glupteba | ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82

General

Target

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Size

4.7MB
MD5

9a232f2047ce830e45c421d4c36314c4
SHA1

949d018bda22adbf77496a90ca7d3520baec4355
SHA256

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82
SHA512

1f84f11ec4aae9d2821226d711f29d330b477ee9891e0b05b14700aac5d5805c130df2bb97e86030b91195942fd987849a65efa1359595944d705c3d67acb20d

Score

10^/10

glupteba dropper evasion loader persistence trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1808-58-0x0000000000400000-0x0000000001400000-memory.dmp	family_glupteba
behavioral1/memory/1808-59-0x0000000000400000-0x0000000001400000-memory.dmp	family_glupteba
behavioral1/memory/1808-61-0x0000000000400000-0x0000000001400000-memory.dmp	family_glupteba
behavioral1/memory/1808-63-0x0000000000400000-0x0000000001400000-memory.dmp	family_glupteba
behavioral1/memory/1196-67-0x0000000000400000-0x0000000001400000-memory.dmp	family_glupteba
behavioral1/memory/1196-76-0x0000000000400000-0x0000000001400000-memory.dmp	family_glupteba
behavioral1/memory/944-84-0x0000000000400000-0x0000000001400000-memory.dmp	family_glupteba
behavioral1/memory/944-85-0x0000000000400000-0x0000000001400000-memory.dmp	family_glupteba
behavioral1/memory/944-86-0x0000000000400000-0x0000000001400000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 12 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\cloudnet.exe = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\CoolThunder = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

Executes dropped EXE 1 IoCs

Processes:

csrss.exe

pid process

944 csrss.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1080 netsh.exe

pid	process
944	csrss.exe

pid	process
1080	netsh.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1808-55-0x0000000000400000-0x0000000001400000-memory.dmp	upx
behavioral1/memory/1196-64-0x0000000000400000-0x0000000001400000-memory.dmp	upx
\Windows\rss\csrss.exe	upx
\Windows\rss\csrss.exe	upx
C:\Windows\rss\csrss.exe	upx
behavioral1/memory/944-77-0x0000000000400000-0x0000000001400000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

pid	process
1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

Windows security modification 2 TTPs 12 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\CoolThunder = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\cloudnet.exe = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoolThunder = "\"C:\\Windows\\rss\\csrss.exe\""	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

Drops file in System32 directory 5 IoCs

Processes:

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	csrss.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

Drops file in Windows directory 3 IoCs

Processes:

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exemakecab.exe

description	ioc	process
File opened for modification	C:\Windows\rss	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
File created	C:\Windows\rss\csrss.exe	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20220726075056.cab	makecab.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

csrss.exeae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exenetsh.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-22 = "Cape Verde Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-521 = "N. Central Asia Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-421 = "Russian Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-422 = "Russian Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exeae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.execsrss.exe

pid	process
1808	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
1808	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
1808	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
1808	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
944	csrss.exe
944	csrss.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

description	pid	process
Token: SeDebugPrivilege	1808	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
Token: SeImpersonatePrivilege	1808	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.execmd.exe

description	pid	process	target process
PID 1196 wrote to memory of 1696	1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe	cmd.exe
PID 1196 wrote to memory of 1696	1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe	cmd.exe
PID 1196 wrote to memory of 1696	1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe	cmd.exe
PID 1196 wrote to memory of 1696	1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe	cmd.exe
PID 1696 wrote to memory of 1080	1696	cmd.exe	netsh.exe
PID 1696 wrote to memory of 1080	1696	cmd.exe	netsh.exe
PID 1696 wrote to memory of 1080	1696	cmd.exe	netsh.exe
PID 1196 wrote to memory of 944	1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe	csrss.exe
PID 1196 wrote to memory of 944	1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe	csrss.exe
PID 1196 wrote to memory of 944	1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe	csrss.exe
PID 1196 wrote to memory of 944	1196	ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe	csrss.exe

C:\Users\Admin\AppData\Local\Temp\ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
"C:\Users\Admin\AppData\Local\Temp\ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808

C:\Users\Admin\AppData\Local\Temp\ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe
"C:\Users\Admin\AppData\Local\Temp\ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82.exe"
2⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1196

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
3⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:1080

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe ""
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:944

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20220726075056.log C:\Windows\Logs\CBS\CbsPersist_20220726075056.cab
1⤵
- Drops file in Windows directory
PID:1340

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

4

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
589c442fc7a0c70dca927115a700d41e

SHA1
66a07dace3afbfd1aa07a47e6875beab62c4bb31

SHA256
2e5cb72e9eb43baafb6c6bfcc573aac92f49a8064c483f9d378a9e8e781a526a

SHA512
1b5fa79e52be495c42cf49618441fb7012e28c02e7a08a91da9213db3ab810f0e83485bc1dd5f625a47d0ba7cfcdd5ea50acc9a8dcebb39f048c40f01e94155b

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
837a81ea8948db7fa523b7ad1ff9fd9d

SHA1
7fc0858538070548b770044643e6c558d9e8ab2a

SHA256
7d037e89ec1861dec1e3dd5bffe5b899ca06ba3d8dd052e94b18797116245e24

SHA512
b68d5830dd776a7571f6a406cc24dd2ab85bccee0b507eab1e18e0247eb186fa5bb7c177bff481c54a63b07e8994970de5ebef76dc754ba43d4d0edda3418086

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize
242B

MD5
0f32ee874418f7f78f1a75689c4f3d9e

SHA1
f7a24cb0930a6df7abc65bc5471c5780382845f6

SHA256
f911ce5103f4135656af743f39569ea343b3299adb44d8c2000ca30e77dc2d7e

SHA512
b02d97a184d05d4eec7b6bfb8c78413907557f7827554c947675b506d1b902ad53c8c7026a7687617fb3e5066c3c32d398fb8ace66352c590d2312d4e0846e11

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.7MB

MD5
9a232f2047ce830e45c421d4c36314c4

SHA1
949d018bda22adbf77496a90ca7d3520baec4355

SHA256
ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82

SHA512
1f84f11ec4aae9d2821226d711f29d330b477ee9891e0b05b14700aac5d5805c130df2bb97e86030b91195942fd987849a65efa1359595944d705c3d67acb20d

Download Submit
\Windows\rss\csrss.exe
Filesize
4.7MB

MD5
9a232f2047ce830e45c421d4c36314c4

SHA1
949d018bda22adbf77496a90ca7d3520baec4355

SHA256
ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82

SHA512
1f84f11ec4aae9d2821226d711f29d330b477ee9891e0b05b14700aac5d5805c130df2bb97e86030b91195942fd987849a65efa1359595944d705c3d67acb20d

Download Submit
\Windows\rss\csrss.exe
Filesize
4.7MB

MD5
9a232f2047ce830e45c421d4c36314c4

SHA1
949d018bda22adbf77496a90ca7d3520baec4355

SHA256
ae7daaeed4d69a185e48b18c9fb70d9422fe4d71cd55bf993165680a4c1e2c82

SHA512
1f84f11ec4aae9d2821226d711f29d330b477ee9891e0b05b14700aac5d5805c130df2bb97e86030b91195942fd987849a65efa1359595944d705c3d67acb20d

Download Submit
memory/944-84-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/944-83-0x00000000099B0000-0x0000000009D40000-memory.dmp

Filesize
3.6MB

Download
memory/944-78-0x00000000099B0000-0x0000000009E70000-memory.dmp

Filesize
4.8MB

Download
memory/944-77-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/944-85-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/944-86-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/944-73-0x0000000000000000-mapping.dmp

Download
memory/1080-69-0x0000000000000000-mapping.dmp

Download
memory/1080-70-0x000007FEFC381000-0x000007FEFC383000-memory.dmp

Filesize
8KB

Download
memory/1196-64-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1196-67-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1196-66-0x0000000009D50000-0x000000000A0E0000-memory.dmp

Filesize
3.6MB

Download
memory/1196-76-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1196-65-0x0000000009D50000-0x000000000A210000-memory.dmp

Filesize
4.8MB

Download
memory/1696-68-0x0000000000000000-mapping.dmp

Download
memory/1808-63-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1808-54-0x0000000076281000-0x0000000076283000-memory.dmp

Filesize
8KB

Download
memory/1808-61-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1808-60-0x0000000009A80000-0x0000000009E10000-memory.dmp

Filesize
3.6MB

Download
memory/1808-59-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1808-58-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/1808-57-0x0000000009A80000-0x0000000009E10000-memory.dmp

Filesize
3.6MB

Download
memory/1808-56-0x0000000009A80000-0x0000000009F40000-memory.dmp

Filesize
4.8MB

Download
memory/1808-55-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads