Analysis
-
max time kernel
67s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07-06-2023 12:46
Static task
static1
General
-
Target
f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe
-
Size
4.2MB
-
MD5
15851aef64e9d9a2dd03b5da99e1f943
-
SHA1
a07155e27a95f4534a09bda15d8187f26e27c97e
-
SHA256
f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8
-
SHA512
4442e5e0e3dc2bf6b4d3010213c914229274dc019c47569767ebe1df02c10d7ddb2a88440d3c199324750bc47ad4fd7e81fde6b506fa023c1de2c6e44c79fb07
-
SSDEEP
98304:75utYctoVARBg2MaaK1g5FJFgQb/OdplY5OuY4di3MrYj:742GQAvSM1iXFgQUplwOP4IMrYj
Malware Config
Signatures
-
Glupteba payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2604-134-0x0000000004C70000-0x000000000555B000-memory.dmp family_glupteba behavioral1/memory/2604-173-0x0000000000400000-0x0000000002959000-memory.dmp family_glupteba behavioral1/memory/2604-204-0x0000000000400000-0x0000000002959000-memory.dmp family_glupteba behavioral1/memory/636-218-0x0000000000400000-0x0000000002959000-memory.dmp family_glupteba behavioral1/memory/636-267-0x0000000000400000-0x0000000002959000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 2488 csrss.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe -
Drops file in Windows directory 2 IoCs
Processes:
f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exedescription ioc process File opened for modification C:\Windows\rss f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe File created C:\Windows\rss\csrss.exe f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
powershell.exef93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exepowershell.exef93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 5012 powershell.exe 5012 powershell.exe 2604 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 2604 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 4644 powershell.exe 4644 powershell.exe 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe 3300 powershell.exe 3300 powershell.exe 3340 powershell.exe 3340 powershell.exe 4976 powershell.exe 4976 powershell.exe 4728 powershell.exe 4728 powershell.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exef93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 5012 powershell.exe Token: SeDebugPrivilege 2604 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Token: SeImpersonatePrivilege 2604 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe Token: SeDebugPrivilege 4644 powershell.exe Token: SeDebugPrivilege 3300 powershell.exe Token: SeDebugPrivilege 3340 powershell.exe Token: SeDebugPrivilege 4976 powershell.exe Token: SeDebugPrivilege 4728 powershell.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exef93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.execmd.execsrss.exedescription pid process target process PID 2604 wrote to memory of 5012 2604 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 2604 wrote to memory of 5012 2604 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 2604 wrote to memory of 5012 2604 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 636 wrote to memory of 4644 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 636 wrote to memory of 4644 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 636 wrote to memory of 4644 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 636 wrote to memory of 4020 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe cmd.exe PID 636 wrote to memory of 4020 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe cmd.exe PID 4020 wrote to memory of 1208 4020 cmd.exe netsh.exe PID 4020 wrote to memory of 1208 4020 cmd.exe netsh.exe PID 636 wrote to memory of 3300 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 636 wrote to memory of 3300 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 636 wrote to memory of 3300 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 636 wrote to memory of 3340 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 636 wrote to memory of 3340 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 636 wrote to memory of 3340 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe powershell.exe PID 636 wrote to memory of 2488 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe csrss.exe PID 636 wrote to memory of 2488 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe csrss.exe PID 636 wrote to memory of 2488 636 f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe csrss.exe PID 2488 wrote to memory of 4976 2488 csrss.exe powershell.exe PID 2488 wrote to memory of 4976 2488 csrss.exe powershell.exe PID 2488 wrote to memory of 4976 2488 csrss.exe powershell.exe PID 2488 wrote to memory of 4728 2488 csrss.exe powershell.exe PID 2488 wrote to memory of 4728 2488 csrss.exe powershell.exe PID 2488 wrote to memory of 4728 2488 csrss.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe"C:\Users\Admin\AppData\Local\Temp\f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe"C:\Users\Admin\AppData\Local\Temp\f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vt5zlucz.klw.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5dbc0b6f99b5a27b8dd963456e05729cf
SHA1227fb9898d89b518c111ac3f8e1bb22e363e91af
SHA25677fbc89700731ab5ad9341aa5b3c707c7611d6ad667371a7b37cc558388d0e95
SHA51205a2fa7b2890fac41949c08cb556aa5951bf76ae7e83c809deb8be73c5b737d951849c9f1a3d9d95769833e9f485427b8736fab17f1c3aee22cf7c6bb67cc520
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5218063d4c801a04c03c96788bf0c09df
SHA1f4343464f9a71ef52699c8eeeabf84e12977657f
SHA2561e47178eee3a19f2c6d36623d2306b93914aa57929b0014558d2bde53af1a4a7
SHA51293aba80890c665da18385dcef95ee33e49c26fa8b1b9c00f16489aa744fe5b61e07f17a2a1503d5cec65279c025ca5d8d23246c92ed9a85607340f888e607be8
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5799e8b8b8896d5ae35c3382055cb3538
SHA1aca6e22d02fd05b068522dac9f6ed5a8109711cf
SHA256a65d6b116da73566686061d504e39f4afaae9b80a2f275b0d81e2f6026af322a
SHA512ebc619df4e7574ab67049559f48991bb2cb4881bfa98e24eb2d4f63314f2b0efdc7673c468a029eb9e3d0eb58247802cf0cf1e707c082ca7f14fa3f1a09e1a42
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD572f53c4a6fab879f90a75a4dc60023eb
SHA128278585f808719d9d4dcca988a4767de43cd261
SHA256e8be46d36e7d12ce6d6de5c0eae2b1b5f0d8b99ade667223b2645aef05d6117d
SHA5127e60928601dfc1eb0e134a3dba2756553c2acbed599877c4f5d949f23261f19f0c22818cf1aa1b4e060054bf20a43e9f352d39f0e81bdebd03da9637b0f21776
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD515851aef64e9d9a2dd03b5da99e1f943
SHA1a07155e27a95f4534a09bda15d8187f26e27c97e
SHA256f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8
SHA5124442e5e0e3dc2bf6b4d3010213c914229274dc019c47569767ebe1df02c10d7ddb2a88440d3c199324750bc47ad4fd7e81fde6b506fa023c1de2c6e44c79fb07
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD515851aef64e9d9a2dd03b5da99e1f943
SHA1a07155e27a95f4534a09bda15d8187f26e27c97e
SHA256f93570e38218ed19f5bb11f232309d26fe71fd0b2b108aa1e273cacec9c68dd8
SHA5124442e5e0e3dc2bf6b4d3010213c914229274dc019c47569767ebe1df02c10d7ddb2a88440d3c199324750bc47ad4fd7e81fde6b506fa023c1de2c6e44c79fb07
-
memory/636-218-0x0000000000400000-0x0000000002959000-memory.dmpFilesize
37.3MB
-
memory/636-267-0x0000000000400000-0x0000000002959000-memory.dmpFilesize
37.3MB
-
memory/2604-134-0x0000000004C70000-0x000000000555B000-memory.dmpFilesize
8.9MB
-
memory/2604-173-0x0000000000400000-0x0000000002959000-memory.dmpFilesize
37.3MB
-
memory/2604-204-0x0000000000400000-0x0000000002959000-memory.dmpFilesize
37.3MB
-
memory/3300-233-0x000000007FBF0000-0x000000007FC00000-memory.dmpFilesize
64KB
-
memory/3300-223-0x00000000709E0000-0x0000000070D34000-memory.dmpFilesize
3.3MB
-
memory/3300-222-0x0000000070260000-0x00000000702AC000-memory.dmpFilesize
304KB
-
memory/3300-221-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB
-
memory/3300-220-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB
-
memory/3300-219-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB
-
memory/3340-249-0x00000000045E0000-0x00000000045F0000-memory.dmpFilesize
64KB
-
memory/3340-236-0x00000000045E0000-0x00000000045F0000-memory.dmpFilesize
64KB
-
memory/3340-251-0x000000007F840000-0x000000007F850000-memory.dmpFilesize
64KB
-
memory/3340-250-0x00000000703E0000-0x0000000070734000-memory.dmpFilesize
3.3MB
-
memory/3340-248-0x0000000070260000-0x00000000702AC000-memory.dmpFilesize
304KB
-
memory/3340-237-0x00000000045E0000-0x00000000045F0000-memory.dmpFilesize
64KB
-
memory/4644-203-0x000000007FC00000-0x000000007FC10000-memory.dmpFilesize
64KB
-
memory/4644-180-0x0000000004570000-0x0000000004580000-memory.dmpFilesize
64KB
-
memory/4644-190-0x0000000004570000-0x0000000004580000-memory.dmpFilesize
64KB
-
memory/4644-191-0x0000000004570000-0x0000000004580000-memory.dmpFilesize
64KB
-
memory/4644-192-0x0000000070260000-0x00000000702AC000-memory.dmpFilesize
304KB
-
memory/4644-193-0x00000000709E0000-0x0000000070D34000-memory.dmpFilesize
3.3MB
-
memory/4728-306-0x0000000002F40000-0x0000000002F50000-memory.dmpFilesize
64KB
-
memory/4728-308-0x0000000070910000-0x0000000070C64000-memory.dmpFilesize
3.3MB
-
memory/4728-307-0x0000000070180000-0x00000000701CC000-memory.dmpFilesize
304KB
-
memory/4728-318-0x0000000002F40000-0x0000000002F50000-memory.dmpFilesize
64KB
-
memory/4728-305-0x0000000002F40000-0x0000000002F50000-memory.dmpFilesize
64KB
-
memory/4976-279-0x0000000004830000-0x0000000004840000-memory.dmpFilesize
64KB
-
memory/4976-292-0x000000007F060000-0x000000007F070000-memory.dmpFilesize
64KB
-
memory/4976-291-0x0000000004830000-0x0000000004840000-memory.dmpFilesize
64KB
-
memory/4976-281-0x00000000703E0000-0x0000000070734000-memory.dmpFilesize
3.3MB
-
memory/4976-280-0x0000000070260000-0x00000000702AC000-memory.dmpFilesize
304KB
-
memory/4976-278-0x0000000004830000-0x0000000004840000-memory.dmpFilesize
64KB
-
memory/5012-157-0x0000000007510000-0x0000000007542000-memory.dmpFilesize
200KB
-
memory/5012-176-0x00000000076F0000-0x00000000076F8000-memory.dmpFilesize
32KB
-
memory/5012-141-0x0000000005800000-0x0000000005866000-memory.dmpFilesize
408KB
-
memory/5012-174-0x00000000076B0000-0x00000000076BE000-memory.dmpFilesize
56KB
-
memory/5012-170-0x00000000074F0000-0x000000000750E000-memory.dmpFilesize
120KB
-
memory/5012-140-0x0000000005790000-0x00000000057F6000-memory.dmpFilesize
408KB
-
memory/5012-172-0x0000000007750000-0x00000000077E6000-memory.dmpFilesize
600KB
-
memory/5012-139-0x00000000050B0000-0x00000000050D2000-memory.dmpFilesize
136KB
-
memory/5012-138-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/5012-137-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/5012-136-0x0000000005160000-0x0000000005788000-memory.dmpFilesize
6.2MB
-
memory/5012-175-0x0000000007700000-0x000000000771A000-memory.dmpFilesize
104KB
-
memory/5012-151-0x0000000005F90000-0x0000000005FAE000-memory.dmpFilesize
120KB
-
memory/5012-152-0x0000000006550000-0x0000000006594000-memory.dmpFilesize
272KB
-
memory/5012-153-0x00000000072C0000-0x0000000007336000-memory.dmpFilesize
472KB
-
memory/5012-154-0x00000000079C0000-0x000000000803A000-memory.dmpFilesize
6.5MB
-
memory/5012-156-0x0000000004B20000-0x0000000004B30000-memory.dmpFilesize
64KB
-
memory/5012-135-0x0000000002650000-0x0000000002686000-memory.dmpFilesize
216KB
-
memory/5012-155-0x0000000007360000-0x000000000737A000-memory.dmpFilesize
104KB
-
memory/5012-159-0x000000007F9F0000-0x000000007FA00000-memory.dmpFilesize
64KB
-
memory/5012-158-0x0000000070260000-0x00000000702AC000-memory.dmpFilesize
304KB
-
memory/5012-160-0x0000000070400000-0x0000000070754000-memory.dmpFilesize
3.3MB
-
memory/5012-171-0x0000000007640000-0x000000000764A000-memory.dmpFilesize
40KB