d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2024, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe
Size 220KB
Sample241118-eevt1axmfv
SHA256 d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9
MD5 43890e17eb6e27603493d6601868a4f6
SHA1 d9723222afeb424de2e07c735713d49c652e0658
SHA512 7f4da682825d4506de79f935114ededce3ba58582be3444660077082214a4192bfef658add6eb8d25c4b54e537db40b5d6b0bd9eefb5a1e58b7ef1faf486f097
SSDEEP 6144:TM9Iq/WPi4qmwtoq9ueQcr/uamo9SO4fg:TM+q/WPzwtooEXo9SL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion persistence

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	csrssr.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	csrssr.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	csrssr.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Microsoft Windows Hosting Service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrssr.exe"	csrssr.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe

Executes dropped EXE 2 IoCs

pid	Process
368	csrssr.exe
1360	csrssr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Hosting Service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrssr.exe"	csrssr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Hosting Service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrssr.exe"	csrssr.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Microsoft Windows Firewall Service = "C:\\Users\\Admin\\AppData\\Local\\Temp\\csrssr.exe"	csrssr.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4508 set thread context of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 368 set thread context of 1360	368	csrssr.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrssr.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 4508 wrote to memory of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 4508 wrote to memory of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 4508 wrote to memory of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 4508 wrote to memory of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 4508 wrote to memory of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 4508 wrote to memory of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 4508 wrote to memory of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 4508 wrote to memory of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 4508 wrote to memory of 112	4508	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	88
PID 112 wrote to memory of 1104	112	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	93
PID 112 wrote to memory of 1104	112	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	93
PID 112 wrote to memory of 1104	112	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	93
PID 112 wrote to memory of 368	112	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	95
PID 112 wrote to memory of 368	112	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	95
PID 112 wrote to memory of 368	112	d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe	95
PID 368 wrote to memory of 1360	368	csrssr.exe	98
PID 368 wrote to memory of 1360	368	csrssr.exe	98
PID 368 wrote to memory of 1360	368	csrssr.exe	98
PID 368 wrote to memory of 1360	368	csrssr.exe	98
PID 368 wrote to memory of 1360	368	csrssr.exe	98
PID 368 wrote to memory of 1360	368	csrssr.exe	98
PID 368 wrote to memory of 1360	368	csrssr.exe	98
PID 368 wrote to memory of 1360	368	csrssr.exe	98
PID 368 wrote to memory of 1360	368	csrssr.exe	98
PID 368 wrote to memory of 1360	368	csrssr.exe	98

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations	csrssr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\DefaultFileTypeRisk = "808464432"	csrssr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\LowRiskFileTypes = ".exe"	csrssr.exe

C:\Users\Admin\AppData\Local\Temp\d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe
"C:\Users\Admin\AppData\Local\Temp\d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe
  C:\Users\Admin\AppData\Local\Temp\d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rm.bat" C:\Users\Admin\AppData\Local\Temp\d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1104
- - C:\Users\Admin\AppData\Local\Temp\csrssr.exe
    "C:\Users\Admin\AppData\Local\Temp\csrssr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:368
  - - C:\Users\Admin\AppData\Local\Temp\csrssr.exe
      C:\Users\Admin\AppData\Local\Temp\csrssr.exe
      4⤵
      Modifies firewall policy service
      Executes dropped EXE
      Adds Run key to start application
      Modifies WinLogon
      System policy modification
      PID:1360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

csrssr.exe

Path C:\Users\Admin\AppData\Local\Temp\csrssr.exe
Size 220KB
SHA256 d1adc4a58c4e0c812cb06cd7c3a44ecc3c761a0cf32dd3fadd6d0fe2527e04d9
MD5 43890e17eb6e27603493d6601868a4f6
SHA1 d9723222afeb424de2e07c735713d49c652e0658
SHA512 7f4da682825d4506de79f935114ededce3ba58582be3444660077082214a4192bfef658add6eb8d25c4b54e537db40b5d6b0bd9eefb5a1e58b7ef1faf486f097
SSDEEP 6144:TM9Iq/WPi4qmwtoq9ueQcr/uamo9SO4fg:TM+q/WPzwtooEXo9SL
MD5 SHA1 SHA512 SSDEEP

Submit Download

rm.bat

Path C:\Users\Admin\AppData\Local\Temp\rm.bat
Size 279B
SHA256 19ebff0c5bfb494310d9210068478c6e12c8bc310f7f945b2e67cecd7268160e
MD5 fe3d90c848669a29a5aecec5951e4ceb
SHA1 d739e3f513fa0700ad18386470870a4c08d95481
SHA512 576370fb815574cc3dd95396a9da00bb918c8fb79c3547c9a5f795dc8568c704cef1738001823a0b9c8eb0a7cab897a103078934829921d6f0fad927200219ae
MD5 SHA1 SHA512

Submit Download

memory/112-0-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/112-2-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/112-1-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/112-3-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/112-19-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1360-22-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1360-24-0x0000000000400000-0x000000000042E000-memory.dmp

Download

memory/1360-23-0x0000000000400000-0x000000000042E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads