Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
20-03-2024 01:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d79de6ffe84fe137828390a98ab88843.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
d79de6ffe84fe137828390a98ab88843.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
d79de6ffe84fe137828390a98ab88843.exe
-
Size
14KB
-
MD5
d79de6ffe84fe137828390a98ab88843
-
SHA1
29eebac4fcf2a24d149208fd6e38beaef5ef21b2
-
SHA256
4f3943397cef93c85394614c5f48ff609e69950125656a3ea5816dce0cacd0e4
-
SHA512
6f1e313b3bab680856f0889ba793700ada7200bce32488abb4145326acded011745b30f4dcbfdc57d814ae02c69c5aa97ffb0583c068a5fd7e7eb654a3a84cfa
-
SSDEEP
384:M3SnvnMVvllOt+f2ip1CnyR+aUOwsMVXRb8S36:QSvMVvvOt9iplsKLM3IS36
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts csrss.exe -
Modifies Installed Components in the registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\stubpath = "%windir%\\Tasks\\hackshen.vbs" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK} csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{H9I12RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\ = "ϵͳÉèÖÃ" csrss.exe -
Deletes itself 1 IoCs
pid Process 2092 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1736 csrss.exe -
Loads dropped DLL 2 IoCs
pid Process 2092 cmd.exe 2092 cmd.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\H: csrss.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\wsock32.dll csrss.exe File created C:\Program Files\Internet Explorer\de-DE\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\wsock32.dll csrss.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Full\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\wsock32.dll csrss.exe File created C:\Program Files\Common Files\System\msadc\it-IT\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\wsock32.dll csrss.exe File created C:\Program Files\Internet Explorer\es-ES\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\wsock32.dll csrss.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\wsock32.dll csrss.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\wsock32.dll csrss.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\wsock32.dll csrss.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\wsock32.dll csrss.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\wsock32.dll csrss.exe File created C:\Program Files\Common Files\System\es-ES\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\System\msadc\ja-JP\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\wsock32.dll csrss.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\wsock32.dll csrss.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\wsock32.dll csrss.exe File created C:\Program Files\Internet Explorer\it-IT\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\wsock32.dll csrss.exe File created C:\Program Files\Common Files\System\wsock32.dll csrss.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\wsock32.dll csrss.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\wsock32.dll csrss.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\wsock32.dll csrss.exe File created C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\wsock32.dll csrss.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\wsock32.dll csrss.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\wsock32.dll csrss.exe File created C:\Program Files\DVD Maker\wsock32.dll csrss.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\Tasks\ÂÌ»¯.bat csrss.exe File opened for modification C:\Windows\Tasks\ÂÌ»¯.bat csrss.exe File created C:\Windows\Tasks\wsock32.dll csrss.exe File created C:\Windows\mfxixue.ini csrss.exe File created C:\Windows\Tasks\csrss.exe d79de6ffe84fe137828390a98ab88843.exe File created C:\Windows\Tasks\hackshen.vbs csrss.exe File opened for modification C:\Windows\Tasks\hackshen.vbs csrss.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2920 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2912 d79de6ffe84fe137828390a98ab88843.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe 1736 csrss.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1736 csrss.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2092 2912 d79de6ffe84fe137828390a98ab88843.exe 28 PID 2912 wrote to memory of 2092 2912 d79de6ffe84fe137828390a98ab88843.exe 28 PID 2912 wrote to memory of 2092 2912 d79de6ffe84fe137828390a98ab88843.exe 28 PID 2912 wrote to memory of 2092 2912 d79de6ffe84fe137828390a98ab88843.exe 28 PID 2092 wrote to memory of 2920 2092 cmd.exe 30 PID 2092 wrote to memory of 2920 2092 cmd.exe 30 PID 2092 wrote to memory of 2920 2092 cmd.exe 30 PID 2092 wrote to memory of 2920 2092 cmd.exe 30 PID 2092 wrote to memory of 1736 2092 cmd.exe 31 PID 2092 wrote to memory of 1736 2092 cmd.exe 31 PID 2092 wrote to memory of 1736 2092 cmd.exe 31 PID 2092 wrote to memory of 1736 2092 cmd.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d79de6ffe84fe137828390a98ab88843.exe"C:\Users\Admin\AppData\Local\Temp\d79de6ffe84fe137828390a98ab88843.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\cmd.execmd /c c:\mfxixue.bat2⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\ipconfig.exeipconfig3⤵
- Gathers network information
PID:2920
-
-
C:\Windows\Tasks\csrss.exeC:\Windows\Tasks\csrss.exe3⤵
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1736
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
912B
MD548ec95bacc8186d72cce11b9584faeb7
SHA10a6900de60be125b545d36a55f56bd0f7db18d32
SHA256402d34fd239a2ecdc35929964d2ba2b8094fc601cee519955734994c67d3d79c
SHA51242115db0a178b8ff4f80d932b1c716724f52159c9e00cab154c6b984bbc1a726947c560cf74821a49876b7d9fa491791e5a5ce5a6e3545ee6fd7c5a0bfc6873d
-
Filesize
14KB
MD57455184e29a885d6adf907ebcf071bb8
SHA1efc2f3db101a774b7180ba4e51e5a365ab4d8305
SHA25646226fb6b86ce7972e6ec37359742e7ebf83df2de25f51631141c31667c7e3d9
SHA51226a1a9ba6fa742f8af34193c78248f1f2b89ae60c108ff335afe1ff66b2f315eceafc60e872c4a28c319ee068c5bf82ba0914dae0ef1f20cb9668fd702ce6fb8
-
Filesize
97B
MD5a8c57eab4925bb4ad48cbabba42746e0
SHA1f9fa7820051d33dadb862777fffd9714517e086d
SHA256bc37a3b40be7e73055684637731ac8514e7ec9a32fd470eb73c71fd8600dba51
SHA512d03022e7dee4f2121c41fa4fc236147cc79dfd8006630e6cb3ac84b1f732015fc957dd27df94fc5e28bc144b932e297f783edf009cd2b55b9fd25529f07e0ec6
-
Filesize
15KB
MD5dead113140d0686a7d7feba99e884258
SHA147289ad8994a2d7a26c8b675a8d273683fc33452
SHA2564712b10f86fd235297ccf236a2321bd0e82e65f98bdb7abb30d748cb6b54a221
SHA5124a71779dc868aad54d3227ef5f783bd4a5cd60e3dffeb50f8b5325b43b24b2fb92b8ce0b4b09490dd050ac7560d4c485575e5142c95f8d67ebe224b0cf9475e0
-
Filesize
131B
MD5ed8ff549660535b7c047c3478ba05dbe
SHA17e159764fd2bfe629d03a2a0b2ed37768bb0582a
SHA256d81e4c08af3513d03147243a64e6058933ae18bb1b33f57aafd7c19949e3c37f
SHA5124419657b6c52090baf114fbfc797bbe79ec5dafcfaf64382ffce9ec36d537b602087cbbd60ebeffe8561af2793ded42e25f760d1ae7d03e5cf74b2779e789913