glupteba | 452c2fae1cf93f933ef30e73cd3ae5d8afc14286b0aa58a512c40f3e81e5a922

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 10:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
029cfa383c2a3c9934a370a3b88f93e1.exe
Size 4.1MB
Sample240126-l9mkfacfdp
SHA256 452c2fae1cf93f933ef30e73cd3ae5d8afc14286b0aa58a512c40f3e81e5a922
MD5 029cfa383c2a3c9934a370a3b88f93e1
SHA1 dbf3495d86a7ed0ef39c46e29b0c8b9701e6a59a
SHA512 889df24541d0eeb701723c65d1f818d65e0b114c26cb4bc5f42f76c9c28710a5a805045f25a2b1d42c89557ae2acf187f7808cdc563b65a998a7d08ed17c2bb4
SSDEEP 98304:H+godgzD5J7Vt33OUYbXVn2+WcYvDBrpcjynumtC/B+xaGNkE:H+g82Jt3+UYbXVWcYv1y6Tto+xME
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 23 IoCs

resource	yara_rule
behavioral1/memory/3056-2-0x0000000004AB0000-0x000000000539B000-memory.dmp	family_glupteba
behavioral1/memory/3056-3-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3056-4-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3056-8-0x0000000004AB0000-0x000000000539B000-memory.dmp	family_glupteba
behavioral1/memory/2704-9-0x0000000004C70000-0x000000000555B000-memory.dmp	family_glupteba
behavioral1/memory/2704-10-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/2704-20-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-23-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-112-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-117-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-128-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-148-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-157-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-159-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-161-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-163-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-165-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-167-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-169-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-171-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-173-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-175-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba
behavioral1/memory/3068-177-0x0000000000400000-0x0000000002EFA000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\029cfa383c2a3c9934a370a3b88f93e1.exe = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe

Modifies boot configuration data using bcdedit 14 IoCs

pid	Process
2072	bcdedit.exe
1644	bcdedit.exe
824	bcdedit.exe
684	bcdedit.exe
1928	bcdedit.exe
2012	bcdedit.exe
1000	bcdedit.exe
2456	bcdedit.exe
2304	bcdedit.exe
860	bcdedit.exe
2180	bcdedit.exe
732	bcdedit.exe
1512	bcdedit.exe
1580	bcdedit.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\Winmon.sys	csrss.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2572	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Executes dropped EXE 6 IoCs

pid	Process
3068	csrss.exe
1984	patch.exe
2884	injector.exe
2792	dsefix.exe
2720	windefender.exe
2052	windefender.exe

Loads dropped DLL 13 IoCs

pid	Process
2704	029cfa383c2a3c9934a370a3b88f93e1.exe
2704	029cfa383c2a3c9934a370a3b88f93e1.exe
832	Process not Found
1984	patch.exe
1984	patch.exe
3068	csrss.exe
1984	patch.exe
1984	patch.exe
1984	patch.exe
1984	patch.exe
1984	patch.exe
1984	patch.exe
3068	csrss.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0004000000005b81-151.dat	upx
behavioral1/memory/2720-152-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/files/0x0004000000005b81-153.dat	upx
behavioral1/files/0x0004000000005b81-154.dat	upx
behavioral1/memory/2720-155-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2052-156-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2052-158-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2052-162-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2052-168-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\029cfa383c2a3c9934a370a3b88f93e1.exe = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	029cfa383c2a3c9934a370a3b88f93e1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMon driver. 1 IoCs

Roottkits write to WinMon to hide PIDs from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMon	csrss.exe

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	029cfa383c2a3c9934a370a3b88f93e1.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	029cfa383c2a3c9934a370a3b88f93e1.exe
File created	C:\Windows\rss\csrss.exe	029cfa383c2a3c9934a370a3b88f93e1.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20240126101411.cab	Process not Found
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1564	sc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2588	schtasks.exe
1848	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-422 = "Russian Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-22 = "Cape Verde Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-152 = "Central America Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-521 = "N. Central Asia Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-432 = "Iran Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	029cfa383c2a3c9934a370a3b88f93e1.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	windefender.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3056	029cfa383c2a3c9934a370a3b88f93e1.exe
2704	029cfa383c2a3c9934a370a3b88f93e1.exe
2704	029cfa383c2a3c9934a370a3b88f93e1.exe
2704	029cfa383c2a3c9934a370a3b88f93e1.exe
2704	029cfa383c2a3c9934a370a3b88f93e1.exe
2704	029cfa383c2a3c9934a370a3b88f93e1.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
3068	csrss.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
3068	csrss.exe
2884	injector.exe
3068	csrss.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe
2884	injector.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	029cfa383c2a3c9934a370a3b88f93e1.exe
Token: SeImpersonatePrivilege	3056	029cfa383c2a3c9934a370a3b88f93e1.exe
Token: SeSystemEnvironmentPrivilege	3068	csrss.exe
Token: SeSecurityPrivilege	1564	sc.exe
Token: SeSecurityPrivilege	1564	sc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2540	2704	029cfa383c2a3c9934a370a3b88f93e1.exe	33
PID 2704 wrote to memory of 2540	2704	029cfa383c2a3c9934a370a3b88f93e1.exe	33
PID 2704 wrote to memory of 2540	2704	029cfa383c2a3c9934a370a3b88f93e1.exe	33
PID 2704 wrote to memory of 2540	2704	029cfa383c2a3c9934a370a3b88f93e1.exe	33
PID 2540 wrote to memory of 2572	2540	cmd.exe	35
PID 2540 wrote to memory of 2572	2540	cmd.exe	35
PID 2540 wrote to memory of 2572	2540	cmd.exe	35
PID 2704 wrote to memory of 3068	2704	029cfa383c2a3c9934a370a3b88f93e1.exe	36
PID 2704 wrote to memory of 3068	2704	029cfa383c2a3c9934a370a3b88f93e1.exe	36
PID 2704 wrote to memory of 3068	2704	029cfa383c2a3c9934a370a3b88f93e1.exe	36
PID 2704 wrote to memory of 3068	2704	029cfa383c2a3c9934a370a3b88f93e1.exe	36
PID 3068 wrote to memory of 2884	3068	csrss.exe	43
PID 3068 wrote to memory of 2884	3068	csrss.exe	43
PID 3068 wrote to memory of 2884	3068	csrss.exe	43
PID 3068 wrote to memory of 2884	3068	csrss.exe	43
PID 1984 wrote to memory of 2072	1984	patch.exe	48
PID 1984 wrote to memory of 2072	1984	patch.exe	48
PID 1984 wrote to memory of 2072	1984	patch.exe	48
PID 1984 wrote to memory of 1644	1984	patch.exe	49
PID 1984 wrote to memory of 1644	1984	patch.exe	49
PID 1984 wrote to memory of 1644	1984	patch.exe	49
PID 1984 wrote to memory of 824	1984	patch.exe	52
PID 1984 wrote to memory of 824	1984	patch.exe	52
PID 1984 wrote to memory of 824	1984	patch.exe	52
PID 1984 wrote to memory of 684	1984	patch.exe	54
PID 1984 wrote to memory of 684	1984	patch.exe	54
PID 1984 wrote to memory of 684	1984	patch.exe	54
PID 1984 wrote to memory of 2012	1984	patch.exe	57
PID 1984 wrote to memory of 2012	1984	patch.exe	57
PID 1984 wrote to memory of 2012	1984	patch.exe	57
PID 1984 wrote to memory of 1928	1984	patch.exe	55
PID 1984 wrote to memory of 1928	1984	patch.exe	55
PID 1984 wrote to memory of 1928	1984	patch.exe	55
PID 1984 wrote to memory of 1000	1984	patch.exe	58
PID 1984 wrote to memory of 1000	1984	patch.exe	58
PID 1984 wrote to memory of 1000	1984	patch.exe	58
PID 1984 wrote to memory of 2456	1984	patch.exe	60
PID 1984 wrote to memory of 2456	1984	patch.exe	60
PID 1984 wrote to memory of 2456	1984	patch.exe	60
PID 1984 wrote to memory of 2304	1984	patch.exe	64
PID 1984 wrote to memory of 2304	1984	patch.exe	64
PID 1984 wrote to memory of 2304	1984	patch.exe	64
PID 1984 wrote to memory of 1512	1984	patch.exe	72
PID 1984 wrote to memory of 1512	1984	patch.exe	72
PID 1984 wrote to memory of 1512	1984	patch.exe	72
PID 1984 wrote to memory of 860	1984	patch.exe	66
PID 1984 wrote to memory of 860	1984	patch.exe	66
PID 1984 wrote to memory of 860	1984	patch.exe	66
PID 1984 wrote to memory of 732	1984	patch.exe	70
PID 1984 wrote to memory of 732	1984	patch.exe	70
PID 1984 wrote to memory of 732	1984	patch.exe	70
PID 1984 wrote to memory of 2180	1984	patch.exe	68
PID 1984 wrote to memory of 2180	1984	patch.exe	68
PID 1984 wrote to memory of 2180	1984	patch.exe	68
PID 3068 wrote to memory of 1580	3068	csrss.exe	74
PID 3068 wrote to memory of 1580	3068	csrss.exe	74
PID 3068 wrote to memory of 1580	3068	csrss.exe	74
PID 3068 wrote to memory of 1580	3068	csrss.exe	74
PID 3068 wrote to memory of 2792	3068	csrss.exe	76
PID 3068 wrote to memory of 2792	3068	csrss.exe	76
PID 3068 wrote to memory of 2792	3068	csrss.exe	76
PID 3068 wrote to memory of 2792	3068	csrss.exe	76
PID 2720 wrote to memory of 840	2720	windefender.exe	84
PID 2720 wrote to memory of 840	2720	windefender.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\029cfa383c2a3c9934a370a3b88f93e1.exe
"C:\Users\Admin\AppData\Local\Temp\029cfa383c2a3c9934a370a3b88f93e1.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056
- C:\Users\Admin\AppData\Local\Temp\029cfa383c2a3c9934a370a3b88f93e1.exe
  "C:\Users\Admin\AppData\Local\Temp\029cfa383c2a3c9934a370a3b88f93e1.exe"
  2⤵
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:2572
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Manipulates WinMon driver.
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1900
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:1984
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2072
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1644
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:824
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:684
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1928
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2012
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1000
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2456
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2304
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:860
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2180
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:732
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2884
  - - C:\Windows\system32\bcdedit.exe
      C:\Windows\Sysnative\bcdedit.exe /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      4⤵
      Executes dropped EXE
      PID:2792
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1848
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:840
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240126101411.log C:\Windows\Logs\CBS\CbsPersist_20240126101411.cab
1⤵
PID:2804

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cab72C2.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab72C2.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.error

Path C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
Size 419KB
SHA256 ffaf3ea80372449614145e5670c0576164afe2281d433e952ea8cc4611cfa552
MD5 fb30d0e5f178471bd0f2ba8374cc8347
SHA1 3291c4feb6383f67dd06ec6241e5c720bf2bf925
SHA512 47be0b8dee3f1963138fed5e64e429a1dd0552b0cd548e423cd010b08a3b6265cb27299048ef9afe8fe4791a17de7db4854ff1c00ff622a4be8bea00ae074093
SSDEEP 6144:9SY6k6k6peetvWYF/Y8khxZ9JTCScN/Z76+UkMoVDoj7UcaTAf0WYVa4DN8hM9EB:6/7rNMoVDSbs/Va4DShM9EFXg+
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.error

Path C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
Size 197KB
SHA256 443e7217ab26da9f18e13455748cd3a47559c9eebc51be401a4da6ab8dc14583
MD5 372fd764ebb163d92824aba899e84f74
SHA1 3518b9c99dad80122a6e1199736e3170bed0c671
SHA512 d99f235f6ce75e1c3d822066adfd7a3b52605b1aff9331a181caf7a94ee28c6d0f9c42c0f63483facf7426096e4aeb925b7c874a9e5f9d1c85ca1d144ad02f9a
SSDEEP 3072:FMRhMzV3iSDi7loqi2iDqiMPxOYU6DIru3ZrRXKNdLIaIwh/IDpmGKKGQw503Oc/:Fi9U6MrSZriIaHz50n885+dfVNuYrJA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar7342.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar7342.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsefix.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
Size 94KB
SHA256 414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
MD5 d98e78fd57db58a11f880b45bb659767
SHA1 ab70c0d3bd9103c07632eeecee9f51d198ed0e76
SHA512 aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
SSDEEP 1536:KNSuvn3R+Vjj3d38uezp0Dw+49tKMgVxAlIi8:ah+Vjj3d38uezp0U9vgLAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 150KB
SHA256 08c478b0643c010ca649aed6e18d78706efd5ba7aa0523ffffd9bd75aa1bfb7c
MD5 8eda52d95208288ed9ed53198805294f
SHA1 9df348d88eba6feb9350d93b96e551c814be23b5
SHA512 5d1997dab892b86a64150dc873774fbbd5bdbb965d8f58528977253985e66965cb851d13d7d78da66372c75652acbd387e3168804d9c92d59fadb3943b397df6
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMih:SA3IlIA6e29vngqS8wMA
MD5 SHA1 SHA512 SSDEEP

Submit Download

patch.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
Size 907KB
SHA256 99c46f85ed2d33b62d3ac4a9881bb65bd2c90f920fad7eb03475ea5856f8f29b
MD5 6d9aada032ad4e3915c140784dc0600f
SHA1 6c570cea381ec223a4a8f0973f7ebf6697dfd34a
SHA512 a58c692b7c72464b462ebb87928af59b7f60c32e2701e2ef222c63405bc6eff5fb9bfae92da59328bf1779e1bdad6ab3bf117b89b71a1e8e1f5f0857490d7484
SSDEEP 12288:fKlnaLI9gFlsJ0MFYPybIEdpvfXVVv4Uvfa7WzwwoHhdrfpESHERuw7hweIhPD9B:fKln2MFUEdpHVzXKWHoBpHEjVweSRHYi
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 126KB
SHA256 801bc94ad16800cc9c78b6d256579d74cdf12bb6dd210111f38c4a7b0ac32da7
MD5 4c47493da9ac57f47d375ed35e0bf208
SHA1 eb0c608550359a293a22597295a98d558a1d24d2
SHA512 43f2a1d4360aaf115a2a4f224c1ece88c08a79338f203313ae94a1a4b5fe6484dfd089d6e1bfca656310c4a8bb3ac748a9ad5ea66706d7483c89d1d79b299f76
SSDEEP 3072:iQzM4n/KuPquKdA8trN0gMQiNttYXTZH9SWvcYcOEnxDstL:l5/Kk18tWPf8ZH9FvgxE
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path C:\Users\Admin\AppData\Local\Temp\osloader.exe
Size 591KB
SHA256 b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
MD5 e2f68dc7fbd6e0bf031ca3809a739346
SHA1 9c35494898e65c8a62887f28e04c0359ab6f63f5
SHA512 26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
SSDEEP 12288:g3SAVNtsCiPdRpuHq83wf1PKWZlZQUUFoqn6F7H4:giAJsC6dbuHq8G1PK6lZvL+6NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 1.5MB
SHA256 1c8d8d590a02713ae183dda5bd1070aad7dc7533bb97c3d49b9314ef39ce1b77
MD5 085609f4ca10347c4bb273cc1b612e75
SHA1 227bef2e1201291c13297b960cded578308cd444
SHA512 8e2cf373374435ce4dc7ca4320126967485c690671b7cd5ab77b2d9ab7225dd7ffab9c4872b7c6015cea74f67fd6b1969a3f484372fcc16da8e2d2cf5ff6fb96
SSDEEP 24576:3dIGfGfIgyV2ueLPUuwnvAHQw/unpH0qThcOzRD2oI4Jh2efV1HLvvfYGt33Nnol:HOfgV21LTZgG8blD5JdVVnt336mmU4rT
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 1.8MB
SHA256 86c15a5591514a0c3d759d10a26fcd233c8db76802bb70a43db557f4b77ab07e
MD5 6d0e57e4c2d603e8c38aa071d433eb03
SHA1 1e1c6574482257b71ea48526ce02f62eb3650aa0
SHA512 18f3edbe1f61ba8259aa9ba7dc5913cbefd91e76a45324789e12e4b3b34854e0eab6726b19880d844f0f066990b7e5506a5ea3629c469051ceada71aacf37f46
SSDEEP 49152:HOfgV21LTZgG8blD5JdVVnt336mmU4ryKvJX8EXS:H+godgzD5J7Vt33OUYbXS
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 475KB
SHA256 fb9f84db0c55f4d304b327ebde17bf46b7fc3b030031eabaf07fe46b0ce887bd
MD5 8c758283f321545a962509d108af6d4a
SHA1 5e02b506edd5c6a097613a7e58494fc6db9095c3
SHA512 264d67776c826201c7ae05191b199fd3ed6b0614d3ae495a356ab55c4bdebed2081232f056e5d3f9b60dc68c5cfeff297b56ea6aa82cbc2ae32e46cf69f5f14a
SSDEEP 12288:3hjXIzOA7lxo9rTGxdIgyma2uDa2FsVPAF49hGnaYA6y6vFWbH7ZKy:3dIGfGfIgyV2ueLPUuwnvAHQw/N
MD5 SHA1 SHA512 SSDEEP

Submit Download

windefender.exe

Path C:\Windows\windefender.exe
Size 46KB
SHA256 e1fa96048a41c3e18d6f3d08df8b30965dfd7e5592b932a461de74bc78bc8236
MD5 0b112a215d0537b235dc0762e9beff2a
SHA1 4e6c7ba0c99247249a4283c474160815b367df6c
SHA512 5f2d44d14e022d60b22af46379cb537c34ea04f4c7476b5a1e333c73f98760969b53f8c54f8d9208e7fba427fafff9830a4be497c8ffa580c8601a579ff87251
SSDEEP 768:+ASnPigAF9DR3+UxmMaXKFmj513autwmtZr6urZwM8XxHjeJ6P8D1STr:rgAFBR3kHKFmj5dwmnr6utwMWu6PUur
MD5 SHA1 SHA512 SSDEEP

Submit Download

windefender.exe

Path C:\Windows\windefender.exe
Size 1.3MB
SHA256 2cdc748fb7fa7a6a4158d69190cb8e992630646741d6ed5deec9062a0137fc86
MD5 c5f61e5dbf635a35385a6b3f0824488a
SHA1 11ee35a3c324906c2e6fb611d629d0e73052d7d7
SHA512 8e581ac14a984fda6a6a76a9b730fb96b4f04dc402e9a183ecdcdd604263efae628a5917f87fdeaa8c5cb0673d6ca385d5a68b24fcd3df80575e7cd7f264bcd3
SSDEEP 24576:y+SUi7LyUe4OD8EBqtkV9C+nxnRpwD745MhFiBV9QcmfXrbVaAH0DDr2XdaB6geW:y+SUiJeHpNnxG745Mfi39uXrbcI6DOd4
MD5 SHA1 SHA512 SSDEEP

Submit Download

windefender.exe

Path C:\Windows\windefender.exe
Size 1.1MB
SHA256 9cdb710270b41ad2a8c6977e7457091aae3a35e735d1edfdd50915cae752c58b
MD5 ba016b574ad51d5aa6feb20239c3a711
SHA1 b0260104e34a568ba01226159f7488530edc53b7
SHA512 c0e4bd6199dbfceeb0aeacecdd1b11d6844f5af5ab581eab02721286071a037ef0d5f25fc3503fb0a44f2b748e67d41c0ecb1eb3f7d0cd59acc62925860f98ed
SSDEEP 24576:y+SUi7LyUe4OD8EBqtkV9C+nxnRpwD745MhFiBV9QcmfXrbVaAH0DDr2XdaB6k:y+SUiJeHpNnxG745Mfi39uXrbcI6DOdu
MD5 SHA1 SHA512 SSDEEP

Submit Download

injector.exe

Path \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 114KB
SHA256 c702a6c3977f3d99452aa5404dfe6645fe98723158edc165380aafd8f5528ec5
MD5 ab53f0556d23f91c2f85bfdf4b6a49b2
SHA1 561ba319577e1d141369a0c421e8c7e065769600
SHA512 34edaf00fdad4f2acf32c7d098e8d899dc03020bbc981e7445f9c014bcd7a962429a5d2318e6ec7a47f6ae98581ed07b10e9e0f93e29957ee8da65fc12006192
SSDEEP 1536:qbHe9ldfDaOH358g52HHF79ahJx9uSyL6eF0y+JjkEz6Pb:qbHszDaOJ8u2HHFIWr6e29k7
MD5 SHA1 SHA512 SSDEEP

Submit Download

patch.exe

Path \Users\Admin\AppData\Local\Temp\csrss\patch.exe
Size 719KB
SHA256 e241202c5406be4a6460ac3e85812b0ca9a42a69e91574aed898b16a2180d545
MD5 5828205b4eed58b9c2ad4c5896f2ff65
SHA1 f8c230134e1a11fcf4862de2aca4e5e0010f658c
SHA512 49df4d697770a4eca239cd1e976cbd99829058fdce54911a47b49545fcc5e74582e0e052e34280b8ca45fa97e199b2653eb7d4463df553b08052b2939bbff8f9
SSDEEP 12288:fKlnaLI9gFlsJ0MFYPybIEdpvfXVVv4Uvfa7WzwwoHhdrfpESHERuw7hweIhPDB:fKln2MFUEdpHVzXKWHoBpHEjVweSB
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbghelp.dll

Path \Users\Admin\AppData\Local\Temp\dbghelp.dll
Size 427KB
SHA256 283f5f4ce5d2ef2cd31136078c9ec5bea6798a2b436b661dbd1a5e0ee97c7bce
MD5 0f7e5f869c56c77a28ce62cf2f05113f
SHA1 d52f667281a7c727a55d9a371e27f6b9099fc464
SHA512 002fc372ecd6c939cae53723c7a5b11d58bb058bc34e84c2d6df3d5fcd18c3028fbe313bfb1f43f1e7c76a5081e696fe5d641f93e399b7bd24fb9ec37ca9540c
SSDEEP 12288:h9gFlsJ0MFYPybIEdpvfXVVv4Uvfa7WzwwoHhdrfA:QMFUEdpHVzXKWHoo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 184KB
SHA256 0e1b490e6db5fe740e0cd283473a1ada699e3983cd08627bc8b568009d827bcb
MD5 a0d033514ee86c7a589da280f4cc4d9b
SHA1 bd11b653d2057d93273f3c3bc5400e20dda4296b
SHA512 047191f0b692f4a6799205af7d7bbbf94b9c53879a3122b6042498f84da1315613781ee3d9fbf2fc064bd9415aac33ace4c6333122648d6cd561c227eaa29851
SSDEEP 3072:iQzM4n/KuPquKdA8trN0gMQiNttYXTZH9SWvcYcOEnxDstTXEKAPBjuhj3GhvCPI:l5/Kk18tWPf8ZH9FvgxGXXA5juZ3GhvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 70KB
SHA256 f2ff66e2dc23df4672643ac87d90c4114b9fdc1b153e0bcfe4a568318d517985
MD5 146bd69f7544dd760c0f33b65c30f095
SHA1 be6406d974ebdd0e59880c57c59ecbc3bb502d78
SHA512 e3d26826577a06902cdbda7f5dda740f02318d6a22c503822800f7e5013cc9282bcf2cea080b18000aa6b836fd6f8d65bfb572ada1438bd486712fa46d0c28fc
SSDEEP 1536:c1QWSMKbJNRxn3vuV/HraCc81uKeeA5Cto2N0l1kMQrD12:iQzM4n/KuPquKdA8trN0gMQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 78KB
SHA256 7e4dbcf634b3b3c7a295b633a790031f8c162985c62373da1180e47929150844
MD5 2af2008dbcd7eb878b5d091ada9ebf00
SHA1 851fca1f9cb2bb3e2461f81ae1f03ab32af3c0aa
SHA512 1a19967f3452f5055ebbf7c6af5c511f2750e204e21f8d69d5b1e9410a44116e5ae96a940ae7abccb7d38f526d90e4a0b880e7cfc63aa80d01326064a943be94
SSDEEP 1536:c1QWSMKbJNRxn3vuV/HraCc81uKeeA5Cto2N0l1kMQrD1T0NtrROnN:iQzM4n/KuPquKdA8trN0gMQiNto
MD5 SHA1 SHA512 SSDEEP

Submit Download

symsrv.dll

Path \Users\Admin\AppData\Local\Temp\symsrv.dll
Size 163KB
SHA256 e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f
MD5 5c399d34d8dc01741269ff1f1aca7554
SHA1 e0ceed500d3cef5558f3f55d33ba9c3a709e8f55
SHA512 8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d
SSDEEP 3072:XFg2VNLKO+Qgd/T0hexf+fs7ketCv5mQTeKBSccrfjZDDwvI:XFg2TLT+h9xf+f+c4fVDEI
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Windows\rss\csrss.exe
Size 1.5MB
SHA256 f107fb4de989919ed74298d5bd60a43ec5cbec607c9b926db93fd99926d9a64f
MD5 e93268952b1699de862391376a74a168
SHA1 e1094daea1b497769cb133d4c564f67832c3a9d7
SHA512 6ea22d8f3d10af1c49bcaa9d0a777af91a1ee5c0959f82f75a45529e2cc5dcd8999bc8a5aac2491f80aafc93041c3ed140b7ebf62d5835ba14bd76f252dddae5
SSDEEP 24576:3dIGfGfIgyV2ueLPUuwnvAHQw/unpH0qThcOzRD2oI4Jh2efV1HLvvfYGt33NnoI:HOfgV21LTZgG8blD5JdVVnt336mmU4ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Windows\rss\csrss.exe
Size 1.2MB
SHA256 946601266eeb32b598872887adfbabac3bab9035b48d687626339c5abd8363e4
MD5 d22db4bd8f3fa03ecfc7af1bc2210c63
SHA1 d062df2d88c9ea469b37d75270628d1612c8b3e4
SHA512 0306796fe255dd85b416f1afe837acb39589960d88a7770bce18669f1d73c2a7151768b7802cde0a142f4d2fc03da0bb929f41714a2bdf649cf764ecd1f084a3
SSDEEP 24576:3dIGfGfIgyV2ueLPUuwnvAHQw/unpH0qThcOzRD2oI4Jh2efV1HLvvfYGx:HOfgV21LTZgG8blD5JdVVnx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1984-60-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/1984-41-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/2052-156-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/2052-168-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/2052-162-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/2052-158-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/2704-7-0x00000000032E0000-0x00000000036D8000-memory.dmp

Download

memory/2704-21-0x00000000032E0000-0x00000000036D8000-memory.dmp

Download

memory/2704-20-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/2704-10-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/2704-9-0x0000000004C70000-0x000000000555B000-memory.dmp

Download

memory/2704-5-0x00000000032E0000-0x00000000036D8000-memory.dmp

Download

memory/2720-152-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/2720-155-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/3056-2-0x0000000004AB0000-0x000000000539B000-memory.dmp

Download

memory/3056-8-0x0000000004AB0000-0x000000000539B000-memory.dmp

Download

memory/3056-6-0x0000000002F90000-0x0000000003388000-memory.dmp

Download

memory/3056-0-0x0000000002F90000-0x0000000003388000-memory.dmp

Download

memory/3056-4-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3056-1-0x0000000002F90000-0x0000000003388000-memory.dmp

Download

memory/3056-3-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-148-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-19-0x0000000003060000-0x0000000003458000-memory.dmp

Download

memory/3068-117-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-112-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-128-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-157-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-116-0x0000000003060000-0x0000000003458000-memory.dmp

Download

memory/3068-159-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-161-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-23-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-163-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-165-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-167-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-22-0x0000000003060000-0x0000000003458000-memory.dmp

Download

memory/3068-169-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-171-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-173-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-175-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download

memory/3068-177-0x0000000000400000-0x0000000002EFA000-memory.dmp

Download