Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2024 18:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2662822eb64657633b06a15ab36d592.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2662822eb64657633b06a15ab36d592.exe
Resource
win10v2004-20240221-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
a2662822eb64657633b06a15ab36d592.exe
-
Size
17KB
-
MD5
a2662822eb64657633b06a15ab36d592
-
SHA1
3abbf482d7b5b28e969b1994447d17d30ef8b470
-
SHA256
666a60eef65de8adcc326d7fd1a95e0984a50e281cd85bf2df232216aac5cfe5
-
SHA512
f203ab74dbc91c7504acfd36b60281159fb6106d0f7509fe869b174c4ba81a98cbb108f359348d96c812dda731897b346c04e5b465312352803703ad899f083d
-
SSDEEP
384:IqTfFGmEb6ec9Jqm+b42wCKt2Xe6w3z8XBcWaFzra8ypNWodXU:TUj8JNndAXGWa28ypN5l
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts csrss.exe -
Modifies Installed Components in the registry 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK} csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\ = "ϵͳÉèÖÃ" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\stubpath = "%windir%\\Tasks\\hackshen.vbs" csrss.exe -
Executes dropped EXE 1 IoCs
pid Process 2244 csrss.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\H: csrss.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\wsock32.dll csrss.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\wsock32.dll csrss.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\wsock32.dll csrss.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\wsock32.dll csrss.exe File created C:\Program Files\Common Files\microsoft shared\ink\pt-PT\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\wsock32.dll csrss.exe File created C:\Program Files\Java\jre-1.8\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\System\en-US\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\wsock32.dll csrss.exe File created C:\Program Files\Common Files\System\ado\wsock32.dll csrss.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\wsock32.dll csrss.exe File created C:\Program Files\Common Files\microsoft shared\ink\sl-SI\wsock32.dll csrss.exe File created C:\Program Files\Common Files\System\Ole DB\es-ES\wsock32.dll csrss.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\it\wsock32.dll csrss.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\wsock32.dll csrss.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\wsock32.dll csrss.exe File created C:\Program Files\Java\jre-1.8\lib\images\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\wsock32.dll csrss.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\wsock32.dll csrss.exe File created C:\Program Files\Java\jre-1.8\lib\security\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\uk-UA\wsock32.dll csrss.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\fr\wsock32.dll csrss.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\wsock32.dll csrss.exe File created C:\Program Files\Common Files\microsoft shared\ink\he-IL\wsock32.dll csrss.exe File created C:\Program Files\Common Files\microsoft shared\TextConv\en-US\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\wsock32.dll csrss.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tr-TR\wsock32.dll csrss.exe File created C:\Program Files\Common Files\microsoft shared\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\wsock32.dll csrss.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk-1.8\bin\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\cmm\wsock32.dll csrss.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\wsock32.dll csrss.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\wsock32.dll csrss.exe File created C:\Program Files\Internet Explorer\images\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\management\wsock32.dll csrss.exe File created C:\Program Files\Common Files\microsoft shared\ink\ko-KR\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\wsock32.dll csrss.exe File opened for modification C:\Program Files\dotnet\host\fxr\wsock32.dll csrss.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\tr\wsock32.dll csrss.exe File created C:\Program Files\Internet Explorer\fr-FR\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\server\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sl-SI\wsock32.dll csrss.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk-1.8\jre\wsock32.dll csrss.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\wsock32.dll csrss.exe File opened for modification C:\Program Files\dotnet\host\fxr\8.0.0\wsock32.dll csrss.exe File opened for modification C:\Program Files\Internet Explorer\it-IT\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\ext\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jre-1.8\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\wsock32.dll csrss.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sk-SK\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\wsock32.dll csrss.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\wsock32.dll csrss.exe File created C:\Program Files\Internet Explorer\es-ES\wsock32.dll csrss.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\ÂÌ»¯.bat csrss.exe File created C:\Windows\Tasks\wsock32.dll csrss.exe File created C:\Windows\mfxixue.ini csrss.exe File created C:\Windows\Tasks\csrss.exe a2662822eb64657633b06a15ab36d592.exe File created C:\Windows\Tasks\hackshen.vbs csrss.exe File opened for modification C:\Windows\Tasks\hackshen.vbs csrss.exe File created C:\Windows\Tasks\ÂÌ»¯.bat csrss.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4840 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 116 a2662822eb64657633b06a15ab36d592.exe 116 a2662822eb64657633b06a15ab36d592.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe 2244 csrss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2244 csrss.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 116 wrote to memory of 4768 116 a2662822eb64657633b06a15ab36d592.exe 89 PID 116 wrote to memory of 4768 116 a2662822eb64657633b06a15ab36d592.exe 89 PID 116 wrote to memory of 4768 116 a2662822eb64657633b06a15ab36d592.exe 89 PID 4768 wrote to memory of 4840 4768 cmd.exe 91 PID 4768 wrote to memory of 4840 4768 cmd.exe 91 PID 4768 wrote to memory of 4840 4768 cmd.exe 91 PID 4768 wrote to memory of 2244 4768 cmd.exe 92 PID 4768 wrote to memory of 2244 4768 cmd.exe 92 PID 4768 wrote to memory of 2244 4768 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2662822eb64657633b06a15ab36d592.exe"C:\Users\Admin\AppData\Local\Temp\a2662822eb64657633b06a15ab36d592.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\mfxixue.bat2⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\ipconfig.exeipconfig3⤵
- Gathers network information
PID:4840
-
-
C:\Windows\Tasks\csrss.exeC:\Windows\Tasks\csrss.exe3⤵
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:2244
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
884B
MD5b75a3383b4197a5100367add2fc3195d
SHA1a543ddb041c89ab95b72c28b6e16b203e7cf6e9c
SHA256649cc16668f27c6ccbfbbabbc8c147710701437041f2326f3d568c4ea5a2c5ac
SHA512f819eac15e13c31b160915d6a32c7eb8dec1c1fda409b4767e3f4c3cb63bbd0506da4a6486908491829f46d4ec5c0658f71fd76a24a22e50730ce8dbca48a5f8
-
Filesize
17KB
MD57633e1cd548b40707f260b7b21a5eb69
SHA183fced324212dd4950afe96489bab44e7a642029
SHA2564719404098faef757544b14f5749f5a8c6fa9c2098ce3deccfb54af5f4b8255d
SHA512fd95bd9790493ea72284603ceef12d7f163c64b240b5d5a0b1ff380fc9221c7753631477aee1f987063bd919fbcf40ac9249de474a982e159aab26cca4eddd7c
-
Filesize
97B
MD5a8c57eab4925bb4ad48cbabba42746e0
SHA1f9fa7820051d33dadb862777fffd9714517e086d
SHA256bc37a3b40be7e73055684637731ac8514e7ec9a32fd470eb73c71fd8600dba51
SHA512d03022e7dee4f2121c41fa4fc236147cc79dfd8006630e6cb3ac84b1f732015fc957dd27df94fc5e28bc144b932e297f783edf009cd2b55b9fd25529f07e0ec6
-
Filesize
6KB
MD5d50cc09e37307d26ad4c2fce8957d0ed
SHA12d29ee8ecb2a24fba8fbcc9fd03fbda58b77b579
SHA2560a2aca33c2c67afdbde6b75ce054f0f2b74d1de5c3e49a441c1577b4ee249948
SHA5128bc7422ae3a93da838886e4917ab4d02f693066439bd0f7b1f95213fe658c9c6b272a0076b09adc2fef687eee28f300bbd1fd201e2a31914a353e16aa9d43de9
-
Filesize
131B
MD502382ad87b13a804ff9011ed1171c9ec
SHA1d0ac42b0c025bbe57cd70531c903964b788ee8bc
SHA2562055499b4476ce892a5731e698852b40eddd26d4f15cce5fdc3c4f61fa77ce24
SHA51267190a9b75f1c43757809ff799bb5c695cb693fd36fd20c515cd9912f18983dfddf9b6645ea4580c0dec559c2421acb188b4044dd62298231edef9280a28db68