Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2023, 02:18
Static task
static1
General
-
Target
13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe
-
Size
4.2MB
-
MD5
445fd17cf81c9ca1888e01cd857e3973
-
SHA1
c9104c9ba8af6aa51b91391bab2f7c26d2620cae
-
SHA256
13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12
-
SHA512
8542933205d1e12bd148b707014645a31dc0c91cfd3130268b7d5a9f23a51940057c757d523368adccfca1c08d4048295e2b02a74674c784d515feb630e5e0b4
-
SSDEEP
98304:wcqU71k9uIcOOX3U7dpf6ELptGigmzK3yj4Rv:yUJ29YnJkXgmzK3fRv
Malware Config
Signatures
-
Glupteba payload 17 IoCs
resource yara_rule behavioral1/memory/2256-134-0x0000000005380000-0x0000000005C6B000-memory.dmp family_glupteba behavioral1/memory/2256-173-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/2256-204-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/1504-208-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/1504-261-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/1504-294-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-295-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-348-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-357-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-368-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-372-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-376-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-380-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-384-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-388-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-392-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba behavioral1/memory/4548-396-0x0000000000400000-0x00000000030D0000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 3132 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 4548 csrss.exe 2852 injector.exe 2100 windefender.exe 4240 windefender.exe -
resource yara_rule behavioral1/files/0x001400000001db57-360.dat upx behavioral1/files/0x001400000001db57-361.dat upx behavioral1/memory/2100-362-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/files/0x001400000001db57-363.dat upx behavioral1/memory/2100-365-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4240-366-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4240-370-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4240-378-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3700 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4740 schtasks.exe 4384 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1152 powershell.exe 1152 powershell.exe 2256 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 2256 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 2824 powershell.exe 2824 powershell.exe 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 4452 powershell.exe 4452 powershell.exe 4840 powershell.exe 4840 powershell.exe 2388 powershell.exe 2388 powershell.exe 1988 powershell.exe 1988 powershell.exe 4496 powershell.exe 4496 powershell.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 4548 csrss.exe 4548 csrss.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 4548 csrss.exe 4548 csrss.exe 2852 injector.exe 2852 injector.exe 4548 csrss.exe 4548 csrss.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe 2852 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1152 powershell.exe Token: SeDebugPrivilege 2256 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Token: SeImpersonatePrivilege 2256 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 4452 powershell.exe Token: SeDebugPrivilege 4840 powershell.exe Token: SeDebugPrivilege 2388 powershell.exe Token: SeDebugPrivilege 1988 powershell.exe Token: SeDebugPrivilege 4496 powershell.exe Token: SeSystemEnvironmentPrivilege 4548 csrss.exe Token: SeSecurityPrivilege 3700 sc.exe Token: SeSecurityPrivilege 3700 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2256 wrote to memory of 1152 2256 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 83 PID 2256 wrote to memory of 1152 2256 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 83 PID 2256 wrote to memory of 1152 2256 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 83 PID 1504 wrote to memory of 2824 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 93 PID 1504 wrote to memory of 2824 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 93 PID 1504 wrote to memory of 2824 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 93 PID 1504 wrote to memory of 4056 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 95 PID 1504 wrote to memory of 4056 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 95 PID 4056 wrote to memory of 3132 4056 cmd.exe 97 PID 4056 wrote to memory of 3132 4056 cmd.exe 97 PID 1504 wrote to memory of 4452 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 98 PID 1504 wrote to memory of 4452 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 98 PID 1504 wrote to memory of 4452 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 98 PID 1504 wrote to memory of 4840 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 101 PID 1504 wrote to memory of 4840 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 101 PID 1504 wrote to memory of 4840 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 101 PID 1504 wrote to memory of 4548 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 103 PID 1504 wrote to memory of 4548 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 103 PID 1504 wrote to memory of 4548 1504 13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe 103 PID 4548 wrote to memory of 2388 4548 csrss.exe 104 PID 4548 wrote to memory of 2388 4548 csrss.exe 104 PID 4548 wrote to memory of 2388 4548 csrss.exe 104 PID 4548 wrote to memory of 1988 4548 csrss.exe 109 PID 4548 wrote to memory of 1988 4548 csrss.exe 109 PID 4548 wrote to memory of 1988 4548 csrss.exe 109 PID 4548 wrote to memory of 4496 4548 csrss.exe 112 PID 4548 wrote to memory of 4496 4548 csrss.exe 112 PID 4548 wrote to memory of 4496 4548 csrss.exe 112 PID 4548 wrote to memory of 2852 4548 csrss.exe 114 PID 4548 wrote to memory of 2852 4548 csrss.exe 114 PID 2100 wrote to memory of 3896 2100 windefender.exe 120 PID 2100 wrote to memory of 3896 2100 windefender.exe 120 PID 2100 wrote to memory of 3896 2100 windefender.exe 120 PID 3896 wrote to memory of 3700 3896 cmd.exe 121 PID 3896 wrote to memory of 3700 3896 cmd.exe 121 PID 3896 wrote to memory of 3700 3896 cmd.exe 121 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe"C:\Users\Admin\AppData\Local\Temp\13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
C:\Users\Admin\AppData\Local\Temp\13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe"C:\Users\Admin\AppData\Local\Temp\13adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3132
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4840
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4740
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1600
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2852
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4384
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4240
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD530490c4fa80b944b1e269f133df1ea5b
SHA1262c671e4be42404769854e241092db10f8f1ba5
SHA2560b646a80e949e6694c99243b37edc1edaafaf6381c3cecc9d6d8f6f5a4f5247c
SHA51210ee6ce778fc9e101e2a73041ee93569675eb6ffe9e5fefbf757125c900f1bcd7ac83cf252cc18463b6328c2fbe2a57773b6a83d2131333055de5c20293d5f3b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5b38d411654819a4b3686c57f5e430822
SHA1fadfa3c3e0d307dcc6e1e60c211bbebf999787d7
SHA256e120a911e471bc8eded634b9a3792c27c1cd71ac8e37204789b0eb6851d3f36b
SHA51286ccdaca516492eadfda966c0eb5e1e8a6673402d8b4657c179cf5a8282c458c4f91444f32c3ed34da7641c3a96227cd2cd833b29d3d542f10cdb02a09f1cf31
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5453b200dcfa0eb49b3e387e394793af2
SHA1437a1d927b035274f0b03282c5b4ea0d8161a7c2
SHA256917a522b705c61d8496a57ccab89ffc07dd94406257fb2d6719557e642acba70
SHA512c3c6cf4f26135249452671bcdd36fb54844a99d342b326d2d4de6a9aecc4a681fed0ca51ddf7d3a644cfe78560baed6675e5892f44b79f0c14c2fd5cc5750de1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD516d23c7f71b0f1d4f12395bac8220911
SHA15879424b022b5e9a64c4924c7a7c48a2db089ab9
SHA256e66629c5a1382bc6a52375eba8d0e78c9c395dac7f4896ebf74669869cf1b328
SHA51228f5ff447e97b6378170a96985032846e738ab8eaf249a5849754dd1b8ecd2e5aa935c712e7ec52d4c69e3d516988db770bdb370b9b552525063f7c6c17f2361
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD58c9d578f613d0d8885a91c1f9c3f237a
SHA1102d2c1102d6fcc49ef778c28d4255218c8d225e
SHA2561478c33f6304183b2afb2bc83a1844bb4337e91fce28e99425cd6294c7077a77
SHA5122dec526514c3ddbf226b04c6bc27d54c6facd7504292a03a6e6e8ec81e948b190cd034360f45b2f325e1dca8ccf1a7eb8ff8431080a92237c122aaba0a1ab1c7
-
Filesize
4.2MB
MD5445fd17cf81c9ca1888e01cd857e3973
SHA1c9104c9ba8af6aa51b91391bab2f7c26d2620cae
SHA25613adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12
SHA5128542933205d1e12bd148b707014645a31dc0c91cfd3130268b7d5a9f23a51940057c757d523368adccfca1c08d4048295e2b02a74674c784d515feb630e5e0b4
-
Filesize
4.2MB
MD5445fd17cf81c9ca1888e01cd857e3973
SHA1c9104c9ba8af6aa51b91391bab2f7c26d2620cae
SHA25613adeea84a682bd402a321c8b1289ec3def4ebc2a3d87edff436492311e7ee12
SHA5128542933205d1e12bd148b707014645a31dc0c91cfd3130268b7d5a9f23a51940057c757d523368adccfca1c08d4048295e2b02a74674c784d515feb630e5e0b4
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec