-66-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing