Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
181s -
max time network
251s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2023, 05:41
Static task
static1
Behavioral task
behavioral1
Sample
e0cbefcb1af40c7d4aff4aca26621a98.exe
Resource
win7-20231023-en
General
-
Target
e0cbefcb1af40c7d4aff4aca26621a98.exe
-
Size
4.1MB
-
MD5
6725367cdcecead21e3bb16f2c147fc5
-
SHA1
d9634b52918cae903ab33cf5e95cec4e2d68887a
-
SHA256
cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80
-
SHA512
1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef
-
SSDEEP
98304:2/PhUkVJX19OpDdS5crjkfEGTE140944Lc9d+O413CxNBgG:AUkVJF0DSSrMEYs499sXCxEG
Malware Config
Signatures
-
Glupteba payload 23 IoCs
resource yara_rule behavioral2/memory/992-2-0x0000000002FF0000-0x00000000038DB000-memory.dmp family_glupteba behavioral2/memory/992-3-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/992-68-0x0000000002FF0000-0x00000000038DB000-memory.dmp family_glupteba behavioral2/memory/992-75-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/992-307-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2468-310-0x0000000002E70000-0x000000000375B000-memory.dmp family_glupteba behavioral2/memory/2468-311-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2468-551-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2468-561-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2468-906-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/2468-1055-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1059-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1306-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1799-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1807-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1813-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1815-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1817-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1819-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1821-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1823-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1825-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba behavioral2/memory/1828-1834-0x0000000000400000-0x0000000000D1B000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\e0cbefcb1af40c7d4aff4aca26621a98.exe = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4800 netsh.exe -
Executes dropped EXE 5 IoCs
pid Process 1828 csrss.exe 4660 injector.exe 2188 windefender.exe 1904 windefender.exe 4200 f801950a962ddba14caaa44bf084b55c.exe -
resource yara_rule behavioral2/files/0x000700000001abdd-1808.dat upx behavioral2/files/0x000700000001abdd-1810.dat upx behavioral2/files/0x000700000001abdd-1811.dat upx behavioral2/memory/2188-1812-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1904-1814-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1904-1818-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/files/0x000700000001ab7d-1830.dat upx behavioral2/files/0x000700000001ab7d-1832.dat upx behavioral2/memory/1904-1833-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4200-1835-0x0000000000400000-0x0000000000C25000-memory.dmp upx behavioral2/memory/4200-1837-0x0000000000400000-0x0000000000C25000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\e0cbefcb1af40c7d4aff4aca26621a98.exe = "0" e0cbefcb1af40c7d4aff4aca26621a98.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\S-1-5-21-2508097367-364665605-1201309312-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN e0cbefcb1af40c7d4aff4aca26621a98.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss e0cbefcb1af40c7d4aff4aca26621a98.exe File created C:\Windows\rss\csrss.exe e0cbefcb1af40c7d4aff4aca26621a98.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1800 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4128 schtasks.exe 1220 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2432 = "Cuba Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" e0cbefcb1af40c7d4aff4aca26621a98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" e0cbefcb1af40c7d4aff4aca26621a98.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3668 powershell.exe 3668 powershell.exe 3668 powershell.exe 992 e0cbefcb1af40c7d4aff4aca26621a98.exe 992 e0cbefcb1af40c7d4aff4aca26621a98.exe 4344 powershell.exe 4344 powershell.exe 4344 powershell.exe 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 2216 powershell.exe 2216 powershell.exe 2216 powershell.exe 4996 powershell.exe 4996 powershell.exe 4996 powershell.exe 3648 powershell.exe 3648 powershell.exe 3648 powershell.exe 2424 powershell.exe 2424 powershell.exe 2424 powershell.exe 4572 powershell.exe 4572 powershell.exe 4572 powershell.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 1828 csrss.exe 1828 csrss.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 1828 csrss.exe 1828 csrss.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 1828 csrss.exe 1828 csrss.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3668 powershell.exe Token: SeDebugPrivilege 992 e0cbefcb1af40c7d4aff4aca26621a98.exe Token: SeImpersonatePrivilege 992 e0cbefcb1af40c7d4aff4aca26621a98.exe Token: SeDebugPrivilege 4344 powershell.exe Token: SeDebugPrivilege 2216 powershell.exe Token: SeDebugPrivilege 4996 powershell.exe Token: SeDebugPrivilege 3648 powershell.exe Token: SeDebugPrivilege 2424 powershell.exe Token: SeDebugPrivilege 4572 powershell.exe Token: SeSystemEnvironmentPrivilege 1828 csrss.exe Token: SeSecurityPrivilege 1800 sc.exe Token: SeSecurityPrivilege 1800 sc.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 992 wrote to memory of 3668 992 e0cbefcb1af40c7d4aff4aca26621a98.exe 71 PID 992 wrote to memory of 3668 992 e0cbefcb1af40c7d4aff4aca26621a98.exe 71 PID 992 wrote to memory of 3668 992 e0cbefcb1af40c7d4aff4aca26621a98.exe 71 PID 2468 wrote to memory of 4344 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 76 PID 2468 wrote to memory of 4344 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 76 PID 2468 wrote to memory of 4344 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 76 PID 2468 wrote to memory of 4940 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 78 PID 2468 wrote to memory of 4940 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 78 PID 4940 wrote to memory of 4800 4940 cmd.exe 80 PID 4940 wrote to memory of 4800 4940 cmd.exe 80 PID 2468 wrote to memory of 2216 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 81 PID 2468 wrote to memory of 2216 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 81 PID 2468 wrote to memory of 2216 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 81 PID 2468 wrote to memory of 4996 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 83 PID 2468 wrote to memory of 4996 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 83 PID 2468 wrote to memory of 4996 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 83 PID 2468 wrote to memory of 1828 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 85 PID 2468 wrote to memory of 1828 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 85 PID 2468 wrote to memory of 1828 2468 e0cbefcb1af40c7d4aff4aca26621a98.exe 85 PID 1828 wrote to memory of 3648 1828 csrss.exe 86 PID 1828 wrote to memory of 3648 1828 csrss.exe 86 PID 1828 wrote to memory of 3648 1828 csrss.exe 86 PID 1828 wrote to memory of 2424 1828 csrss.exe 93 PID 1828 wrote to memory of 2424 1828 csrss.exe 93 PID 1828 wrote to memory of 2424 1828 csrss.exe 93 PID 1828 wrote to memory of 4572 1828 csrss.exe 95 PID 1828 wrote to memory of 4572 1828 csrss.exe 95 PID 1828 wrote to memory of 4572 1828 csrss.exe 95 PID 1828 wrote to memory of 4660 1828 csrss.exe 97 PID 1828 wrote to memory of 4660 1828 csrss.exe 97 PID 2188 wrote to memory of 1996 2188 windefender.exe 104 PID 2188 wrote to memory of 1996 2188 windefender.exe 104 PID 2188 wrote to memory of 1996 2188 windefender.exe 104 PID 1996 wrote to memory of 1800 1996 cmd.exe 105 PID 1996 wrote to memory of 1800 1996 cmd.exe 105 PID 1996 wrote to memory of 1800 1996 cmd.exe 105 PID 1828 wrote to memory of 4200 1828 csrss.exe 108 PID 1828 wrote to memory of 4200 1828 csrss.exe 108 PID 1828 wrote to memory of 4200 1828 csrss.exe 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
-
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4344
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4800
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4128
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4984
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4660
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1220
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe4⤵
- Executes dropped EXE
PID:4200 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "csrss" /f5⤵PID:4176
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "ScheduledUpdate" /f5⤵PID:660
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1904
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
Filesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
Filesize
99KB
MD509031a062610d77d685c9934318b4170
SHA1880f744184e7774f3d14c1bb857e21cc7fe89a6d
SHA256778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd
SHA5129a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD59f15a552403961bbbdbb482d3023acd2
SHA16036b9d729728329ff182efc7abe416418a41280
SHA256875d19670831bd6256a5d973d754c534bf1c854008abbc13bd48ab057e820c43
SHA5127bf8b01f18adca78d2c60523a5ff78af9553de5ad6d4b1e677300ea6d366733ca9fc5685a836eab18ed4b6d3565f8ee9710e2d0f927d81f552e1d2abd7e70852
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5660fdd74c16c3976bb531733f13a5ffb
SHA1b66d1d478abc518c4de8970decc8c1dd84eeab9e
SHA256a830f0a0162aa0bc24b40005d309ce8ab8735de47ca11561afa1707d4a804450
SHA512d478f9df8224fa7f0ff15f554da9a58fbee9699396d7e40b1f6f52d7c3fa19625fb3a45d827a781a102f237316a497aef2b7ddd031810fc414c3965d6483a4d2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5466f010afa963ce999bd4b130a3c86b7
SHA12a237b0fc46f9c3a5fe2e2c2d4935dfbf017484f
SHA256fe5575a0bb991b34bd2af71d5fda701da8fed5cb7ba851ce7a067dd318332ea7
SHA512aef12ca03dfefcd6d54808b2bd5960f64afe44dfb64bd36de8e3078aed76e9775f2fdfa241188e288d1a5387b0e2c6e420ff44ef42fa1af4270bdb05d9146f91
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD523325613b4e33d2cb1bc4e28507a9ea4
SHA18e8766b0db89e3bdb12877e28f11557d47fa1c06
SHA256874355fd2e01b871f66170b895ce8fc8a7488270efefcbf493e874d621960c2a
SHA512748fc44b81ce477d30380700efc8f817bb339cccfa27a6695be3d8cc9efbcf74db3082492aabe187beac88a10ca6121a87e3055de4feb757006bb029f8c3ce2d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD537e4ab5228b56cab505a313d64718bde
SHA1db15013cc98e35ed73d0ccbe8e188ced999976c2
SHA256d771b6a4ef27e7358c3740b4e753deb452c697c55124454e2ab6c304dd4f4a9c
SHA512d35dd9cbd4d8b24adcf7b3a288f45b317741421eda6d85ef65fc699894618fc6fb840a865dcc1b90d582ff3776d95b6766da488ed1402a8b5cba3836a257d3ce
-
Filesize
4.1MB
MD56725367cdcecead21e3bb16f2c147fc5
SHA1d9634b52918cae903ab33cf5e95cec4e2d68887a
SHA256cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80
SHA5121583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef
-
Filesize
4.1MB
MD56725367cdcecead21e3bb16f2c147fc5
SHA1d9634b52918cae903ab33cf5e95cec4e2d68887a
SHA256cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80
SHA5121583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec