Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 06:06
Static task
static1
General
-
Target
643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe
-
Size
4.1MB
-
MD5
943f28a2db3c700d6c097c4b4321b707
-
SHA1
56845d4d44bd257670fc9109b7d18e1fa79abcd5
-
SHA256
643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c
-
SHA512
c8255c1787a014bed2e1c9c8e82a568013f47c1dce3d69966d9fd92541c911ad601e10b3e9d292ace755f861ebd32f82a90db6e91770c9cfbed9c290826455fa
-
SSDEEP
98304:VWQJ3/SZh78Y2fGqAFWzjIygktZxbAwuNDww:4YUh78Y2+qAejXHbAw05
Malware Config
Signatures
-
Glupteba payload 19 IoCs
resource yara_rule behavioral1/memory/4820-2-0x0000000003050000-0x000000000393B000-memory.dmp family_glupteba behavioral1/memory/4820-3-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4820-24-0x0000000003050000-0x000000000393B000-memory.dmp family_glupteba behavioral1/memory/4820-26-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4820-58-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4848-61-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4848-89-0x0000000002A80000-0x0000000002E82000-memory.dmp family_glupteba behavioral1/memory/4848-94-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4848-95-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/4848-156-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1656-251-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1656-262-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1656-268-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1656-270-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1656-272-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1656-274-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1656-276-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1656-278-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral1/memory/1656-287-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4904 netsh.exe -
Executes dropped EXE 5 IoCs
pid Process 1656 csrss.exe 4904 injector.exe 4256 windefender.exe 2880 windefender.exe 1600 f801950a962ddba14caaa44bf084b55c.exe -
resource yara_rule behavioral1/files/0x0007000000022f48-261.dat upx behavioral1/files/0x0007000000022f48-264.dat upx behavioral1/files/0x0007000000022f48-265.dat upx behavioral1/memory/4256-267-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2880-269-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2880-273-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/files/0x000a000000022d24-283.dat upx behavioral1/files/0x000a000000022d24-285.dat upx behavioral1/memory/2880-286-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1600-288-0x0000000000400000-0x0000000000C25000-memory.dmp upx behavioral1/memory/1600-290-0x0000000000400000-0x0000000000C25000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Set value (str) \REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive schtasks.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe File created C:\Windows\rss\csrss.exe 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2452 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3336 schtasks.exe 1344 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates schtasks.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2112 powershell.exe 2112 powershell.exe 4820 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4820 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 1304 powershell.exe 1304 powershell.exe 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 4404 powershell.exe 4404 powershell.exe 4404 powershell.exe 3732 powershell.exe 3732 powershell.exe 3732 powershell.exe 1344 powershell.exe 1344 powershell.exe 1344 powershell.exe 2976 powershell.exe 2976 powershell.exe 2976 powershell.exe 1176 powershell.exe 1176 powershell.exe 1176 powershell.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 1656 csrss.exe 1656 csrss.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 1656 csrss.exe 1656 csrss.exe 4904 injector.exe 4904 injector.exe 1656 csrss.exe 1656 csrss.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe 4904 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2112 powershell.exe Token: SeDebugPrivilege 4820 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Token: SeImpersonatePrivilege 4820 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe Token: SeDebugPrivilege 1304 powershell.exe Token: SeDebugPrivilege 4404 powershell.exe Token: SeDebugPrivilege 3732 powershell.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeDebugPrivilege 2976 powershell.exe Token: SeDebugPrivilege 1176 powershell.exe Token: SeSystemEnvironmentPrivilege 1656 csrss.exe Token: SeSecurityPrivilege 2452 sc.exe Token: SeSecurityPrivilege 2452 sc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4820 wrote to memory of 2112 4820 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 92 PID 4820 wrote to memory of 2112 4820 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 92 PID 4820 wrote to memory of 2112 4820 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 92 PID 4848 wrote to memory of 1304 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 100 PID 4848 wrote to memory of 1304 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 100 PID 4848 wrote to memory of 1304 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 100 PID 4848 wrote to memory of 3080 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 102 PID 4848 wrote to memory of 3080 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 102 PID 3080 wrote to memory of 4904 3080 cmd.exe 104 PID 3080 wrote to memory of 4904 3080 cmd.exe 104 PID 4848 wrote to memory of 4404 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 106 PID 4848 wrote to memory of 4404 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 106 PID 4848 wrote to memory of 4404 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 106 PID 4848 wrote to memory of 3732 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 109 PID 4848 wrote to memory of 3732 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 109 PID 4848 wrote to memory of 3732 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 109 PID 4848 wrote to memory of 1656 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 111 PID 4848 wrote to memory of 1656 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 111 PID 4848 wrote to memory of 1656 4848 643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe 111 PID 1656 wrote to memory of 1344 1656 csrss.exe 112 PID 1656 wrote to memory of 1344 1656 csrss.exe 112 PID 1656 wrote to memory of 1344 1656 csrss.exe 112 PID 1656 wrote to memory of 2976 1656 csrss.exe 118 PID 1656 wrote to memory of 2976 1656 csrss.exe 118 PID 1656 wrote to memory of 2976 1656 csrss.exe 118 PID 1656 wrote to memory of 1176 1656 csrss.exe 122 PID 1656 wrote to memory of 1176 1656 csrss.exe 122 PID 1656 wrote to memory of 1176 1656 csrss.exe 122 PID 1656 wrote to memory of 4904 1656 csrss.exe 124 PID 1656 wrote to memory of 4904 1656 csrss.exe 124 PID 4256 wrote to memory of 548 4256 windefender.exe 135 PID 4256 wrote to memory of 548 4256 windefender.exe 135 PID 4256 wrote to memory of 548 4256 windefender.exe 135 PID 548 wrote to memory of 2452 548 cmd.exe 136 PID 548 wrote to memory of 2452 548 cmd.exe 136 PID 548 wrote to memory of 2452 548 cmd.exe 136 PID 1656 wrote to memory of 1600 1656 csrss.exe 141 PID 1656 wrote to memory of 1600 1656 csrss.exe 141 PID 1656 wrote to memory of 1600 1656 csrss.exe 141 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe"C:\Users\Admin\AppData\Local\Temp\643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Users\Admin\AppData\Local\Temp\643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe"C:\Users\Admin\AppData\Local\Temp\643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4904
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3336
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4584
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4904
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Drops file in System32 directory
- Creates scheduled task(s)
- Modifies data under HKEY_USERS
PID:1344
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe4⤵
- Executes dropped EXE
PID:1600 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "csrss" /f5⤵PID:4532
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "ScheduledUpdate" /f5⤵PID:4336
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2880
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
Filesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
Filesize
99KB
MD509031a062610d77d685c9934318b4170
SHA1880f744184e7774f3d14c1bb857e21cc7fe89a6d
SHA256778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd
SHA5129a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5283a74631cd99012cdf94d544831ca46
SHA17c85659965b50c463b406073520a4a59dbed72ba
SHA256d97705a2893cf45278df80c5c86a99d005dcfaaefe65c9f693b56621d515953f
SHA512e94160ead77640e47b153b8a87041c78fc047eefb21194ee587ae789738f9a480e7dde3fd4cee1e8423271a1362cbc8689727eb37549216530d335b54315e20b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e53f0eda3d4c084c481543bbb9d3b443
SHA1cfd42ed8a7e04ada1f4bc66b5e5d989488ae6e0b
SHA256d37ab477d0ff410a8cce1298b038821990b1c0400191174f9fa93f55dba9e49f
SHA51272ec2031a00237bc747e1e7624a9cd89df4d308954e36dca8ff7fbd274435c9bd818e9a14ae73938ab2aef22f552f3c3fb24a02867adc2d02f63d14604f62bec
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD50af5e9f955247709f44145ee0ad53929
SHA1b223ed15e084e53daf15e7417dbb9560d97cfb72
SHA256528539d8d62b32b3566d5685baa15b425dc4d80b43920e213cbe29bcef633e8b
SHA512412519ab57807f98f7f7b63c9607767f614dd8eef199991855883dcd960aa09444ddc95afc64e702a7c2890472fc500cbbfdf92729de0f2f13cabd2e6ecd49e4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD58fe885315158fba9205d1a8034018929
SHA14e3fd76527bfcb98ff7f65d901f178a7c094b78d
SHA25641db0bc931c92d5e0732c015dffa061e148901ea24110ee0b8a7392dbfe06581
SHA512bcf20a291092251ef878b3f28f18bebc8501eb375cf14614439928fdc136735d5dc22886bddd7e8353ab457a0dd1a47b3eb14257fa50c1454fedc9e18d7bb26b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD594663f3efbfbcf00b4c76a12eb898155
SHA1343ec71b24f93605fb307faa93d8d10d93260b08
SHA2565bff7424e1eca92c0f595900d67a2ca64be90a50cf422b3a669bac7f6ea72b3f
SHA512c440d91f4804aa0a60f39850d89d76ea715044d9be3f7ea84b1257f5b1ea3f94db0ac92c3d190106b4f6733b0cbb5db504c5a8bab433c82ccc01a6a4050d9468
-
Filesize
4.1MB
MD5943f28a2db3c700d6c097c4b4321b707
SHA156845d4d44bd257670fc9109b7d18e1fa79abcd5
SHA256643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c
SHA512c8255c1787a014bed2e1c9c8e82a568013f47c1dce3d69966d9fd92541c911ad601e10b3e9d292ace755f861ebd32f82a90db6e91770c9cfbed9c290826455fa
-
Filesize
4.1MB
MD5943f28a2db3c700d6c097c4b4321b707
SHA156845d4d44bd257670fc9109b7d18e1fa79abcd5
SHA256643500cb87ae0d06fcf695d5d19c78169e26daea0adf63ec3e753a6a4a22141c
SHA512c8255c1787a014bed2e1c9c8e82a568013f47c1dce3d69966d9fd92541c911ad601e10b3e9d292ace755f861ebd32f82a90db6e91770c9cfbed9c290826455fa
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec