glupteba | 1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922

Resubmissions

08-02-2024 19:00

240208-xnla2ahe7z 10

08-02-2024 07:34

240208-jd5p2aefen 10

08-02-2024 04:47

240208-fevdxabb9y 10

Analysis

max time kernel
208s
max time network
245s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08-02-2024 19:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe
Size

5.5MB
MD5

c4580e8db0c3dbc88891842fd8a31158
SHA1

744f03fcf10db1459d3f40beaea2bfe1b000582b
SHA256

1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922
SHA512

cefd412e0d5aba56d6603fdc46a056474ce387dbb220b32a9317dca0822bef9320515afacc2ab2086db46f9e01b3456c87a0dc83bd99c246550d87efd3606945
SSDEEP

98304:Fs9EI6sZJrf04Hr3VvPkrcRizJ6krK4JLQaEHlXU+vG9G1jMaZQRrkp:W+I6sU4HjZkwkVJo1+G1jMaZQpk

Score

10^/10

glupteba smokeloader pub1 backdoor discovery dropper evasion loader persistence rootkit spyware stealer trojan upx

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php

rc4.i32

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 15 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2648-53-0x0000000002D80000-0x000000000366B000-memory.dmp	family_glupteba
behavioral2/memory/2648-54-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2648-136-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2648-138-0x0000000002D80000-0x000000000366B000-memory.dmp	family_glupteba
behavioral2/memory/1996-141-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1996-219-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1996-240-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1456-344-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1456-357-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1456-368-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1456-412-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1456-421-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1456-424-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1456-432-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1456-438-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

4440 netsh.exe

pid	process
4440	netsh.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exeInstallSetup_nine.exe9C86.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	InstallSetup_nine.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	9C86.exe

Drops startup file 1 IoCs

Processes:

9C86.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe 9C86.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe	9C86.exe

Executes dropped EXE 15 IoCs

Processes:

InstallSetup_nine.exed21cbe21e38b385a41a68c5e6dd32f4c.exerty25.exetoolspub1.exeu2f8.0.exed21cbe21e38b385a41a68c5e6dd32f4c.execsrss.exeD0BD.exeinjector.exewindefender.exewindefender.exe2A92.exe9C86.exeA5EE.exeqemu-ga.exe

pid	process
3140	InstallSetup_nine.exe
2648	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3792	rty25.exe
4068	toolspub1.exe
4892	u2f8.0.exe
1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1456	csrss.exe
1028	D0BD.exe
1208	injector.exe
3836	windefender.exe
1696	windefender.exe
3944	2A92.exe
3084	9C86.exe
4476	A5EE.exe
2568	qemu-ga.exe

Loads dropped DLL 2 IoCs

Processes:

u2f8.0.exe

pid process

4892 u2f8.0.exe
4892 u2f8.0.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4892	u2f8.0.exe
4892	u2f8.0.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
C:\Windows\windefender.exe	upx
behavioral2/memory/3836-366-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1696-410-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/1696-422-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN d21cbe21e38b385a41a68c5e6dd32f4c.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Drops file in Windows directory 4 IoCs

Processes:

d21cbe21e38b385a41a68c5e6dd32f4c.execsrss.exe

description	ioc	process
File opened for modification	C:\Windows\rss	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File created	C:\Windows\rss\csrss.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

4952 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4344 4892 WerFault.exe u2f8.0.exe
2108 3084 WerFault.exe 9C86.exe

pid	process
4952	sc.exe

pid	pid_target	process	target process
4344	4892	WerFault.exe	u2f8.0.exe
2108	3084	WerFault.exe	9C86.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

toolspub1.exeD0BD.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D0BD.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D0BD.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	D0BD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

u2f8.0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	u2f8.0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	u2f8.0.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4868 schtasks.exe
4600 schtasks.exe

pid	process
4868	schtasks.exe
4600	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exewindefender.exed21cbe21e38b385a41a68c5e6dd32f4c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-352 = "FLE Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-572 = "China Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

toolspub1.exepowershell.exed21cbe21e38b385a41a68c5e6dd32f4c.exe

pid	process
4068	toolspub1.exe
4068	toolspub1.exe
2504	powershell.exe
2504	powershell.exe
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
3492
2648	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2648	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3492
3492
3492
3492
3492
3492
3492
3492

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

toolspub1.exeD0BD.exe

pid process

4068 toolspub1.exe
1028 D0BD.exe

Suspicious use of AdjustPrivilegeToken 44 IoCs

Processes:

powershell.exed21cbe21e38b385a41a68c5e6dd32f4c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe9C86.exeA5EE.exe

description	pid	process
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeDebugPrivilege	2648	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeImpersonatePrivilege	2648	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeDebugPrivilege	2380	powershell.exe
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeDebugPrivilege	1692	powershell.exe
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeDebugPrivilege	1688	powershell.exe
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeDebugPrivilege	1160	powershell.exe
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeSystemEnvironmentPrivilege	1456	csrss.exe
Token: SeSecurityPrivilege	4952	sc.exe
Token: SeSecurityPrivilege	4952	sc.exe
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeDebugPrivilege	3084	9C86.exe
Token: SeDebugPrivilege	4476	A5EE.exe
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492
Token: SeShutdownPrivilege	3492
Token: SeCreatePagefilePrivilege	3492

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exed21cbe21e38b385a41a68c5e6dd32f4c.exeInstallSetup_nine.exed21cbe21e38b385a41a68c5e6dd32f4c.execmd.execsrss.exewindefender.execmd.exe9C86.exe

description	pid	process	target process
PID 884 wrote to memory of 3140	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	InstallSetup_nine.exe
PID 884 wrote to memory of 3140	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	InstallSetup_nine.exe
PID 884 wrote to memory of 3140	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	InstallSetup_nine.exe
PID 884 wrote to memory of 2648	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 884 wrote to memory of 2648	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 884 wrote to memory of 2648	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe
PID 884 wrote to memory of 3792	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	rty25.exe
PID 884 wrote to memory of 3792	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	rty25.exe
PID 884 wrote to memory of 4068	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	toolspub1.exe
PID 884 wrote to memory of 4068	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	toolspub1.exe
PID 884 wrote to memory of 4068	884	1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe	toolspub1.exe
PID 2648 wrote to memory of 2504	2648	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2648 wrote to memory of 2504	2648	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 2648 wrote to memory of 2504	2648	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 3140 wrote to memory of 4892	3140	InstallSetup_nine.exe	u2f8.0.exe
PID 3140 wrote to memory of 4892	3140	InstallSetup_nine.exe	u2f8.0.exe
PID 3140 wrote to memory of 4892	3140	InstallSetup_nine.exe	u2f8.0.exe
PID 1996 wrote to memory of 2380	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1996 wrote to memory of 2380	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1996 wrote to memory of 2380	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1996 wrote to memory of 4280	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	cmd.exe
PID 1996 wrote to memory of 4280	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	cmd.exe
PID 4280 wrote to memory of 4440	4280	cmd.exe	netsh.exe
PID 4280 wrote to memory of 4440	4280	cmd.exe	netsh.exe
PID 1996 wrote to memory of 1692	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1996 wrote to memory of 1692	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1996 wrote to memory of 1692	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1996 wrote to memory of 1248	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1996 wrote to memory of 1248	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1996 wrote to memory of 1248	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	powershell.exe
PID 1996 wrote to memory of 1456	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	csrss.exe
PID 1996 wrote to memory of 1456	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	csrss.exe
PID 1996 wrote to memory of 1456	1996	d21cbe21e38b385a41a68c5e6dd32f4c.exe	csrss.exe
PID 1456 wrote to memory of 1688	1456	csrss.exe	powershell.exe
PID 1456 wrote to memory of 1688	1456	csrss.exe	powershell.exe
PID 1456 wrote to memory of 1688	1456	csrss.exe	powershell.exe
PID 1456 wrote to memory of 3180	1456	csrss.exe	powershell.exe
PID 1456 wrote to memory of 3180	1456	csrss.exe	powershell.exe
PID 1456 wrote to memory of 3180	1456	csrss.exe	powershell.exe
PID 1456 wrote to memory of 1160	1456	csrss.exe	powershell.exe
PID 1456 wrote to memory of 1160	1456	csrss.exe	powershell.exe
PID 1456 wrote to memory of 1160	1456	csrss.exe	powershell.exe
PID 3492 wrote to memory of 1028	3492		D0BD.exe
PID 3492 wrote to memory of 1028	3492		D0BD.exe
PID 3492 wrote to memory of 1028	3492		D0BD.exe
PID 1456 wrote to memory of 1208	1456	csrss.exe	injector.exe
PID 1456 wrote to memory of 1208	1456	csrss.exe	injector.exe
PID 3836 wrote to memory of 2900	3836	windefender.exe	cmd.exe
PID 3836 wrote to memory of 2900	3836	windefender.exe	cmd.exe
PID 3836 wrote to memory of 2900	3836	windefender.exe	cmd.exe
PID 2900 wrote to memory of 4952	2900	cmd.exe	sc.exe
PID 2900 wrote to memory of 4952	2900	cmd.exe	sc.exe
PID 2900 wrote to memory of 4952	2900	cmd.exe	sc.exe
PID 3492 wrote to memory of 3944	3492		2A92.exe
PID 3492 wrote to memory of 3944	3492		2A92.exe
PID 3492 wrote to memory of 3944	3492		2A92.exe
PID 3492 wrote to memory of 3084	3492		9C86.exe
PID 3492 wrote to memory of 3084	3492		9C86.exe
PID 3492 wrote to memory of 3084	3492		9C86.exe
PID 3492 wrote to memory of 4476	3492		A5EE.exe
PID 3492 wrote to memory of 4476	3492		A5EE.exe
PID 3492 wrote to memory of 4476	3492		A5EE.exe
PID 3084 wrote to memory of 2568	3084	9C86.exe	qemu-ga.exe
PID 3084 wrote to memory of 2568	3084	9C86.exe	qemu-ga.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe
"C:\Users\Admin\AppData\Local\Temp\1f435b3a62304733dce1b9caf24cfac768db739127e8ec31d466455628ec0922.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Temp\InstallSetup_nine.exe
  "C:\Users\Admin\AppData\Local\Temp\InstallSetup_nine.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Users\Admin\AppData\Local\Temp\u2f8.0.exe
    "C:\Users\Admin\AppData\Local\Temp\u2f8.0.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:4892
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 2356
      4⤵
      Program crash
      PID:4344
- C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
  "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
    "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks for VirtualBox DLLs, possible anti-VM trick
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:2380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:4440
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:1692
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:1248
  - - C:\Windows\rss\csrss.exe
      C:\Windows\rss\csrss.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Manipulates WinMonFS driver.
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:1688
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:4868
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        5⤵
        
        PID:3992
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:3180
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        5⤵
        Executes dropped EXE
        
        PID:1208
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        5⤵
        Creates scheduled task(s)
        
        PID:4600
    - - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3836
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2900
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
- C:\Users\Admin\AppData\Local\Temp\rty25.exe
  "C:\Users\Admin\AppData\Local\Temp\rty25.exe"
  2⤵
  - Executes dropped EXE
  PID:3792
- C:\Users\Admin\AppData\Local\Temp\toolspub1.exe
  "C:\Users\Admin\AppData\Local\Temp\toolspub1.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:4068

C:\Users\Admin\AppData\Local\Temp\D0BD.exe
C:\Users\Admin\AppData\Local\Temp\D0BD.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1028

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1696

C:\Users\Admin\AppData\Local\Temp\2A92.exe
C:\Users\Admin\AppData\Local\Temp\2A92.exe
1⤵
- Executes dropped EXE
PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4892 -ip 4892
1⤵
PID:4220

C:\Users\Admin\AppData\Local\Temp\9C86.exe
C:\Users\Admin\AppData\Local\Temp\9C86.exe
1⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3084
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 1232
  2⤵
  - Program crash
  PID:2108

C:\Users\Admin\AppData\Local\Temp\A5EE.exe
C:\Users\Admin\AppData\Local\Temp\A5EE.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3084 -ip 3084
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
1024KB

MD5
3e0c5d0dfe8abc71d8609b02dba39169

SHA1
038e1207a7dd0c13f64204d9466fbafa8fbc08cb

SHA256
7fd2d86e40a224c67a783dfc6353ce20c559fe4cb6a899b2875c0ec8d97d0f41

SHA512
cb58530108a7fd9b0e4db1814c3e1cd775daa3251aa3f6cf4015f3cdcfba09768273b3fae6f64b0ee6719d8fd17122910d3821aa938b161a5954371ecc1c625b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2A92.exe

Filesize
6.0MB

MD5
95e59305ad61119cf15ee95562bd05ba

SHA1
0f0059cda9609c46105cf022f609c407f3718e04

SHA256
dd87f94c961b9612bbd65761bee6ed15318d63652f262e2c425bd177a2341a19

SHA512
5fbcfe79162460080e0c3944df747835f0b8f2cdb35b038eb69eadf2eb85a209f7d5432a328d0f0eeafba036012f48793e3c08d94531b98a12a498bcf3b00ad2

Download Submit
C:\Users\Admin\AppData\Local\Temp\9C86.exe

Filesize
649KB

MD5
35ffefa212414c2538df410e5ad3afa7

SHA1
e7721fbb85e400c74c7f4de95f1c27b6318caabd

SHA256
9217999518147c602f16ed7d80c9b95dec621f442192ce49192736a27e73847f

SHA512
7bf9ffe99588a1e6e01a6c84fee7bd998b337653c908e33d3c10f1aa9abc7af925ca9d86a884099824133947614aa070181c973b220163dd99dde87765152a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\A5EE.exe

Filesize
952KB

MD5
422a9c5cfa6370c93a4bd5db29c3d196

SHA1
caaf89e601fde4bc9dbe3c0edda8e7efa5062e17

SHA256
82311d6280999d5c9d368377e30b8f55abe2a3d7d98f8c074f6e40c5be7cd965

SHA512
2caf014595f65caa26bd7c8396f981ee452ef01fdf35dde3e9e2e950855f564e97026f71c52b9a49526f9bca68d4f5c6d4bc9ba51d4b8330e38e4b4b84214e96

Download Submit
C:\Users\Admin\AppData\Local\Temp\D0BD.exe

Filesize
170KB

MD5
69d761d941e1a7a4721e267e91167b3a

SHA1
7e83135738bdd132a8c9da031b4794852cfc9f8b

SHA256
c6d317e1eb756b3577414068ac20fc445921f4edd86bef21dbab2d89920e4649

SHA512
4ccfe22c2a726f10e4956383fb12371cc07be797707ac6b5dba1a14a5b798c24503bd4f29302c525240dffd0a3f1d3775ff575a2fddb4443df974d1de5ce1295

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup_nine.exe

Filesize
419KB

MD5
654abe1db0f972272b5b012914d9e5d6

SHA1
1ac7b42167369dcfa528837f13a2c80de7bcc161

SHA256
5f2bdf7f83ab075f7dafaf7493cbf4ab08d2e79b95cd3382621acfe73ba96094

SHA512
18823ab8a9a160ac169052ec210e6adb356190dc0644c8b5fd6f5ccbc8de2666c5e9d44ef90c954d5b6e948c81ef2666900c0fe40b7d5e4b644a39e8b93c1a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xvhjf4rd.kkl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
4.2MB

MD5
66560a15081c9dee9fed498d5f0a25a9

SHA1
fbd7626525777262423fb9beea1e5b7e50fda2b5

SHA256
11e2cfb1fb58a3f69826d5bc36e88fde44c53def20891739ea7054eaabf24551

SHA512
dbd84583c6248db88452ef12074aa668ee982a9fe18484611a1b6d67a7233f9f3fca466bc843dfbc227099a5fd67af24c98f2d5408b26f8cf9fd635f7c70ba07

Download Submit
C:\Users\Admin\AppData\Local\Temp\rty25.exe

Filesize
715KB

MD5
8dc1f88ae1fcedeb3983c5f5c3d486b0

SHA1
d40e67ba5558d90cb11eeca04d213322159336fc

SHA256
4a15d91920a4da9a64935248c126fb60e8302198df8e5759da8129ac1841beca

SHA512
0b2263fe049e280af1178fd396a06a04e6b99f7c971839207ae225161257ed9d9b7eaa8d0ceb1f14d3aa2094b53ce91dd045ebc169102e707ea7285f91432ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub1.exe

Filesize
238KB

MD5
8c20d9745afb54a1b59131314c15d61c

SHA1
1975f997e2db1e487c1caf570263a6a3ba135958

SHA256
a613b6598e0d4c2e52e6ff91538aca8d92c66ef7c13a9baadcba0039570a69d1

SHA512
580021850dfc90647854dd9f8124418abffbe261e3d7f2e1d355dd3a40f31be24f1b9df77ad52f7fa63503a5ee857e270c156e5575e3a32387335018296128d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\u2f8.0.exe

Filesize
211KB

MD5
95fadb59c6f56a41650626902242c541

SHA1
6207e431219b3432e2745b6f9f10afc94e02a2f2

SHA256
01169a885580678630b67ba750108ce554d3e6fcceebc364750d5d2baf427c6e

SHA512
1bffaf4b47a67ef2abceb012a033fa6f56828346da74283c638b44b6d8c83af61545571d567d6b5515eebbebca3448536937b0ea4b7e2bd3f56acafb6a3d6963

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe

Filesize
4KB

MD5
a5ce3aba68bdb438e98b1d0c70a3d95c

SHA1
013f5aa9057bf0b3c0c24824de9d075434501354

SHA256
9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a

SHA512
7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
eb1e378ad39cfbbd73eeedf9580894b1

SHA1
c3904eb582ab02fc11f6ef941acd7f74bd986f9f

SHA256
f6de229be7289ee83a970a499352e7a4c5dad66d5bf0cbacba7791e5920d4f2b

SHA512
2d072dab81d816a6939f7821c73fe139e2f693287e24e5ce756a5cbe16f6ab169209b9b53752b7530a1db14f289981747a9250b559df42fbbe65338453b654ab

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
37ab418f95632585ac4600064f54dc77

SHA1
661dbfae37f83ee3387706cbc9e7d391a9640e14

SHA256
fb9b39a75cda30886d8f6a71341aee7ef0221c86301b286209fa0af72d9be01b

SHA512
344ce19b589d26fe9ea1d24816f45402190a001e4f9b6b161287d442fd20df6f878f1d16377e4fa0aab60f7db5d07adec1b50165084f924d474cbf16aaea2d66

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
3b9a20162e24231005a12291a066b33b

SHA1
0c5578d0bcc47ba32cbf23d5678989cf116a09ed

SHA256
649345671147c1e2ab04331e4c1716e1874035da019b2ea0e937054da6595367

SHA512
3df8db6f50c8a1949d1e9b6c9dd8c2ef35090d442113906bde2d764864529cba13e3a51e319ad01040c357a5a18769da692d505871eb80bca4c81bff5b942407

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
b4b5bedb4e838b7c99147676cb727db9

SHA1
98cf679f8900fc84ce2c8c286693a29a074bd86b

SHA256
00a209c8caf43d2f5537ec2fa92a0115fc7198ebfe4bd75cab20a4ae551c71f7

SHA512
5e001ed877d503c0741d24c6eb19ce26610f173631cc3c73b68188542a2c52c6ef3f6e9d961846c9a19b37a1bfad26aefe8687f803d6a2054578c045488162d2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
2d5574b9676afadcea40af15db61fdd5

SHA1
b74e6caf55d0bba7de7ccfb30a0800cf2b9dcee2

SHA256
037c98cd4609d733a9bbec2bf421870c848ea108e5f8fa6afd14210395935f74

SHA512
b1a39dfbe066a6b3f6d36a9dfee30915f716d6f515cd7a536ce7abf6905c626deb13147f64b34d9378d724cc70184222b0c49e7f31f411cc62012dc9e600d9a7

Download Submit
C:\Windows\windefender.exe

Filesize
896KB

MD5
1bbe083616bf706612d777818a5af69a

SHA1
3b9f559fd32da96ca15fe2c9a0ded61fcae12114

SHA256
3b4a8e5a470eab36018519000ad7cb7bbadf6c6d51824e99e4327ba39e42b87e

SHA512
566c46403b8467a93124babb92ae873b1680f3a578ba4211b6b0f2e21476b3d22e23dbcc7cb61a104451ef2869ed2b0d92a56aeebbec2193e9fdf2d71283ddf1

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/884-1-0x0000000000DF0000-0x0000000001380000-memory.dmp

Filesize
5.6MB

Download
memory/884-48-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/884-0-0x0000000075050000-0x0000000075800000-memory.dmp

Filesize
7.7MB

Download
memory/1028-346-0x0000000000400000-0x0000000002BD7000-memory.dmp

Filesize
39.8MB

Download
memory/1456-432-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1456-357-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1456-344-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1456-438-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1456-424-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1456-368-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1456-412-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1456-421-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1696-410-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1696-422-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1996-240-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1996-140-0x00000000028D0000-0x0000000002CCC000-memory.dmp

Filesize
4.0MB

Download
memory/1996-219-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1996-141-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2380-167-0x00000000031A0000-0x00000000031B0000-memory.dmp

Filesize
64KB

Download
memory/2380-169-0x0000000007C60000-0x0000000007C71000-memory.dmp

Filesize
68KB

Download
memory/2380-168-0x00000000031A0000-0x00000000031B0000-memory.dmp

Filesize
64KB

Download
memory/2380-170-0x0000000007CB0000-0x0000000007CC4000-memory.dmp

Filesize
80KB

Download
memory/2380-166-0x0000000007940000-0x00000000079E3000-memory.dmp

Filesize
652KB

Download
memory/2380-156-0x0000000070A70000-0x0000000070DC4000-memory.dmp

Filesize
3.3MB

Download
memory/2380-155-0x00000000705D0000-0x000000007061C000-memory.dmp

Filesize
304KB

Download
memory/2380-154-0x000000007F650000-0x000000007F660000-memory.dmp

Filesize
64KB

Download
memory/2380-144-0x00000000031A0000-0x00000000031B0000-memory.dmp

Filesize
64KB

Download
memory/2380-143-0x00000000031A0000-0x00000000031B0000-memory.dmp

Filesize
64KB

Download
memory/2380-142-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/2380-173-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/2504-90-0x00000000065B0000-0x00000000065FC000-memory.dmp

Filesize
304KB

Download
memory/2504-63-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2504-134-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/2504-61-0x0000000002FE0000-0x0000000003016000-memory.dmp

Filesize
216KB

Download
memory/2504-62-0x0000000074A50000-0x0000000075200000-memory.dmp

Filesize
7.7MB

Download
memory/2504-130-0x0000000007DB0000-0x0000000007DCA000-memory.dmp

Filesize
104KB

Download
memory/2504-129-0x0000000007CC0000-0x0000000007CD4000-memory.dmp

Filesize
80KB

Download
memory/2504-128-0x0000000007CB0000-0x0000000007CBE000-memory.dmp

Filesize
56KB

Download
memory/2504-127-0x0000000007C70000-0x0000000007C81000-memory.dmp

Filesize
68KB

Download
memory/2504-126-0x0000000007D10000-0x0000000007DA6000-memory.dmp

Filesize
600KB

Download
memory/2504-125-0x0000000007C50000-0x0000000007C5A000-memory.dmp

Filesize
40KB

Download
memory/2504-131-0x0000000007CF0000-0x0000000007CF8000-memory.dmp

Filesize
32KB

Download
memory/2504-123-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/2504-124-0x0000000007B60000-0x0000000007C03000-memory.dmp

Filesize
652KB

Download
memory/2504-122-0x0000000007B40000-0x0000000007B5E000-memory.dmp

Filesize
120KB

Download
memory/2504-111-0x0000000070A70000-0x0000000070DC4000-memory.dmp

Filesize
3.3MB

Download
memory/2504-110-0x00000000705D0000-0x000000007061C000-memory.dmp

Filesize
304KB

Download
memory/2504-108-0x0000000007B00000-0x0000000007B32000-memory.dmp

Filesize
200KB

Download
memory/2504-64-0x0000000005670000-0x0000000005C98000-memory.dmp

Filesize
6.2MB

Download
memory/2504-107-0x000000007FC90000-0x000000007FCA0000-memory.dmp

Filesize
64KB

Download
memory/2504-65-0x00000000055D0000-0x00000000055F2000-memory.dmp

Filesize
136KB

Download
memory/2504-66-0x0000000005ED0000-0x0000000005F36000-memory.dmp

Filesize
408KB

Download
memory/2504-72-0x0000000005FB0000-0x0000000006016000-memory.dmp

Filesize
408KB

Download
memory/2504-81-0x0000000006200000-0x0000000006554000-memory.dmp

Filesize
3.3MB

Download
memory/2504-82-0x0000000006580000-0x000000000659E000-memory.dmp

Filesize
120KB

Download
memory/2504-101-0x0000000007960000-0x000000000797A000-memory.dmp

Filesize
104KB

Download
memory/2504-100-0x0000000007FE0000-0x000000000865A000-memory.dmp

Filesize
6.5MB

Download
memory/2504-99-0x00000000076B0000-0x0000000007726000-memory.dmp

Filesize
472KB

Download
memory/2504-98-0x0000000006AE0000-0x0000000006B24000-memory.dmp

Filesize
272KB

Download
memory/2648-54-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2648-53-0x0000000002D80000-0x000000000366B000-memory.dmp

Filesize
8.9MB

Download
memory/2648-138-0x0000000002D80000-0x000000000366B000-memory.dmp

Filesize
8.9MB

Download
memory/2648-136-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2648-52-0x0000000002980000-0x0000000002D7D000-memory.dmp

Filesize
4.0MB

Download
memory/3140-51-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3140-109-0x0000000000640000-0x0000000000740000-memory.dmp

Filesize
1024KB

Download
memory/3140-50-0x00000000020E0000-0x0000000002147000-memory.dmp

Filesize
412KB

Download
memory/3140-49-0x0000000000640000-0x0000000000740000-memory.dmp

Filesize
1024KB

Download
memory/3140-117-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/3492-102-0x0000000003110000-0x0000000003126000-memory.dmp

Filesize
88KB

Download
memory/3492-345-0x0000000003140000-0x0000000003156000-memory.dmp

Filesize
88KB

Download
memory/3792-35-0x00007FF66BFA0000-0x00007FF66C057000-memory.dmp

Filesize
732KB

Download
memory/3836-366-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4068-106-0x00000000005D0000-0x00000000005DB000-memory.dmp

Filesize
44KB

Download
memory/4068-105-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4068-55-0x00000000005D0000-0x00000000005DB000-memory.dmp

Filesize
44KB

Download
memory/4068-56-0x0000000000460000-0x0000000000560000-memory.dmp

Filesize
1024KB

Download
memory/4068-57-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/4892-175-0x0000000000400000-0x0000000002BE1000-memory.dmp

Filesize
39.9MB

Download
memory/4892-431-0x0000000000400000-0x0000000002BE1000-memory.dmp

Filesize
39.9MB

Download
memory/4892-369-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/4892-417-0x0000000000400000-0x0000000002BE1000-memory.dmp

Filesize
39.9MB

Download
memory/4892-439-0x0000000000400000-0x0000000002BE1000-memory.dmp

Filesize
39.9MB

Download
memory/4892-361-0x0000000000400000-0x0000000002BE1000-memory.dmp

Filesize
39.9MB

Download
memory/4892-176-0x0000000002C20000-0x0000000002D20000-memory.dmp

Filesize
1024KB

Download
memory/4892-97-0x0000000000400000-0x0000000002BE1000-memory.dmp

Filesize
39.9MB

Download
memory/4892-403-0x0000000000400000-0x0000000002BE1000-memory.dmp

Filesize
39.9MB

Download
memory/4892-349-0x0000000000400000-0x0000000002BE1000-memory.dmp

Filesize
39.9MB

Download
memory/4892-95-0x0000000002C20000-0x0000000002D20000-memory.dmp

Filesize
1024KB

Download
memory/4892-96-0x0000000004820000-0x0000000004854000-memory.dmp

Filesize
208KB

Download