e38d3f5f725b87b072aa1a7cd772bafde24afed3a47b05be735a554a406da734

General

Target

71249c7234586da21d10b349be6b4044.exe
Size

327KB
MD5

71249c7234586da21d10b349be6b4044
SHA1

3fe0ce136436c8afa5a6fcdecbaf03d79ebb5701
SHA256

e38d3f5f725b87b072aa1a7cd772bafde24afed3a47b05be735a554a406da734
SHA512

fd47e8bf7ea234a2ef84865afa1b8609ce12d5fa60e4395e3bd43967d10ddd49b2f1971004936660506a840ace20308536ed52d4733429a5ea8f15fe0b8577f2
SSDEEP

6144:p2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:p2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1664	csrssys.exe
2128	csrssys.exe

Loads dropped DLL 4 IoCs

pid	Process
2916	71249c7234586da21d10b349be6b4044.exe
2916	71249c7234586da21d10b349be6b4044.exe
2916	71249c7234586da21d10b349be6b4044.exe
1664	csrssys.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\shell\runas	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\shell\runas\command\IsolatedCommand = "\"%1\" %*"	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\DefaultIcon	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\shell\open\command	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\ = "wexplorer"	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\csrssys.exe\" /START \"%1\" %*"	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\shell\runas\command	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\shell\runas	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\shell\open\command	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\shell	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\DefaultIcon\ = "%1"	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\shell	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\DefaultIcon	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\ = "Application"	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\shell\runas\command\ = "\"%1\" %*"	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\shell\runas\command	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\DefaultIcon\ = "%1"	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\shell\open	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SysWOW_32\\csrssys.exe\" /START \"%1\" %*"	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\shell\open\command\IsolatedCommand = "\"%1\" %*"	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe	71249c7234586da21d10b349be6b4044.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.exe\shell\open	71249c7234586da21d10b349be6b4044.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\wexplorer\Content-Type = "application/x-msdownload"	71249c7234586da21d10b349be6b4044.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1664	csrssys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1664	2916	71249c7234586da21d10b349be6b4044.exe	28
PID 2916 wrote to memory of 1664	2916	71249c7234586da21d10b349be6b4044.exe	28
PID 2916 wrote to memory of 1664	2916	71249c7234586da21d10b349be6b4044.exe	28
PID 2916 wrote to memory of 1664	2916	71249c7234586da21d10b349be6b4044.exe	28
PID 1664 wrote to memory of 2128	1664	csrssys.exe	29
PID 1664 wrote to memory of 2128	1664	csrssys.exe	29
PID 1664 wrote to memory of 2128	1664	csrssys.exe	29
PID 1664 wrote to memory of 2128	1664	csrssys.exe	29

C:\Users\Admin\AppData\Local\Temp\71249c7234586da21d10b349be6b4044.exe
"C:\Users\Admin\AppData\Local\Temp\71249c7234586da21d10b349be6b4044.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\csrssys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\csrssys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\csrssys.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\csrssys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\csrssys.exe"
    3⤵
    - Executes dropped EXE
    PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Microsoft\SysWOW_32\csrssys.exe

Filesize
327KB

MD5
ccd6fb4dd2e69daf1486b043dce4f1f4

SHA1
df0fe7fe65f52da4c665ed218397f950dda481fa

SHA256
f1f9daa48fead37df9ec2d57a901af033835f3375cec01f0102668f1e6cda00f

SHA512
db57ab6ab92c69751e1b6d3dadd8281c1466111249086c9f961c53690e6c904ae6dae3a6b73db89050582a1bb723ea427967015b376feeafbf11b71130bf590b

Download Submit

Analysis

Sharing