8173c41e31a106bd4663e8293014f81587a44f915e5aa47ca9d35f0f772184a9

General

Target

2075541a32e0be95011e3ab525853733.exe
Size

103KB
MD5

2075541a32e0be95011e3ab525853733
SHA1

e9970883d9ac69f7aa78ebcb66e3d5865956b110
SHA256

8173c41e31a106bd4663e8293014f81587a44f915e5aa47ca9d35f0f772184a9
SHA512

8b9acc18ac77bb87de5418d21758470a127c56d6437edc15d3292b48d7c2ed8ba0e12e94ce4785c316f8e2256e9e057608770bb1d45db5d69ae34c68d282f74f
SSDEEP

1536:mayt3u/g1bJjRroLVPjXCDw+/MO8zCzhiSayt3qyVjMoRPWn/sn:ma2tJNroLVrC78zEiSa2qyjTWe

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2608	csrss.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2608 set thread context of 2396	2608	csrss.exe	29
PID 2608 set thread context of 2688	2608	csrss.exe	30
PID 2608 set thread context of 0	2608	csrss.exe
PID 2608 set thread context of 0	2608	csrss.exe
PID 2608 set thread context of 0	2608	csrss.exe
PID 2608 set thread context of 0	2608	csrss.exe
PID 2608 set thread context of 0	2608	csrss.exe
PID 2608 set thread context of 0	2608	csrss.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\Porno Screensaver britney.exe	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\Porno Screensaver britney.exe	svchost.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Serials edition.txt.pif	svchost.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Serials edition.txt.pif	svchost.exe
File created	C:\Program Files\DVD Maker\Shared\Ringtones.mp3.pif	svchost.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\Ringtones.mp3.pif	svchost.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\Arnold Schwarzenegger.jpg.pif	svchost.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\Arnold Schwarzenegger.jpg.pif	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\csrss.exe	2075541a32e0be95011e3ab525853733.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	1916	2075541a32e0be95011e3ab525853733.exe
Token: SeSystemtimePrivilege	1916	2075541a32e0be95011e3ab525853733.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2608	1916	2075541a32e0be95011e3ab525853733.exe	28
PID 1916 wrote to memory of 2608	1916	2075541a32e0be95011e3ab525853733.exe	28
PID 1916 wrote to memory of 2608	1916	2075541a32e0be95011e3ab525853733.exe	28
PID 1916 wrote to memory of 2608	1916	2075541a32e0be95011e3ab525853733.exe	28
PID 2608 wrote to memory of 2396	2608	csrss.exe	29
PID 2608 wrote to memory of 2396	2608	csrss.exe	29
PID 2608 wrote to memory of 2396	2608	csrss.exe	29
PID 2608 wrote to memory of 2396	2608	csrss.exe	29
PID 2608 wrote to memory of 2396	2608	csrss.exe	29
PID 2608 wrote to memory of 2688	2608	csrss.exe	30
PID 2608 wrote to memory of 2688	2608	csrss.exe	30
PID 2608 wrote to memory of 2688	2608	csrss.exe	30
PID 2608 wrote to memory of 2688	2608	csrss.exe	30
PID 2608 wrote to memory of 2688	2608	csrss.exe	30

C:\Users\Admin\AppData\Local\Temp\2075541a32e0be95011e3ab525853733.exe
"C:\Users\Admin\AppData\Local\Temp\2075541a32e0be95011e3ab525853733.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Windows\csrss.exe
  "C:\Windows\csrss.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\svchost.exe
    svchost C:\Windows\csrss.exe
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\svchost.exe
    svchost C:\Windows\csrss.exe
    3⤵
    - Drops file in Program Files directory
    PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\csrss.exe

Filesize
103KB

MD5
2075541a32e0be95011e3ab525853733

SHA1
e9970883d9ac69f7aa78ebcb66e3d5865956b110

SHA256
8173c41e31a106bd4663e8293014f81587a44f915e5aa47ca9d35f0f772184a9

SHA512
8b9acc18ac77bb87de5418d21758470a127c56d6437edc15d3292b48d7c2ed8ba0e12e94ce4785c316f8e2256e9e057608770bb1d45db5d69ae34c68d282f74f

Download Submit
memory/2396-7-0x0000000013140000-0x0000000013157000-memory.dmp

Filesize
92KB

Download
memory/2396-10-0x0000000013140000-0x0000000013157000-memory.dmp

Filesize
92KB

Download
memory/2396-9-0x0000000013140000-0x0000000013157000-memory.dmp

Filesize
92KB

Download
memory/2396-11-0x0000000013140000-0x0000000013157000-memory.dmp

Filesize
92KB

Download
memory/2688-14-0x0000000013140000-0x0000000013157000-memory.dmp

Filesize
92KB

Download
memory/2688-15-0x0000000013140000-0x0000000013157000-memory.dmp

Filesize
92KB

Download
memory/2688-17-0x0000000013140000-0x0000000013157000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing