Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
05/10/2023, 13:25
Static task
static1
General
-
Target
7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe
-
Size
4.1MB
-
MD5
b1b5d6204253f7d60330b4146365ef5a
-
SHA1
074e5e4894812ffc17a2a2ab5a44ceea266dcf78
-
SHA256
7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c
-
SHA512
64834d5b2574ef3089eadfb7ca1a803391d705be7237e13837ac6a9d894893fefbdde6914a997a538e2a79a541916096886e23d53b22244238d238d4720fdac8
-
SSDEEP
98304:2sgW9rfApQAQ5yzwO1Y/4kXG7tUkbcQ+fSRxyDIXZfS6QZnn:2shlMrQ5yzwOC/nXG7NcbfSRcDgVr2n
Malware Config
Signatures
-
Glupteba payload 20 IoCs
resource yara_rule behavioral1/memory/608-2-0x0000000005070000-0x000000000595B000-memory.dmp family_glupteba behavioral1/memory/608-3-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/608-14-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/608-17-0x0000000005070000-0x000000000595B000-memory.dmp family_glupteba behavioral1/memory/608-295-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/608-306-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/2880-309-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/2880-332-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/2880-569-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/2880-837-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/2880-1057-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/4804-1060-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/4804-1097-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/4804-1414-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/4804-1809-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/4804-1810-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/4804-1811-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/4804-1819-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/4804-1821-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba behavioral1/memory/4804-1823-0x0000000000400000-0x0000000002FB7000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 984 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 4804 csrss.exe 3116 injector.exe 3720 windefender.exe 2012 windefender.exe -
resource yara_rule behavioral1/files/0x000700000001affe-1814.dat upx behavioral1/files/0x000700000001affe-1816.dat upx behavioral1/files/0x000700000001affe-1817.dat upx behavioral1/memory/3720-1818-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2012-1820-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2445638973-2158012892-84912826-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe File created C:\Windows\rss\csrss.exe 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3132 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4592 schtasks.exe 356 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1144 powershell.exe 1144 powershell.exe 1144 powershell.exe 608 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 608 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 4036 powershell.exe 4036 powershell.exe 4036 powershell.exe 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 4624 powershell.exe 4624 powershell.exe 4624 powershell.exe 3144 powershell.exe 3144 powershell.exe 3144 powershell.exe 4556 powershell.exe 4556 powershell.exe 4556 powershell.exe 2180 powershell.exe 2180 powershell.exe 2180 powershell.exe 4416 powershell.exe 4416 powershell.exe 4416 powershell.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 4804 csrss.exe 4804 csrss.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 4804 csrss.exe 4804 csrss.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe 3116 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1144 powershell.exe Token: SeDebugPrivilege 608 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Token: SeImpersonatePrivilege 608 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe Token: SeDebugPrivilege 4036 powershell.exe Token: SeDebugPrivilege 4624 powershell.exe Token: SeDebugPrivilege 3144 powershell.exe Token: SeDebugPrivilege 4556 powershell.exe Token: SeDebugPrivilege 2180 powershell.exe Token: SeDebugPrivilege 4416 powershell.exe Token: SeSystemEnvironmentPrivilege 4804 csrss.exe Token: SeSecurityPrivilege 3132 sc.exe Token: SeSecurityPrivilege 3132 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 608 wrote to memory of 1144 608 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 71 PID 608 wrote to memory of 1144 608 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 71 PID 608 wrote to memory of 1144 608 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 71 PID 2880 wrote to memory of 4036 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 76 PID 2880 wrote to memory of 4036 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 76 PID 2880 wrote to memory of 4036 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 76 PID 2880 wrote to memory of 2400 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 78 PID 2880 wrote to memory of 2400 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 78 PID 2400 wrote to memory of 984 2400 cmd.exe 80 PID 2400 wrote to memory of 984 2400 cmd.exe 80 PID 2880 wrote to memory of 4624 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 81 PID 2880 wrote to memory of 4624 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 81 PID 2880 wrote to memory of 4624 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 81 PID 2880 wrote to memory of 3144 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 83 PID 2880 wrote to memory of 3144 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 83 PID 2880 wrote to memory of 3144 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 83 PID 2880 wrote to memory of 4804 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 85 PID 2880 wrote to memory of 4804 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 85 PID 2880 wrote to memory of 4804 2880 7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe 85 PID 4804 wrote to memory of 4556 4804 csrss.exe 86 PID 4804 wrote to memory of 4556 4804 csrss.exe 86 PID 4804 wrote to memory of 4556 4804 csrss.exe 86 PID 4804 wrote to memory of 2180 4804 csrss.exe 92 PID 4804 wrote to memory of 2180 4804 csrss.exe 92 PID 4804 wrote to memory of 2180 4804 csrss.exe 92 PID 4804 wrote to memory of 4416 4804 csrss.exe 95 PID 4804 wrote to memory of 4416 4804 csrss.exe 95 PID 4804 wrote to memory of 4416 4804 csrss.exe 95 PID 4804 wrote to memory of 3116 4804 csrss.exe 97 PID 4804 wrote to memory of 3116 4804 csrss.exe 97 PID 3720 wrote to memory of 1356 3720 windefender.exe 105 PID 3720 wrote to memory of 1356 3720 windefender.exe 105 PID 3720 wrote to memory of 1356 3720 windefender.exe 105 PID 1356 wrote to memory of 3132 1356 cmd.exe 106 PID 1356 wrote to memory of 3132 1356 cmd.exe 106 PID 1356 wrote to memory of 3132 1356 cmd.exe 106 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe"C:\Users\Admin\AppData\Local\Temp\7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
-
C:\Users\Admin\AppData\Local\Temp\7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe"C:\Users\Admin\AppData\Local\Temp\7a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:984
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4556
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4592
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:508
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3116
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:356
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3132
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2012
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD56a53ac1983c066a828400b84e71e039c
SHA1662441c60408f5f2c0deb27e291ac72344a8f9f6
SHA256dac6ac8df2073281ce72a50cca8841834e81c9c86a1cd534f4cdd9be7a300b96
SHA51240f52e06228a54d850437c715cd491c8c85349d43b7bbe2cd4c234ed111fb38cfbe838605fbdfc1382cdc2b5f6503af79ceb8ca6944ae41b2cb04bd945c70583
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD57a75e89665c3c7a37ade89ff7ad6187b
SHA1f58b04ab317aa872aed21358fe0fb0f0a7b4251b
SHA256a6d52b27913ab578e2b250e4cfd9d1ca1dbc21bd99a8ef829aaf81a047896cf9
SHA51238654ebf2ef3c56e51eca9f3b3b384b77f78cce91e48087521435b3cd05e441654cf2197c28f919a6c8976543e9bc4a06686b4ed308842f67b6e01b95285c353
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5bff4f5b1778b9505881f84657222ea66
SHA1aca7e09fe031a6897032d17b11f78865fdb0ea4b
SHA256aa6d0e43e24b8d904e3fb7ee15790495576f9a44d77d23515969949c24f29b9b
SHA51239bddf312a5413927fe11f75b799e4af23ac98243d0470cf5f8df3947013448f61b9a507a8c963645b8084e6bd326f91d08fe0ddb3bc05b6abcc82a78c8c74cd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5a1df27e6a221fee13916a25e72787948
SHA10ecd615fa80a27426110744452c09ea140a4fc70
SHA2562a6f8daba8cbb3795f99f27a1d9aceda0c9230de6ed9fece1bcc5710c5f8b202
SHA512676b0465411b6e5cdbf0b3b11f3254614417e086ef776383a0a281ee611f1bb6dc6f9b254efd5f8b6651d739eab7d3da08c82f9c85fd7d63d7c73a9cd7410e1b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD50deb8b9983e16424957561b8ca8a8611
SHA195df285cec9c571a6bdb4d34dfb04f152d762db4
SHA256457f3e3e47c8d56f393083f8ea02f2bbf6690e57eae11eac00bd73daba5e0b36
SHA5122c3c755d9ed55fe1c13c5ed294173a2cc20df1faefdf5d70361b340d0111da432f5026fab409777e91995a6ad5c2d6fc3e407b2f3642b1d6e358ebf91b5fdbb2
-
Filesize
4.1MB
MD5b1b5d6204253f7d60330b4146365ef5a
SHA1074e5e4894812ffc17a2a2ab5a44ceea266dcf78
SHA2567a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c
SHA51264834d5b2574ef3089eadfb7ca1a803391d705be7237e13837ac6a9d894893fefbdde6914a997a538e2a79a541916096886e23d53b22244238d238d4720fdac8
-
Filesize
4.1MB
MD5b1b5d6204253f7d60330b4146365ef5a
SHA1074e5e4894812ffc17a2a2ab5a44ceea266dcf78
SHA2567a76874f931ff8c8874c4dd511426057ef6fd3541829080a4454b2c5ca1b876c
SHA51264834d5b2574ef3089eadfb7ca1a803391d705be7237e13837ac6a9d894893fefbdde6914a997a538e2a79a541916096886e23d53b22244238d238d4720fdac8
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec