Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22/09/2023, 07:50
Static task
static1
General
-
Target
145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe
-
Size
4.1MB
-
MD5
e927490e119fedf92bdfdbabb6ad5a17
-
SHA1
2dece546602ba55890fc791656e7ec4027a40f48
-
SHA256
145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9
-
SHA512
7e5380838f90c7bd9095d2e51461526559eda900210984d129dab053ce2084f9ad0f7c66167b03c59acc30929611c76ad105365b390c6825840c7af2ed10c733
-
SSDEEP
98304:vZvizi9TYcdcmJwy08hZjaU8DpJ/7O248HCT:R6zi9T/CmJwZ8jaU8Dn7O248i
Malware Config
Signatures
-
Glupteba payload 21 IoCs
resource yara_rule behavioral1/memory/3212-1-0x0000000002FF0000-0x00000000038DB000-memory.dmp family_glupteba behavioral1/memory/3212-2-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3212-3-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3212-22-0x0000000002FF0000-0x00000000038DB000-memory.dmp family_glupteba behavioral1/memory/3212-50-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/3212-59-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2728-61-0x0000000002F20000-0x000000000380B000-memory.dmp family_glupteba behavioral1/memory/2728-62-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2728-92-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2728-96-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2728-125-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/2728-157-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4464-190-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4464-258-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4464-259-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4464-260-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4464-261-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4464-262-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4464-263-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4464-264-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4464-265-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4492 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 4464 csrss.exe 2196 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe File created C:\Windows\rss\csrss.exe 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3784 3212 WerFault.exe 84 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1452 schtasks.exe 900 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 432 powershell.exe 432 powershell.exe 3212 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 3212 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 1248 powershell.exe 1248 powershell.exe 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 4528 powershell.exe 4528 powershell.exe 620 powershell.exe 620 powershell.exe 4748 powershell.exe 4748 powershell.exe 3604 powershell.exe 3604 powershell.exe 4124 powershell.exe 4124 powershell.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 4464 csrss.exe 4464 csrss.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 4464 csrss.exe 4464 csrss.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe 2196 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 432 powershell.exe Token: SeDebugPrivilege 3212 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Token: SeImpersonatePrivilege 3212 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe Token: SeDebugPrivilege 1248 powershell.exe Token: SeDebugPrivilege 4528 powershell.exe Token: SeDebugPrivilege 620 powershell.exe Token: SeDebugPrivilege 4748 powershell.exe Token: SeDebugPrivilege 3604 powershell.exe Token: SeDebugPrivilege 4124 powershell.exe Token: SeSystemEnvironmentPrivilege 4464 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3212 wrote to memory of 432 3212 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 88 PID 3212 wrote to memory of 432 3212 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 88 PID 3212 wrote to memory of 432 3212 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 88 PID 2728 wrote to memory of 1248 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 95 PID 2728 wrote to memory of 1248 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 95 PID 2728 wrote to memory of 1248 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 95 PID 2728 wrote to memory of 1320 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 100 PID 2728 wrote to memory of 1320 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 100 PID 1320 wrote to memory of 4492 1320 cmd.exe 101 PID 1320 wrote to memory of 4492 1320 cmd.exe 101 PID 2728 wrote to memory of 4528 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 102 PID 2728 wrote to memory of 4528 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 102 PID 2728 wrote to memory of 4528 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 102 PID 2728 wrote to memory of 620 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 104 PID 2728 wrote to memory of 620 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 104 PID 2728 wrote to memory of 620 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 104 PID 2728 wrote to memory of 4464 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 106 PID 2728 wrote to memory of 4464 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 106 PID 2728 wrote to memory of 4464 2728 145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe 106 PID 4464 wrote to memory of 4748 4464 csrss.exe 107 PID 4464 wrote to memory of 4748 4464 csrss.exe 107 PID 4464 wrote to memory of 4748 4464 csrss.exe 107 PID 4464 wrote to memory of 3604 4464 csrss.exe 113 PID 4464 wrote to memory of 3604 4464 csrss.exe 113 PID 4464 wrote to memory of 3604 4464 csrss.exe 113 PID 4464 wrote to memory of 4124 4464 csrss.exe 115 PID 4464 wrote to memory of 4124 4464 csrss.exe 115 PID 4464 wrote to memory of 4124 4464 csrss.exe 115 PID 4464 wrote to memory of 2196 4464 csrss.exe 119 PID 4464 wrote to memory of 2196 4464 csrss.exe 119 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe"C:\Users\Admin\AppData\Local\Temp\145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432
-
-
C:\Users\Admin\AppData\Local\Temp\145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe"C:\Users\Admin\AppData\Local\Temp\145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1248
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4492
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:620
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4748
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1452
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3784
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2196
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:900
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 9282⤵
- Program crash
PID:3784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3212 -ip 32121⤵PID:4204
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD58b9d1939a51fd6137a3a427faa1d9a15
SHA156a41caa61b4bb21fc2c5aea312882453e4c90bd
SHA25684cb939ad579dbfd780a99bce00d000b47f4192df6e6f96e2a29a85dad3e9bd0
SHA512149e6cf13c9761c111c905aded40b675c6381069fd264df29176b6d9ef5d15ca14157aabcbfb5c3243f825600cc6deb1e040945f99d3caf3f42aa3509ac7195a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD564a81e6cb6a28c733731d41f7c9f183c
SHA17ab0d0f5ae1e0748669b4e8e6d5f85c16fdc89ce
SHA2565ce387751d59c00a81d535efccae47e4bbe35b980f7e9e11d5dba6097a06dbe7
SHA512df789c3ee7161c02f1bc1360acde3e0ba382397997916e87015c6ae9fc061575d6e3a2948dfd8246310678b8970001467e13cbbdce99ac6816739dbc73a9fd4c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD595ba8ec4eb001c7eb6f57173000b76eb
SHA1db956d9c6b66579e86ddb071e03839571a5ef807
SHA2561fc6374b3842b25cda02347fb6d46534b85577131d4b7ffe907df71f643e5fa2
SHA512a0c5e8d9c8b0807068bff982cb9cf1a675dfcf2771e80e121553c8c27773dc8f349eb22c7f741efda3cb6bd55fc63681941251562c989f864e51dd31ad0f2102
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5fc3c51622e307a3c98f3e6373ee3c2ee
SHA1709ac026713554e2d35a69e646481426cb0ebcd6
SHA25688f0b942a886c9fdf685eba4a79aecc41f079feb133e34ad81194535252bb449
SHA5121ea4b89deceb8c01fa5abac9ef146c90912be2159f08d414435ae4295dceae43aed8c5f87bec0a6a89fe4fc6b14bf875bc88f4223d7401b20f579bfa8ce580ae
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD51db6e6475cb05718c5dea56c192eec4e
SHA16a8eecd8ef1dd38f28b992cd795e4f39f0d9d701
SHA256b3abf0fba5d66ddf8b1adf0d9620313880ae1dc290082e721af97f8d0d64dcef
SHA512b38c8442c0a0fc976992ad0cb68e805d6350a69c84d41510d56b2a8767a801dec7d53e19f90c6573279fe475a2e377b25845edd3ccf0f62923760bdfaadf54e0
-
Filesize
4.1MB
MD5e927490e119fedf92bdfdbabb6ad5a17
SHA12dece546602ba55890fc791656e7ec4027a40f48
SHA256145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9
SHA5127e5380838f90c7bd9095d2e51461526559eda900210984d129dab053ce2084f9ad0f7c66167b03c59acc30929611c76ad105365b390c6825840c7af2ed10c733
-
Filesize
4.1MB
MD5e927490e119fedf92bdfdbabb6ad5a17
SHA12dece546602ba55890fc791656e7ec4027a40f48
SHA256145ffbb68dd96e43ab294aec1d0979f5495fc3c3b34299dd4342ff6610fc56b9
SHA5127e5380838f90c7bd9095d2e51461526559eda900210984d129dab053ce2084f9ad0f7c66167b03c59acc30929611c76ad105365b390c6825840c7af2ed10c733