Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe
Resource
win7-20230831-en
General
-
Target
c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe
-
Size
4.2MB
-
MD5
e3d93cc9f7e1bf8a3746896c8e254081
-
SHA1
2e4ae32f6090526b47f3d9c2df43803871dda504
-
SHA256
c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a
-
SHA512
d9c012187bf8babadf335a35b8819a42e22607ff5571cd8902ecb3e5b699b3701ce3d13ddfd5b9e37139b7727c4d5020d3587b5434caae50450913ac50b2ac8d
-
SSDEEP
98304:uIxiUJINe1gHFmAQ6IRhLN0OuRc9DpYz7xII3zmdLQ7k:RiOG4gHFmAQ620m/q7+aSS7k
Malware Config
Signatures
-
Glupteba payload 21 IoCs
resource yara_rule behavioral2/memory/868-2-0x0000000002F00000-0x00000000037EB000-memory.dmp family_glupteba behavioral2/memory/868-3-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/868-29-0x0000000002F00000-0x00000000037EB000-memory.dmp family_glupteba behavioral2/memory/868-31-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/868-48-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/868-58-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2348-61-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2348-98-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2348-155-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-237-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-257-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-258-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-259-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-260-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-261-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-262-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-263-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-264-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-265-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-266-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/4804-267-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1896 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 4804 csrss.exe 620 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe File created C:\Windows\rss\csrss.exe c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2968 868 WerFault.exe 81 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4840 schtasks.exe 2880 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3228 powershell.exe 3228 powershell.exe 868 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 868 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 5112 powershell.exe 5112 powershell.exe 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 4240 powershell.exe 4240 powershell.exe 2944 powershell.exe 2944 powershell.exe 1776 powershell.exe 1776 powershell.exe 2700 powershell.exe 2700 powershell.exe 2264 powershell.exe 2264 powershell.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 4804 csrss.exe 4804 csrss.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 4804 csrss.exe 4804 csrss.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe 620 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 3228 powershell.exe Token: SeDebugPrivilege 868 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Token: SeImpersonatePrivilege 868 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe Token: SeDebugPrivilege 5112 powershell.exe Token: SeDebugPrivilege 4240 powershell.exe Token: SeDebugPrivilege 2944 powershell.exe Token: SeDebugPrivilege 1776 powershell.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeDebugPrivilege 2264 powershell.exe Token: SeSystemEnvironmentPrivilege 4804 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 868 wrote to memory of 3228 868 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 87 PID 868 wrote to memory of 3228 868 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 87 PID 868 wrote to memory of 3228 868 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 87 PID 2348 wrote to memory of 5112 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 99 PID 2348 wrote to memory of 5112 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 99 PID 2348 wrote to memory of 5112 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 99 PID 2348 wrote to memory of 2704 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 100 PID 2348 wrote to memory of 2704 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 100 PID 2704 wrote to memory of 1896 2704 cmd.exe 102 PID 2704 wrote to memory of 1896 2704 cmd.exe 102 PID 2348 wrote to memory of 4240 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 103 PID 2348 wrote to memory of 4240 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 103 PID 2348 wrote to memory of 4240 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 103 PID 2348 wrote to memory of 2944 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 106 PID 2348 wrote to memory of 2944 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 106 PID 2348 wrote to memory of 2944 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 106 PID 2348 wrote to memory of 4804 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 108 PID 2348 wrote to memory of 4804 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 108 PID 2348 wrote to memory of 4804 2348 c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe 108 PID 4804 wrote to memory of 1776 4804 csrss.exe 110 PID 4804 wrote to memory of 1776 4804 csrss.exe 110 PID 4804 wrote to memory of 1776 4804 csrss.exe 110 PID 4804 wrote to memory of 2700 4804 csrss.exe 114 PID 4804 wrote to memory of 2700 4804 csrss.exe 114 PID 4804 wrote to memory of 2700 4804 csrss.exe 114 PID 4804 wrote to memory of 2264 4804 csrss.exe 118 PID 4804 wrote to memory of 2264 4804 csrss.exe 118 PID 4804 wrote to memory of 2264 4804 csrss.exe 118 PID 4804 wrote to memory of 620 4804 csrss.exe 122 PID 4804 wrote to memory of 620 4804 csrss.exe 122 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe"C:\Users\Admin\AppData\Local\Temp\c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Users\Admin\AppData\Local\Temp\c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe"C:\Users\Admin\AppData\Local\Temp\c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1896
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2944
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2580
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2880
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:620
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4840
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 868 -s 8122⤵
- Program crash
PID:2968
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 868 -ip 8681⤵PID:540
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5d40cd1c8862824602e4bff5b2e7ed90a
SHA1351db8febf2dc094a001cbd89d892265d7066086
SHA256fab4cf66c5299ede3863d3e5b6530aaf4cb5126426952d9a31236a55e809bb01
SHA5125ff67d6c0198bc493c99c9409be70f59d59696a87ed13740d3d95fddeabb0a89d37733e0de488124cad2ccc1df82a18c024e40522a9089745d45456d07b7a229
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a73c85a804a399175e4bd57bd345f604
SHA1e1ddcd5af2035a0c069eb4346160c95a6cb59374
SHA25648146c1b04b13691f400c45b92be5e21be56af9e03aa0efd529a71da572128be
SHA512fcd40742f80328a8c77b86e875e928be86ed41096cc38a0e55149771260ae55d7fd05c77dd10bfdf6cd5edbbad4ce60d5c0fc5e9e3aa342b86ada0381e0adcaf
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD590b6efbcc16517c21a0cb6cc75ebe904
SHA16112ef31763a743967ec81bafb39d2971b94cf1a
SHA2560dab338f6300693b64d2ed1c2dadd8c1051356a204dfc097625c8278edea58be
SHA512981305b70b34b1ca389ecf12bec6419773dcf540ae255086303c73458d125ba2232e675333839c620fb590d1a4c5f0b86da764d8ceb827bee7609bd911c3bc55
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e3f57d5e3b3578267f03e08ec18cd23b
SHA15bdcf36fbaa8dc1b914b92dea69084461ce02a1a
SHA2567b5020cd9f82b80aa673f3ebf995669e6756fa5ea9dfe3731c1fe8b272a988d8
SHA5122edd8b4f2592c19ca0b96f180e0b24d675cde1e6be3bc983ca32230296814f8fc6ffb569b6699a7fffa87e7fe4d2a43418f1c65db5208b53c3af34658b314a43
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5544006324c9c14317ee372ea8d3ef739
SHA16452648fa38d05eb45e2a6730924189eec22dd8d
SHA2568094bfd4f6f6b2d2e2dffe4bba0045a6c81a7323907ffae01561c1a5483f978b
SHA51216e2edc27156b73d7f20a8c5198882d35fec2e5555fa869c2c06e5395bec7602bdfb4209f21ae31ca748cf4f68b01c920e415191afa548d9fa5a5cda5ca80597
-
Filesize
4.2MB
MD5e3d93cc9f7e1bf8a3746896c8e254081
SHA12e4ae32f6090526b47f3d9c2df43803871dda504
SHA256c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a
SHA512d9c012187bf8babadf335a35b8819a42e22607ff5571cd8902ecb3e5b699b3701ce3d13ddfd5b9e37139b7727c4d5020d3587b5434caae50450913ac50b2ac8d
-
Filesize
4.2MB
MD5e3d93cc9f7e1bf8a3746896c8e254081
SHA12e4ae32f6090526b47f3d9c2df43803871dda504
SHA256c5744c100c12c3d3a9e599a33309c8d5926131dacb7f2be75142a798e303452a
SHA512d9c012187bf8babadf335a35b8819a42e22607ff5571cd8902ecb3e5b699b3701ce3d13ddfd5b9e37139b7727c4d5020d3587b5434caae50450913ac50b2ac8d