Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2023, 09:04
Static task
static1
Behavioral task
behavioral1
Sample
09751399.exe
Resource
win7-20230220-en
General
-
Target
09751399.exe
-
Size
4.2MB
-
MD5
289257051a7e30f837a00b4186b47501
-
SHA1
322971cb7da2f62756e505ea8ba036462514c1bf
-
SHA256
433ec815318e439551d66ddf3c605ba7da5e966b671107b425f73262d39a9c83
-
SHA512
028854277ad817627f3070f0648bd546b2cc0a5c3ed220b1596725a41c934a9c62eb8f23c6e71619ea0c6c2d625b23c8a2ce03ca4eba016539a2134f4057bc26
-
SSDEEP
98304:aHVVp2uqi61tX39zbn2cQKXNes4aMrVfmxWuRZxuBKBOBL:aFYzTXNH2c3eKokxlRfC
Malware Config
Signatures
-
Glupteba payload 16 IoCs
resource yara_rule behavioral2/memory/4516-134-0x0000000002FD0000-0x00000000038BB000-memory.dmp family_glupteba behavioral2/memory/4516-157-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4516-203-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4648-231-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4648-264-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-306-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-353-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-355-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-357-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-359-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-361-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-363-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-365-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-367-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-369-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/956-371-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 848 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 956 csrss.exe 4788 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 09751399.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 09751399.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 09751399.exe File created C:\Windows\rss\csrss.exe 09751399.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1496 schtasks.exe 3100 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 09751399.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 09751399.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 09751399.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 09751399.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5104 powershell.exe 5104 powershell.exe 4516 09751399.exe 4516 09751399.exe 1748 powershell.exe 1748 powershell.exe 4648 09751399.exe 4648 09751399.exe 4648 09751399.exe 4648 09751399.exe 4648 09751399.exe 4648 09751399.exe 4648 09751399.exe 4648 09751399.exe 4648 09751399.exe 4648 09751399.exe 4984 powershell.exe 4984 powershell.exe 2676 powershell.exe 2676 powershell.exe 3552 powershell.exe 3552 powershell.exe 2824 powershell.exe 2824 powershell.exe 4972 powershell.exe 4972 powershell.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 956 csrss.exe 956 csrss.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 956 csrss.exe 956 csrss.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe 4788 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 5104 powershell.exe Token: SeDebugPrivilege 4516 09751399.exe Token: SeImpersonatePrivilege 4516 09751399.exe Token: SeDebugPrivilege 1748 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeDebugPrivilege 2676 powershell.exe Token: SeDebugPrivilege 3552 powershell.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 4972 powershell.exe Token: SeSystemEnvironmentPrivilege 956 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 4516 wrote to memory of 5104 4516 09751399.exe 84 PID 4516 wrote to memory of 5104 4516 09751399.exe 84 PID 4516 wrote to memory of 5104 4516 09751399.exe 84 PID 4648 wrote to memory of 1748 4648 09751399.exe 89 PID 4648 wrote to memory of 1748 4648 09751399.exe 89 PID 4648 wrote to memory of 1748 4648 09751399.exe 89 PID 4648 wrote to memory of 4284 4648 09751399.exe 91 PID 4648 wrote to memory of 4284 4648 09751399.exe 91 PID 4284 wrote to memory of 848 4284 cmd.exe 93 PID 4284 wrote to memory of 848 4284 cmd.exe 93 PID 4648 wrote to memory of 4984 4648 09751399.exe 96 PID 4648 wrote to memory of 4984 4648 09751399.exe 96 PID 4648 wrote to memory of 4984 4648 09751399.exe 96 PID 4648 wrote to memory of 2676 4648 09751399.exe 101 PID 4648 wrote to memory of 2676 4648 09751399.exe 101 PID 4648 wrote to memory of 2676 4648 09751399.exe 101 PID 4648 wrote to memory of 956 4648 09751399.exe 104 PID 4648 wrote to memory of 956 4648 09751399.exe 104 PID 4648 wrote to memory of 956 4648 09751399.exe 104 PID 956 wrote to memory of 3552 956 csrss.exe 105 PID 956 wrote to memory of 3552 956 csrss.exe 105 PID 956 wrote to memory of 3552 956 csrss.exe 105 PID 956 wrote to memory of 2824 956 csrss.exe 111 PID 956 wrote to memory of 2824 956 csrss.exe 111 PID 956 wrote to memory of 2824 956 csrss.exe 111 PID 956 wrote to memory of 4972 956 csrss.exe 113 PID 956 wrote to memory of 4972 956 csrss.exe 113 PID 956 wrote to memory of 4972 956 csrss.exe 113 PID 956 wrote to memory of 4788 956 csrss.exe 115 PID 956 wrote to memory of 4788 956 csrss.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\09751399.exe"C:\Users\Admin\AppData\Local\Temp\09751399.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104
-
-
C:\Users\Admin\AppData\Local\Temp\09751399.exe"C:\Users\Admin\AppData\Local\Temp\09751399.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:848
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1496
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3012
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4788
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3100
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD559a9a49977aa5c57fc5f573e31d3b0f5
SHA18fbfcd014741827486cd3ff163eb46f24128d1e5
SHA256b041fe6075435f6733f9a143b71388b81c033122ace3c9b10b6e4c820cf46f4a
SHA512a33c2d88376e36ba194f97c79585b1179b928637662aa0dc45e53bd73c1c00f66e4267fab4fd56fb15a9002b0f44feb9ebb6f69464d2f29ddc6da399533989e7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ed6bdcfe1f7ad45e792dffdd73c9c462
SHA1242b53223cbf1cc9d43e061a7f51d72a1a1ba468
SHA2564716686b82ab1b79afefa729c99755ebebda017347273624d64de5a1c5269bf1
SHA512f04ae8e39ebe4503c93d50a3a62610e4a8868b5d1ab574a119e7a987380c6141cd1a591eff7d35cf88df67d99358c6b1692a4053df7a19a2279d0497453d54ab
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD57bd2dc4d09ce7d30b1a02fe485004a21
SHA1db09a40bb374bdf86549e39f06f13f7f997a8723
SHA256059ee1b5770b72c7505f56685413fe6af8f1440cd5b47e22ac022d819d5b5b2e
SHA512f65779ba4333783a975329b5c65570a37cd4c99a4ca3bf1c6d5060819922f40375771b260076dc2baf1b542d8f66fd9fd70a6e7d6424365512f9869f638a827e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD50c2cf23784c633f033cdaa5169d9ec48
SHA1bb39397bae53bac05282a04caf54c6988b892d98
SHA256a307711d804a6c3363f3bf8327603e59b7a948db994d74b97a39f3ef1ea4d8e4
SHA512e78b85bedf93a8019d87fbc500733474fee4ab60a1821eebd5192c706f37aaa31df4278915ede7a43018c363ba98d03839eb82f98b8fae3ae1857485a0c5dfed
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5cc05b98736b51f53c01a41296de1191a
SHA1221c7cc4ddd0a941cb33ec1eb5730306c3db854c
SHA256ed4b9ff41e14612cfc2bc87fc04d6449051f09d586771243d2c582e87acd276e
SHA51248cad866ce2d979f000f2d0fbd0f66c277ec35a6ecf89fd21017e50cadd883dca1f1d914145a07e16ee79fca6d32f97fe0247885f3c519a91cbf85438de7162d
-
Filesize
4.2MB
MD5289257051a7e30f837a00b4186b47501
SHA1322971cb7da2f62756e505ea8ba036462514c1bf
SHA256433ec815318e439551d66ddf3c605ba7da5e966b671107b425f73262d39a9c83
SHA512028854277ad817627f3070f0648bd546b2cc0a5c3ed220b1596725a41c934a9c62eb8f23c6e71619ea0c6c2d625b23c8a2ce03ca4eba016539a2134f4057bc26
-
Filesize
4.2MB
MD5289257051a7e30f837a00b4186b47501
SHA1322971cb7da2f62756e505ea8ba036462514c1bf
SHA256433ec815318e439551d66ddf3c605ba7da5e966b671107b425f73262d39a9c83
SHA512028854277ad817627f3070f0648bd546b2cc0a5c3ed220b1596725a41c934a9c62eb8f23c6e71619ea0c6c2d625b23c8a2ce03ca4eba016539a2134f4057bc26