Analysis
-
max time kernel
125s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04/05/2024, 07:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
数码资源网.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
数码资源网.url
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
辅助程序/功能程序/csrss.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
辅助程序/功能程序/csrss.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
辅助程序/过游戏保护/csrss.exe
Resource
win7-20240220-en
windows7-x64
16 signatures
150 seconds
General
-
Target
辅助程序/过游戏保护/csrss.exe
-
Size
1.2MB
-
MD5
94dcf3d9a7cf1b9fa079d0e6f4f2ba5a
-
SHA1
72f801de257841558356aae3710ec1e0c606fc8b
-
SHA256
b23e7005b48679fa121cb99ccec15aa5e259c1b91c08a99490ccdb961e330b44
-
SHA512
3bbd4086b97866b9f79d31b1f416bf188bb51bef88f87cb252fc91099ff51703c6eb65f1e40ff866157e306dc52274bba10bf703e1dde320a03705802b13a31c
-
SSDEEP
12288:bcNMq4xG3b0RK5bzMjidw7JU6eUOMwFdVfZobi2a89ujY68aapv:bcD4s3wRQYj6gJU6pOMwFHmi9bOaov
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" csrss.exe -
resource yara_rule behavioral5/memory/1660-8-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-3-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-4-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-6-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-10-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-13-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-7-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-5-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-12-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-11-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-9-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-28-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-30-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-29-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-32-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-33-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-35-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-36-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-38-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-41-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-40-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-43-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-52-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-53-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-55-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-56-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-62-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-64-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-65-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-68-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral5/memory/1660-69-0x0000000002010000-0x000000000309E000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" csrss.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: csrss.exe File opened (read-only) \??\S: csrss.exe File opened (read-only) \??\T: csrss.exe File opened (read-only) \??\G: csrss.exe File opened (read-only) \??\J: csrss.exe File opened (read-only) \??\V: csrss.exe File opened (read-only) \??\K: csrss.exe File opened (read-only) \??\R: csrss.exe File opened (read-only) \??\Q: csrss.exe File opened (read-only) \??\W: csrss.exe File opened (read-only) \??\Y: csrss.exe File opened (read-only) \??\I: csrss.exe File opened (read-only) \??\M: csrss.exe File opened (read-only) \??\L: csrss.exe File opened (read-only) \??\O: csrss.exe File opened (read-only) \??\P: csrss.exe File opened (read-only) \??\U: csrss.exe File opened (read-only) \??\Z: csrss.exe File opened (read-only) \??\E: csrss.exe File opened (read-only) \??\H: csrss.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf csrss.exe File opened for modification F:\autorun.inf csrss.exe -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe csrss.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe csrss.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe csrss.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe csrss.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe csrss.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI csrss.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe 1660 csrss.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe Token: SeDebugPrivilege 1660 csrss.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1660 csrss.exe 1660 csrss.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1640 1660 csrss.exe 23 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 PID 1660 wrote to memory of 1112 1660 csrss.exe 19 PID 1660 wrote to memory of 1168 1660 csrss.exe 20 PID 1660 wrote to memory of 1204 1660 csrss.exe 21 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1112
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1168
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\辅助程序\过游戏保护\csrss.exe"C:\Users\Admin\AppData\Local\Temp\辅助程序\过游戏保护\csrss.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1660
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1640
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5a1b30ab1b0264bb91c4268146d3b303c
SHA184daf02d92f8851f9882876c24b42998314524c9
SHA25665d73fea925e806f077432a0c08bd9d4183a4b77923d2a541eb3d422480a83c5
SHA512e470577354b9fd95d50acb69c10f2e87ad242d15af098eecf1779c63f375625521781194c6c87b431998095c58cef451bac9d3b284784463d7b0d73114705f91