Analysis
-
max time kernel
34s -
max time network
57s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2023, 16:09
Static task
static1
General
-
Target
e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe
-
Size
4.2MB
-
MD5
9a4282a1c46ea395d0f593c470e159de
-
SHA1
df0baae1f470902210d765efbe93d180ce9567c1
-
SHA256
e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25
-
SHA512
75a7d987f8a64215e404e67d4ddacb46922b7cee91773c76faf203135d905c2268d17fd839af0de747b0120974fd33df2b11eb0cf25c7818a181196750ad6472
-
SSDEEP
98304:1+040w4TjOwb/q8r4bwkYM/AG5gNGHGIfsaLHC1VDUfZzKfG4h4vz:OaF/qKkYM/D+NGmsDLHC4f0/E
Malware Config
Signatures
-
Glupteba payload 11 IoCs
resource yara_rule behavioral1/memory/1352-2-0x0000000004760000-0x000000000504B000-memory.dmp family_glupteba behavioral1/memory/1352-3-0x0000000000400000-0x0000000002670000-memory.dmp family_glupteba behavioral1/memory/1352-25-0x0000000004760000-0x000000000504B000-memory.dmp family_glupteba behavioral1/memory/1352-30-0x0000000000400000-0x0000000002670000-memory.dmp family_glupteba behavioral1/memory/1352-47-0x0000000000400000-0x0000000002670000-memory.dmp family_glupteba behavioral1/memory/3852-60-0x0000000004780000-0x000000000506B000-memory.dmp family_glupteba behavioral1/memory/3852-61-0x0000000000400000-0x0000000002670000-memory.dmp family_glupteba behavioral1/memory/1352-76-0x0000000000400000-0x0000000002670000-memory.dmp family_glupteba behavioral1/memory/3852-92-0x0000000000400000-0x0000000002670000-memory.dmp family_glupteba behavioral1/memory/3852-142-0x0000000000400000-0x0000000002670000-memory.dmp family_glupteba behavioral1/memory/3852-162-0x0000000000400000-0x0000000002670000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1752 netsh.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1956 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2420 powershell.exe 2420 powershell.exe 1352 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 1352 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 1012 powershell.exe 1012 powershell.exe 1012 powershell.exe 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 4820 powershell.exe 4820 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2420 powershell.exe Token: SeDebugPrivilege 1352 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Token: SeImpersonatePrivilege 1352 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe Token: SeDebugPrivilege 1012 powershell.exe Token: SeDebugPrivilege 4820 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1352 wrote to memory of 2420 1352 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 92 PID 1352 wrote to memory of 2420 1352 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 92 PID 1352 wrote to memory of 2420 1352 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 92 PID 3852 wrote to memory of 1012 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 104 PID 3852 wrote to memory of 1012 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 104 PID 3852 wrote to memory of 1012 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 104 PID 3852 wrote to memory of 1604 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 106 PID 3852 wrote to memory of 1604 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 106 PID 1604 wrote to memory of 1752 1604 cmd.exe 108 PID 1604 wrote to memory of 1752 1604 cmd.exe 108 PID 3852 wrote to memory of 4820 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 109 PID 3852 wrote to memory of 4820 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 109 PID 3852 wrote to memory of 4820 3852 e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe"C:\Users\Admin\AppData\Local\Temp\e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Users\Admin\AppData\Local\Temp\e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe"C:\Users\Admin\AppData\Local\Temp\e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25.exe"2⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1752
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:3364
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵PID:2144
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:3588
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1956
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3532
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:4420
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5204837c0f41a522004bf3c425afe9dc9
SHA123a002a73191ea3c2dc4c1aaa0e29e7f3cedae53
SHA256497af58db0f6ea8d71623efa45f443f4a845d741e036e26133618237c036eb46
SHA5127fa80b81522ac11b2af098019f52cdb372a6a7d64f3a4a00917587da8cb956b68a3ae10c54e12058bd3253ee599466af70f81fb986913ce40b1d577242cbaa73
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD510ec2ef3a07a163fa1b74c582348560d
SHA1bb80e1ae173fd410f01567aaace53e1c2419a2ae
SHA256f5d7399fe5855c03ac8296ec410a2e3cdde005248c90e4b9beee5c601ff62d59
SHA512c71083c90d32998d66992a3bd29d70ba874f0013a9c8e2431c3d386760a442293340813befab64bf1f823d71d95f8f698bf7abe2e0d0c83e21a166b1a4eac694
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD54ebd7094db149c1ab48ad708162d08b3
SHA19c68f247b71e19314f8338c633c78c393fe0ee4d
SHA256999ee283e88f3c859b139c12b69bd4bb8f12160d04702f49cd53cb51e2f6a85b
SHA512b8847a406b525f23bf0ba1dee6e380fc8aa27bb45cfa3f31ef3b45c16879cdaa6612a4fb7563e29efdbb58954cb7180d6d09f9a9cd2d1191cdbe473458b23bcb
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD58855da7ac77a90fcf9d7e9746ad5f6ea
SHA1289cad0774a9c4dc7889c6091b639cf70427fb77
SHA256a6074f4cd48dd4fefe91a1173ccb8aaa8c173161a360197a9b9d991f01e3b1dd
SHA512a545ce9973e243c5378dda29c3c1409b3ef73b2f7638330a5edf61c942377d1c340cb58b360c7e11c0e2d32be67f3a3809da4a4a26ceb093af596c4ca5be39fe
-
Filesize
4.2MB
MD59a4282a1c46ea395d0f593c470e159de
SHA1df0baae1f470902210d765efbe93d180ce9567c1
SHA256e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25
SHA51275a7d987f8a64215e404e67d4ddacb46922b7cee91773c76faf203135d905c2268d17fd839af0de747b0120974fd33df2b11eb0cf25c7818a181196750ad6472
-
Filesize
4.2MB
MD59a4282a1c46ea395d0f593c470e159de
SHA1df0baae1f470902210d765efbe93d180ce9567c1
SHA256e260a1566b80fbe5e546c08d0ee2229f383d4c4beb85a45a0a8978c52a0fdf25
SHA51275a7d987f8a64215e404e67d4ddacb46922b7cee91773c76faf203135d905c2268d17fd839af0de747b0120974fd33df2b11eb0cf25c7818a181196750ad6472