Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
20s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
12/11/2023, 17:20
Static task
static1
General
-
Target
e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe
-
Size
4.1MB
-
MD5
20346c14a5d6046612dfef269d0dddb0
-
SHA1
544c70b6b4202706eafcd3cf8bf399a1bb113e72
-
SHA256
e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2
-
SHA512
03a6264cb1f3f54071bacf7d5c63ff5bb076e899d1b66ba8a0dd6debccf439f4615879fdf020ff116b758a4a384836d78639136b36891a960d4e0cd3bed78c44
-
SSDEEP
98304:T4m/rubTkpC5ed0r3eLOS0vwOeytex7jRmkVQw7tg8Zt:sm/rubTXr3e7Dx7jM87tlH
Malware Config
Signatures
-
Glupteba payload 10 IoCs
resource yara_rule behavioral1/memory/4204-2-0x0000000002E70000-0x000000000375B000-memory.dmp family_glupteba behavioral1/memory/4204-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4204-298-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4204-302-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4204-303-0x0000000002E70000-0x000000000375B000-memory.dmp family_glupteba behavioral1/memory/2776-306-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2776-803-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2776-806-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/2776-1050-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/3636-1054-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2032 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 3636 csrss.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-459651055-4136032345-1270294931-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe File created C:\Windows\rss\csrss.exe e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4680 powershell.exe 4680 powershell.exe 4680 powershell.exe 4204 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 4204 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 4312 powershell.exe 4312 powershell.exe 4312 powershell.exe 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 4560 powershell.exe 4560 powershell.exe 4560 powershell.exe 3572 powershell.exe 3572 powershell.exe 3572 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4680 powershell.exe Token: SeDebugPrivilege 4204 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Token: SeImpersonatePrivilege 4204 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe Token: SeDebugPrivilege 4312 powershell.exe Token: SeDebugPrivilege 4560 powershell.exe Token: SeDebugPrivilege 3572 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4204 wrote to memory of 4680 4204 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 72 PID 4204 wrote to memory of 4680 4204 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 72 PID 4204 wrote to memory of 4680 4204 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 72 PID 2776 wrote to memory of 4312 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 78 PID 2776 wrote to memory of 4312 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 78 PID 2776 wrote to memory of 4312 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 78 PID 2776 wrote to memory of 4972 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 81 PID 2776 wrote to memory of 4972 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 81 PID 4972 wrote to memory of 2032 4972 cmd.exe 79 PID 4972 wrote to memory of 2032 4972 cmd.exe 79 PID 2776 wrote to memory of 4560 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 82 PID 2776 wrote to memory of 4560 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 82 PID 2776 wrote to memory of 4560 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 82 PID 2776 wrote to memory of 3572 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 85 PID 2776 wrote to memory of 3572 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 85 PID 2776 wrote to memory of 3572 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 85 PID 2776 wrote to memory of 3636 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 86 PID 2776 wrote to memory of 3636 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 86 PID 2776 wrote to memory of 3636 2776 e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe"C:\Users\Admin\AppData\Local\Temp\e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Users\Admin\AppData\Local\Temp\e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe"C:\Users\Admin\AppData\Local\Temp\e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4972
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3572
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
PID:3636
-
-
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes1⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
PID:2032
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5594018989f661f76f2f92a28fd83bd8a
SHA15f5918a9a3df33b139f5c8dcebd5c72c565b3f5c
SHA2568e3f7c34419d5ab090ec39f7cb98bf4382e8088cebc94bcd0ef6fa3a8e688689
SHA512a6d13f5f7cd77337f06cd86171059da250c61c7095f4a55e3176c43ffbaa3a349f58e335b0510795ff2753bff9b580bf2e6d49e2ec7f7cdb2e3a839c92b50d05
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize18KB
MD5f73adc7b9c010e89cfe048537064c9ea
SHA1e2019cf23c3b856d42df1ce9d4609391cf16aed4
SHA2567a07aa1b84b6b2eb3c4f4e4c499a51fc6573f2d9603cc046a39f5608810097c2
SHA512e7ac26897cf4d50db118d8ba5c646ab2572860b311106ff30dc1b8918fb69a82ee8ecdc3cda1810750461240ed4a50b8f08e24a549b36f7dfc0f146543af2f63
-
Filesize
4.1MB
MD520346c14a5d6046612dfef269d0dddb0
SHA1544c70b6b4202706eafcd3cf8bf399a1bb113e72
SHA256e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2
SHA51203a6264cb1f3f54071bacf7d5c63ff5bb076e899d1b66ba8a0dd6debccf439f4615879fdf020ff116b758a4a384836d78639136b36891a960d4e0cd3bed78c44
-
Filesize
4.1MB
MD520346c14a5d6046612dfef269d0dddb0
SHA1544c70b6b4202706eafcd3cf8bf399a1bb113e72
SHA256e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2
SHA51203a6264cb1f3f54071bacf7d5c63ff5bb076e899d1b66ba8a0dd6debccf439f4615879fdf020ff116b758a4a384836d78639136b36891a960d4e0cd3bed78c44