Analysis
-
max time kernel
89s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 19:48
Static task
static1
Behavioral task
behavioral1
Sample
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe
Resource
win10v2004-20220414-en
General
-
Target
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe
-
Size
3.8MB
-
MD5
9123f319c3564a94e30c1d9476ae299d
-
SHA1
29297f78a72d860abe5aa31999d36a8dfe7324bc
-
SHA256
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7
-
SHA512
159ce7aaf5cd7ddf6da8d5c206867463fb4cca059ea1463f932183d7070bf23a60afee9390716ed1af788d1b0c7465ad5d4fad8dd59a688d98b9b5975deac557
Malware Config
Signatures
-
Glupteba Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/952-56-0x0000000001790000-0x0000000001E85000-memory.dmp family_glupteba behavioral1/memory/952-57-0x0000000000400000-0x0000000001019000-memory.dmp family_glupteba behavioral1/memory/1716-64-0x0000000000400000-0x0000000001019000-memory.dmp family_glupteba -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 1500 csrss.exe -
Modifies Windows Firewall 1 TTPs
-
Loads dropped DLL 2 IoCs
Processes:
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exepid process 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe -
Processes:
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\1ad956336ccb\1ad956336ccb = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\BoldCherry = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\1ad956336ccb.exe = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe = "0" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\BoldCherry = "\"C:\\Windows\\rss\\csrss.exe\"" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe -
Drops file in Windows directory 3 IoCs
Processes:
makecab.exe491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exedescription ioc process File created C:\Windows\Logs\CBS\CbsPersist_20220524204319.cab makecab.exe File opened for modification C:\Windows\rss 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe File created C:\Windows\rss\csrss.exe 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exenetsh.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-421 = "Russian Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-582 = "North Asia East Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-552 = "North Asia Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exepid process 952 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exedescription pid process Token: SeDebugPrivilege 952 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe Token: SeImpersonatePrivilege 952 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.execmd.exedescription pid process target process PID 1716 wrote to memory of 1900 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe cmd.exe PID 1716 wrote to memory of 1900 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe cmd.exe PID 1716 wrote to memory of 1900 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe cmd.exe PID 1716 wrote to memory of 1900 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe cmd.exe PID 1900 wrote to memory of 1340 1900 cmd.exe netsh.exe PID 1900 wrote to memory of 1340 1900 cmd.exe netsh.exe PID 1900 wrote to memory of 1340 1900 cmd.exe netsh.exe PID 1716 wrote to memory of 1500 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe csrss.exe PID 1716 wrote to memory of 1500 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe csrss.exe PID 1716 wrote to memory of 1500 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe csrss.exe PID 1716 wrote to memory of 1500 1716 491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe"C:\Users\Admin\AppData\Local\Temp\491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe"C:\Users\Admin\AppData\Local\Temp\491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7.exe"2⤵
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\1ad956336ccb\1ad956336ccb\1ad956336ccb.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\1ad956336ccb\1ad956336ccb\1ad956336ccb.exe" enable=yes4⤵
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220524204319.log C:\Windows\Logs\CBS\CbsPersist_20220524204319.cab1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\rss\csrss.exeFilesize
3.8MB
MD59123f319c3564a94e30c1d9476ae299d
SHA129297f78a72d860abe5aa31999d36a8dfe7324bc
SHA256491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7
SHA512159ce7aaf5cd7ddf6da8d5c206867463fb4cca059ea1463f932183d7070bf23a60afee9390716ed1af788d1b0c7465ad5d4fad8dd59a688d98b9b5975deac557
-
\Windows\rss\csrss.exeFilesize
3.8MB
MD59123f319c3564a94e30c1d9476ae299d
SHA129297f78a72d860abe5aa31999d36a8dfe7324bc
SHA256491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7
SHA512159ce7aaf5cd7ddf6da8d5c206867463fb4cca059ea1463f932183d7070bf23a60afee9390716ed1af788d1b0c7465ad5d4fad8dd59a688d98b9b5975deac557
-
\Windows\rss\csrss.exeFilesize
3.8MB
MD59123f319c3564a94e30c1d9476ae299d
SHA129297f78a72d860abe5aa31999d36a8dfe7324bc
SHA256491ebb5503b8c775001c514f3e07a368cb59c8955262e7423f1347bc836414c7
SHA512159ce7aaf5cd7ddf6da8d5c206867463fb4cca059ea1463f932183d7070bf23a60afee9390716ed1af788d1b0c7465ad5d4fad8dd59a688d98b9b5975deac557
-
memory/952-57-0x0000000000400000-0x0000000001019000-memory.dmpFilesize
12.1MB
-
memory/952-54-0x00000000013E0000-0x0000000001786000-memory.dmpFilesize
3.6MB
-
memory/952-56-0x0000000001790000-0x0000000001E85000-memory.dmpFilesize
7.0MB
-
memory/952-55-0x00000000013E0000-0x0000000001786000-memory.dmpFilesize
3.6MB
-
memory/1340-60-0x0000000000000000-mapping.dmp
-
memory/1340-61-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmpFilesize
8KB
-
memory/1500-66-0x0000000000000000-mapping.dmp
-
memory/1716-58-0x0000000001200000-0x00000000015A6000-memory.dmpFilesize
3.6MB
-
memory/1716-62-0x0000000001200000-0x00000000015A6000-memory.dmpFilesize
3.6MB
-
memory/1716-64-0x0000000000400000-0x0000000001019000-memory.dmpFilesize
12.1MB
-
memory/1900-59-0x0000000000000000-mapping.dmp