Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
35s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2023, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe
Resource
win7-20230831-en
General
-
Target
4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe
-
Size
4.2MB
-
MD5
ae8b469776db2c1cb6761a351ba8315e
-
SHA1
df41fb7099ece9fd6acee8da00b7b54acef378d1
-
SHA256
4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358
-
SHA512
25138323836a5cab0cfc6aba5f74c44f1fcc3dc3ee144191a05962e4ae20dd10f151e1e1f7dc1d3e09ebf7470eb3095c3fb6650b8dabea8d6fcb371bae3d8858
-
SSDEEP
98304:jPisFK/8uM75gZt+y9kRZ+r2YOUQ1QQTOc8FgNKYKuIT:WFW6PkRZ+izUpQqmXLIT
Malware Config
Signatures
-
Glupteba payload 10 IoCs
resource yara_rule behavioral2/memory/732-2-0x0000000002F30000-0x000000000381B000-memory.dmp family_glupteba behavioral2/memory/732-3-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/732-30-0x0000000002F30000-0x000000000381B000-memory.dmp family_glupteba behavioral2/memory/732-32-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/732-50-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2768-61-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2768-106-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/732-122-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2768-139-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2768-240-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2044 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 1260 csrss.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe File created C:\Windows\rss\csrss.exe 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 8 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 5024 powershell.exe 5024 powershell.exe 732 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 732 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 640 powershell.exe 640 powershell.exe 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 1156 powershell.exe 1156 powershell.exe 3080 powershell.exe 3080 powershell.exe 3508 powershell.exe 3508 powershell.exe 1904 powershell.exe 1904 powershell.exe 5020 powershell.exe 5020 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 5024 powershell.exe Token: SeDebugPrivilege 732 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Token: SeImpersonatePrivilege 732 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe Token: SeDebugPrivilege 640 powershell.exe Token: SeDebugPrivilege 1156 powershell.exe Token: SeDebugPrivilege 3080 powershell.exe Token: SeDebugPrivilege 3508 powershell.exe Token: SeDebugPrivilege 1904 powershell.exe Token: SeDebugPrivilege 5020 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 732 wrote to memory of 5024 732 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 84 PID 732 wrote to memory of 5024 732 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 84 PID 732 wrote to memory of 5024 732 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 84 PID 2768 wrote to memory of 640 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 92 PID 2768 wrote to memory of 640 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 92 PID 2768 wrote to memory of 640 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 92 PID 2768 wrote to memory of 3308 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 114 PID 2768 wrote to memory of 3308 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 114 PID 3308 wrote to memory of 2044 3308 Conhost.exe 99 PID 3308 wrote to memory of 2044 3308 Conhost.exe 99 PID 2768 wrote to memory of 1156 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 100 PID 2768 wrote to memory of 1156 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 100 PID 2768 wrote to memory of 1156 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 100 PID 2768 wrote to memory of 3080 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 102 PID 2768 wrote to memory of 3080 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 102 PID 2768 wrote to memory of 3080 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 102 PID 2768 wrote to memory of 1260 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 104 PID 2768 wrote to memory of 1260 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 104 PID 2768 wrote to memory of 1260 2768 4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe 104 PID 1260 wrote to memory of 3508 1260 csrss.exe 106 PID 1260 wrote to memory of 3508 1260 csrss.exe 106 PID 1260 wrote to memory of 3508 1260 csrss.exe 106 PID 1260 wrote to memory of 1904 1260 csrss.exe 110 PID 1260 wrote to memory of 1904 1260 csrss.exe 110 PID 1260 wrote to memory of 1904 1260 csrss.exe 110 PID 1260 wrote to memory of 5020 1260 csrss.exe 115 PID 1260 wrote to memory of 5020 1260 csrss.exe 115 PID 1260 wrote to memory of 5020 1260 csrss.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe"C:\Users\Admin\AppData\Local\Temp\4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5024
-
-
C:\Users\Admin\AppData\Local\Temp\4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe"C:\Users\Admin\AppData\Local\Temp\4603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵PID:3308
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2044
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3508
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:8
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1232
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of WriteProcessMemory
PID:3308
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5358e6bc95dc8cc4106f41ff739003989
SHA17c100654f1fb74a67337d30dbb723cc0ea29c01c
SHA2568b204408183df4e1ea6dfe0e8e79e49a89226bd78860f8f4ce00dc080b33a181
SHA5129d079fd7d9772c206260c0c84ad8cb84906d717d0fd4c984a438b7774c6ca2fda3062795ddaf0b6d26070ff0283a51992d0a754fe837ccb8ec70fe980b91c6c0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD53557623b6668b49f4db6527304474abe
SHA110c938a3fcb34aa24c043a1214f658a3e4c7d6a5
SHA256b0ba3717bf2484a3a2769f02605aba097b2da3246c12197cded128f65af571ef
SHA512de62ddeb71b07a31cf421cda6c0808b7bc92960d0b4d581089bbb01b8422058fd0de2127d9c6fd7d35b7f3f133bb78b95189e366e05550643da07fa9eee9f144
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e6026aa2c7414cbc626af381ad1f585c
SHA14c02fd6f4914b03d566b40f75d6a6140a06375d9
SHA256e886aa7a7281b4f5b4df7955dd03539ad569cc365800a629274db5fa06bc314c
SHA512bd509d418c8cdadcd0dcfc4b2eccfecc36505ec6e85fa321534cec2b56c5bc8a83d05cd143d93033a3e8f5f6d7223ab0227121dd1568e7b3de579090d2363a4b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD501a95cc735fc092e9e8acd999d3f2534
SHA10bb291b8eb7d64ea427931c25e8d11b3e2cf2fd2
SHA256254b492b6b0b358ee82d51128ee165271374f97e497d73457cce6badb8899615
SHA5128915e623837b94d2934eab49c13136c9fea3f5441a93deced64ed4c81dc32368ac7e1b1405e5afdc4e5a0cfce81071031d822173eacddd424cea6442501cec87
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5af493d7d66c89a3eb84e2efeae3fdf7f
SHA11935e1ef33b0da3a2cd9827e748b51184faf72fb
SHA256df8269e4974cf1f1e50d9fc188d4bcc46daf9809de007f8da68375b3edb8519e
SHA512a0ed5d0b09f24bd012052184576b1e2c05b3165b7de91959a66f86fe30b3c180f931837591ab10a8e20177d4500979d02079fbabedee799527d3563ed3da18b5
-
Filesize
4.2MB
MD5ae8b469776db2c1cb6761a351ba8315e
SHA1df41fb7099ece9fd6acee8da00b7b54acef378d1
SHA2564603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358
SHA51225138323836a5cab0cfc6aba5f74c44f1fcc3dc3ee144191a05962e4ae20dd10f151e1e1f7dc1d3e09ebf7470eb3095c3fb6650b8dabea8d6fcb371bae3d8858
-
Filesize
4.2MB
MD5ae8b469776db2c1cb6761a351ba8315e
SHA1df41fb7099ece9fd6acee8da00b7b54acef378d1
SHA2564603f0828ed85b5d89180e3978bb7a83b96ec2e11a20d9b309151ab15b747358
SHA51225138323836a5cab0cfc6aba5f74c44f1fcc3dc3ee144191a05962e4ae20dd10f151e1e1f7dc1d3e09ebf7470eb3095c3fb6650b8dabea8d6fcb371bae3d8858