9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae

General

Target

9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
Size

205KB
MD5

9ae84c18aa3f350abe35df0df689f90f
SHA1

bd4030a998756c67c30443352c12d447a08f8c28
SHA256

9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae
SHA512

3909492b061ebaf7837db8a90b0a45ada8b77c94cebda02863a6deb491447145cbb5a1433d5ae8e25896816eff8640a2440ba341c2177ffc93f3c172f730f98c
SSDEEP

6144:LituWxVQlS8ad21jHsDtasJW1aG43SO62dSG:LiouelS8ad21jm443tuG

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
332	csrss.exe

Deletes itself 1 IoCs

pid	Process
1396	cmd.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1396	1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
332	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
Token: SeDebugPrivilege	1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1264	Explorer.EXE
1264	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1264	1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	15
PID 1976 wrote to memory of 332	1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	6
PID 1976 wrote to memory of 1396	1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	28
PID 1976 wrote to memory of 1396	1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	28
PID 1976 wrote to memory of 1396	1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	28
PID 1976 wrote to memory of 1396	1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	28
PID 1976 wrote to memory of 1396	1976	9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe	28
PID 332 wrote to memory of 884	332	csrss.exe	20

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1264
- C:\Users\Admin\AppData\Local\Temp\9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe
  "C:\Users\Admin\AppData\Local\Temp\9469ea30a0d1037882e275368a1a3f8330bf01f7b85a3065107c2cded1b708ae.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\consrv.dll

Filesize
53KB

MD5
d1c9e07123216e8836e7988794cd3c75

SHA1
a1061c34544c9377449e186074404e0dd1009994

SHA256
334bd46d5f3ba098c11827982715c0ff98e2aa1c2361b9702b222949e7e5730c

SHA512
06014da3030fa66fbf64f9dd0c9c229390c93dedcb2c6f53aff810a7d0054c05c514804ea9dbae3d6ec1f13b45b4dd844a7e1ec1706e5a7ae16be8e8a760898b

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
f993c3d2d85d219d14cc9c1a44e373e2

SHA1
61901a08a45e20e97eab37184d33b76daf3da669

SHA256
411910e8e8052bc2ae55c76b6b2391d1bd9b8345f37ae9a14863f50cf93d1d3e

SHA512
a365424cebc03828fcd30a3d65e30abfea1eb9c4d5e0a1e38ca3b3954b5d174c12a15e8764b6286d206919f7c649c3fdbf133ecd3fbb762def9c2bd2148ed2c0

Download Submit
\Windows\System32\consrv.dll

Filesize
53KB

MD5
d1c9e07123216e8836e7988794cd3c75

SHA1
a1061c34544c9377449e186074404e0dd1009994

SHA256
334bd46d5f3ba098c11827982715c0ff98e2aa1c2361b9702b222949e7e5730c

SHA512
06014da3030fa66fbf64f9dd0c9c229390c93dedcb2c6f53aff810a7d0054c05c514804ea9dbae3d6ec1f13b45b4dd844a7e1ec1706e5a7ae16be8e8a760898b

Download Submit
memory/332-69-0x0000000000A80000-0x0000000000A92000-memory.dmp

Filesize
72KB

Download
memory/884-83-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/884-82-0x0000000000830000-0x0000000000838000-memory.dmp

Filesize
32KB

Download
memory/884-81-0x0000000000850000-0x000000000085B000-memory.dmp

Filesize
44KB

Download
memory/884-80-0x0000000000830000-0x0000000000838000-memory.dmp

Filesize
32KB

Download
memory/884-74-0x0000000000840000-0x000000000084B000-memory.dmp

Filesize
44KB

Download
memory/884-70-0x0000000000840000-0x000000000084B000-memory.dmp

Filesize
44KB

Download
memory/884-78-0x0000000000840000-0x000000000084B000-memory.dmp

Filesize
44KB

Download
memory/1264-56-0x0000000002670000-0x0000000002676000-memory.dmp

Filesize
24KB

Download
memory/1264-60-0x0000000002670000-0x0000000002676000-memory.dmp

Filesize
24KB

Download
memory/1264-64-0x0000000002670000-0x0000000002676000-memory.dmp

Filesize
24KB

Download
memory/1976-54-0x0000000030670000-0x00000000306C2000-memory.dmp

Filesize
328KB

Download
memory/1976-68-0x0000000030670000-0x00000000306C2000-memory.dmp

Filesize
328KB

Download
memory/1976-55-0x0000000002320000-0x0000000002372000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing