glupteba | 55dfea3ff8cf6fd2c133dc53b415c12b8e5921951776d559b6fbde136924141d

Analysis

max time kernel
150s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/02/2024, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
024a74276c5ddcc6aff89d508f3bda43.exe
Size 4.1MB
Sample240210-e7nw6aaf78
SHA256 55dfea3ff8cf6fd2c133dc53b415c12b8e5921951776d559b6fbde136924141d
MD5 024a74276c5ddcc6aff89d508f3bda43
SHA1 9ff8593dc7b1889a543fa260eaea5a1c1a4e7931
SHA512 a02a23b7aa6d7333a214cff97ecd3e95985e24e8841921fb435208a5b405d0636136710b5161412cc8fe1bcdced8a43fac8aa5ac418f1fecf89ea9092afc3356
SSDEEP 98304:/IQ9b+1nBcZaXVDYsl1+n8YXugXgmFPX0fDTQIGF0ZiXj/n+rjAidT0v:/59y1eAXVcnnQKR0bTQToAjG1O
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 23 IoCs

resource	yara_rule
behavioral1/memory/2348-2-0x0000000002AE0000-0x00000000033CB000-memory.dmp	family_glupteba
behavioral1/memory/2348-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2348-4-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2348-6-0x0000000002AE0000-0x00000000033CB000-memory.dmp	family_glupteba
behavioral1/memory/1940-9-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1940-18-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-22-0x0000000002BD0000-0x00000000034BB000-memory.dmp	family_glupteba
behavioral1/memory/2892-23-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-101-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-117-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-118-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-148-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-152-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-158-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-160-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-162-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-164-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-166-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-168-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-170-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-172-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-174-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2892-176-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\024a74276c5ddcc6aff89d508f3bda43.exe = "0"	024a74276c5ddcc6aff89d508f3bda43.exe

Modifies boot configuration data using bcdedit 14 IoCs

pid	Process
1720	bcdedit.exe
1104	bcdedit.exe
1112	bcdedit.exe
1628	bcdedit.exe
2520	bcdedit.exe
2328	bcdedit.exe
2944	bcdedit.exe
1808	bcdedit.exe
896	bcdedit.exe
1344	bcdedit.exe
1944	bcdedit.exe
1588	bcdedit.exe
832	bcdedit.exe
2768	bcdedit.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\Winmon.sys	csrss.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2656	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Executes dropped EXE 6 IoCs

pid	Process
2892	csrss.exe
1192	patch.exe
328	injector.exe
2696	dsefix.exe
760	windefender.exe
1480	windefender.exe

Loads dropped DLL 13 IoCs

pid	Process
1940	024a74276c5ddcc6aff89d508f3bda43.exe
1940	024a74276c5ddcc6aff89d508f3bda43.exe
856	Process not Found
1192	patch.exe
1192	patch.exe
1192	patch.exe
1192	patch.exe
1192	patch.exe
2892	csrss.exe
1192	patch.exe
1192	patch.exe
1192	patch.exe
2892	csrss.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000004ed7-151.dat	upx
behavioral1/memory/760-153-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/1480-156-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/760-157-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/1480-159-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/1480-163-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/1480-169-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\024a74276c5ddcc6aff89d508f3bda43.exe = "0"	024a74276c5ddcc6aff89d508f3bda43.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMon driver. 1 IoCs

Roottkits write to WinMon to hide PIDs from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMon	csrss.exe

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	024a74276c5ddcc6aff89d508f3bda43.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	024a74276c5ddcc6aff89d508f3bda43.exe
File created	C:\Windows\rss\csrss.exe	024a74276c5ddcc6aff89d508f3bda43.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20240210043514.cab	makecab.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1064	sc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
588	schtasks.exe
2580	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-422 = "Russian Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-572 = "China Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	csrss.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-362 = "GTB Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-491 = "India Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	024a74276c5ddcc6aff89d508f3bda43.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time"	windefender.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2348	024a74276c5ddcc6aff89d508f3bda43.exe
1940	024a74276c5ddcc6aff89d508f3bda43.exe
1940	024a74276c5ddcc6aff89d508f3bda43.exe
1940	024a74276c5ddcc6aff89d508f3bda43.exe
1940	024a74276c5ddcc6aff89d508f3bda43.exe
1940	024a74276c5ddcc6aff89d508f3bda43.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
2892	csrss.exe
328	injector.exe
328	injector.exe
328	injector.exe
2892	csrss.exe
328	injector.exe
328	injector.exe
2892	csrss.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe
328	injector.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	024a74276c5ddcc6aff89d508f3bda43.exe
Token: SeImpersonatePrivilege	2348	024a74276c5ddcc6aff89d508f3bda43.exe
Token: SeSystemEnvironmentPrivilege	2892	csrss.exe
Token: SeSecurityPrivilege	1064	sc.exe
Token: SeSecurityPrivilege	1064	sc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2228	1940	024a74276c5ddcc6aff89d508f3bda43.exe	33
PID 1940 wrote to memory of 2228	1940	024a74276c5ddcc6aff89d508f3bda43.exe	33
PID 1940 wrote to memory of 2228	1940	024a74276c5ddcc6aff89d508f3bda43.exe	33
PID 1940 wrote to memory of 2228	1940	024a74276c5ddcc6aff89d508f3bda43.exe	33
PID 2228 wrote to memory of 2656	2228	cmd.exe	35
PID 2228 wrote to memory of 2656	2228	cmd.exe	35
PID 2228 wrote to memory of 2656	2228	cmd.exe	35
PID 1940 wrote to memory of 2892	1940	024a74276c5ddcc6aff89d508f3bda43.exe	36
PID 1940 wrote to memory of 2892	1940	024a74276c5ddcc6aff89d508f3bda43.exe	36
PID 1940 wrote to memory of 2892	1940	024a74276c5ddcc6aff89d508f3bda43.exe	36
PID 1940 wrote to memory of 2892	1940	024a74276c5ddcc6aff89d508f3bda43.exe	36
PID 2892 wrote to memory of 328	2892	csrss.exe	43
PID 2892 wrote to memory of 328	2892	csrss.exe	43
PID 2892 wrote to memory of 328	2892	csrss.exe	43
PID 2892 wrote to memory of 328	2892	csrss.exe	43
PID 1192 wrote to memory of 1720	1192	patch.exe	47
PID 1192 wrote to memory of 1720	1192	patch.exe	47
PID 1192 wrote to memory of 1720	1192	patch.exe	47
PID 1192 wrote to memory of 1104	1192	patch.exe	49
PID 1192 wrote to memory of 1104	1192	patch.exe	49
PID 1192 wrote to memory of 1104	1192	patch.exe	49
PID 1192 wrote to memory of 1112	1192	patch.exe	51
PID 1192 wrote to memory of 1112	1192	patch.exe	51
PID 1192 wrote to memory of 1112	1192	patch.exe	51
PID 1192 wrote to memory of 1628	1192	patch.exe	53
PID 1192 wrote to memory of 1628	1192	patch.exe	53
PID 1192 wrote to memory of 1628	1192	patch.exe	53
PID 1192 wrote to memory of 2520	1192	patch.exe	55
PID 1192 wrote to memory of 2520	1192	patch.exe	55
PID 1192 wrote to memory of 2520	1192	patch.exe	55
PID 1192 wrote to memory of 2328	1192	patch.exe	57
PID 1192 wrote to memory of 2328	1192	patch.exe	57
PID 1192 wrote to memory of 2328	1192	patch.exe	57
PID 1192 wrote to memory of 2944	1192	patch.exe	59
PID 1192 wrote to memory of 2944	1192	patch.exe	59
PID 1192 wrote to memory of 2944	1192	patch.exe	59
PID 1192 wrote to memory of 1808	1192	patch.exe	61
PID 1192 wrote to memory of 1808	1192	patch.exe	61
PID 1192 wrote to memory of 1808	1192	patch.exe	61
PID 1192 wrote to memory of 896	1192	patch.exe	63
PID 1192 wrote to memory of 896	1192	patch.exe	63
PID 1192 wrote to memory of 896	1192	patch.exe	63
PID 1192 wrote to memory of 1344	1192	patch.exe	65
PID 1192 wrote to memory of 1344	1192	patch.exe	65
PID 1192 wrote to memory of 1344	1192	patch.exe	65
PID 1192 wrote to memory of 1944	1192	patch.exe	67
PID 1192 wrote to memory of 1944	1192	patch.exe	67
PID 1192 wrote to memory of 1944	1192	patch.exe	67
PID 1192 wrote to memory of 1588	1192	patch.exe	69
PID 1192 wrote to memory of 1588	1192	patch.exe	69
PID 1192 wrote to memory of 1588	1192	patch.exe	69
PID 1192 wrote to memory of 832	1192	patch.exe	71
PID 1192 wrote to memory of 832	1192	patch.exe	71
PID 1192 wrote to memory of 832	1192	patch.exe	71
PID 2892 wrote to memory of 2768	2892	csrss.exe	73
PID 2892 wrote to memory of 2768	2892	csrss.exe	73
PID 2892 wrote to memory of 2768	2892	csrss.exe	73
PID 2892 wrote to memory of 2768	2892	csrss.exe	73
PID 2892 wrote to memory of 2696	2892	csrss.exe	75
PID 2892 wrote to memory of 2696	2892	csrss.exe	75
PID 2892 wrote to memory of 2696	2892	csrss.exe	75
PID 2892 wrote to memory of 2696	2892	csrss.exe	75
PID 760 wrote to memory of 1640	760	windefender.exe	84
PID 760 wrote to memory of 1640	760	windefender.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\024a74276c5ddcc6aff89d508f3bda43.exe
"C:\Users\Admin\AppData\Local\Temp\024a74276c5ddcc6aff89d508f3bda43.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2348
- C:\Users\Admin\AppData\Local\Temp\024a74276c5ddcc6aff89d508f3bda43.exe
  "C:\Users\Admin\AppData\Local\Temp\024a74276c5ddcc6aff89d508f3bda43.exe"
  2⤵
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:2656
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Manipulates WinMon driver.
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:2620
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:588
  - - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:1192
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1720
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1104
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1112
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1628
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2520
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2328
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2944
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1808
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:896
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1344
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1944
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1588
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:832
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:328
  - - C:\Windows\system32\bcdedit.exe
      C:\Windows\Sysnative\bcdedit.exe /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      4⤵
      Executes dropped EXE
      PID:2696
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2580
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:760
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:1640
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240210043514.log C:\Windows\Logs\CBS\CbsPersist_20240210043514.cab
1⤵
- Drops file in Windows directory
PID:2712

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cab73BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab73BB.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.error

Path C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error
Size 4.1MB
SHA256 82a0d8310f980206bfd6d0b185b9b219b1cc86351117ae2e9be8705cb13a3bdf
MD5 c2f7313966930496f4d6cf1beadfacdc
SHA1 5222b113bda15fead7c05059de706ec1777ee5b3
SHA512 7ac1d4cb52a944fb14eb5ebf18f51ab220de09402a585c10ed5560896cfb1768bddfa264dd75efb16610a47bec7b7deca5b0ee170a95f1568b3b6ae06129e743
SSDEEP 49152:eMCP9SXShbVEG8beukiJBBwU/Fd2Doy3dGMqC/NQoPSzrqkc7q1uc/PTTCh/Qr:7CP5bVEchUg7XlQoUUq1zH
MD5 SHA1 SHA512 SSDEEP

Submit Download

download.error

Path C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error
Size 492KB
SHA256 feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71
MD5 fafbf2197151d5ce947872a4b0bcbe16
SHA1 a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020
SHA512 acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6
SSDEEP 3072:yQO3MRhMzV3iSDi7loqi2iDqiMPxOYU6DIru3ZrSmV+pxbKM5zePCpQqmO4QzEQi:8i9U6MrSZrV+paO4QFipx+Z0dZ8i9s+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar7499.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar7499.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

patch.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
Size 136KB
SHA256 d1fe164bc7c44a7cbf8614118c617afa2d305959e8a960a3b6a95fa8b12b7f8a
MD5 f16c7fe73dd46cb4551c8e730fbb6a67
SHA1 be5e2c811af231348b4735c4e67be17242b7fb78
SHA512 0247b6eb5b7717a60b12b985d9a9b7c1763988947bd9bb89231b591f91c4dc4346f7848244ee7d333458ed31dbdc6c481dff48cfe6f1a98ffc67c8fa3c78fd7c
SSDEEP 3072:aDYE0IkKlnalYoY1m6ydQuprenFn39gFlsJon96sPYV6mnuuI:XE0JKlnalNYvRuBenx9gFlsJA9PYrI
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 28KB
SHA256 e10a2447104cddbdfc825022b937375ae620cf3f0bda5b62d0299abbad916b24
MD5 055709f3515eb52abf27165661ccf316
SHA1 7287c29adbd18390f5474990444c2ddf0f477ba6
SHA512 8547626f9dd39e41b0d90937373efdb89ae97e6071a984297bf60724a3505c2fa8e4003b286befe6c89d090f5eb01037a00ceb07ce495e5ca53f7e66ae4b6873
SSDEEP 768:k3IO1diWSvQLxK9SQtEgzeYJNRxVV3aDgx4M:c1QWSMKbJNRxn3vuM
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 128KB
SHA256 ffcc19d131a98fd0394eccf4bd26daccb6c9ee189199ec222096e4559bc18518
MD5 a8261bfb6c375ee15a39a3bbfccb8ed6
SHA1 2084e5f1b6339447e1c863104a5aa018b3aeb806
SHA512 16f953a8bd8d6f986fcb18067462db35ff8c302cc3c7384fb176178b8429121a22c23ad1d9c61147e24cbec464a1d72abd71421e4dd5bd4474589b9b5cff141b
SSDEEP 3072:Ot++TaUpAszmFQqVR1ogfW+rw9f8A9zpe:ebaczgFVR1RbA8Aq
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 64KB
SHA256 65116d60d74be4a544e2a15d6932d0aeb4b472a4411190a9ba69f3bd5bddb99e
MD5 07f31a15fb0a90cf946cde277a764b2d
SHA1 e9d9d42799a5dba386c157dfbf548acb4ca4e9e6
SHA512 279afeb6103debf418b32b917b89864639ada74b1adca58e9a2b32c5bc18a1d092af03840150a1b0162232e08120d0c1fb7fc3fb725b7659e00a6cd5c7d8f140
SSDEEP 1536:OtYDa6fhyL++TarM+kp91UFWXIP5CkI1G2f0zic:Ot++TaUpAsz
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 1.4MB
SHA256 8522cc93a3160ab0168529621237e9e478d05601f6dc516da24f162b83633893
MD5 dea5af011ed3f85fa38b0c103a99e197
SHA1 71c3fc1b91d9e0ed0cd1628556d7c979628a9c21
SHA512 7054ced21659e56440243241939bc5148503941a65aca73a9e3010014fb1b0c472464c3e8d03d6f8eafb359e2c3bc1bd1e5e888fb7f8679e45b3782f0f0438a8
SSDEEP 24576:c4z8QyKb4qqWUalVzuSve9cgQEOobKgbXxXfEbNUYsfL1MhLlo:/IQyKb4qqWUabuSv4cgTOaXVuSYsf8Ly
MD5 SHA1 SHA512 SSDEEP

Submit Download

windefender.exe

Path C:\Windows\windefender.exe
Size 2.0MB
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
SSDEEP 49152:y+SUiJeHpNnxG745Mfi39uXrbcI6DOdVgeuaNjwAx1bJljkv6kXjxNh:fdlHA4yiN8cI6SX3hbJCvhx
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsefix.exe

Path \Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
Size 94KB
SHA256 414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0
MD5 d98e78fd57db58a11f880b45bb659767
SHA1 ab70c0d3bd9103c07632eeecee9f51d198ed0e76
SHA512 aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831
SSDEEP 1536:KNSuvn3R+Vjj3d38uezp0Dw+49tKMgVxAlIi8:ah+Vjj3d38uezp0U9vgLAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

injector.exe

Path \Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
MD5 SHA1 SHA512 SSDEEP

Submit Download

patch.exe

Path \Users\Admin\AppData\Local\Temp\csrss\patch.exe
Size 195KB
SHA256 ffa220ca01db9c035a1bfb12d3c9faa33ce59bb28adb62abfc21aa465f60c414
MD5 1d2aa8bdd783d479e5c5ba0f4c2fdc42
SHA1 9ff9ba787102f6216b55a09a6011a6cd114e0afc
SHA512 813df7982f74d638b56543421b6eb3ceb2d963c562dc696e814fb74372967368961784b1b95eb2cb244e485b64cfff60064bb67886314d2fe31ef53906ac6613
SSDEEP 6144:XE0JKlnalNYvRuBenx9gFlsJA9PYr1FYPybuT:fKlnaLI9gFlsJ0MFYPyb8
MD5 SHA1 SHA512 SSDEEP

Submit Download

dbghelp.dll

Path \Users\Admin\AppData\Local\Temp\dbghelp.dll
Size 1.5MB
SHA256 6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026
MD5 f0616fa8bc54ece07e3107057f74e4db
SHA1 b33995c4f9a004b7d806c4bb36040ee844781fca
SHA512 15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c
SSDEEP 24576:QMFUEdpHVzXKWHoBpHEjVweSRHYU/L38dsh0Dt/oPf2u:JRpHNdInHdUU/z0Vu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 2.0MB
SHA256 d7b289c14ebe91a4a0b48a7391d419a7f8efded86a67c1f6f8a4010518a633f2
MD5 8ea94db76d1dd66b9a176e7115fa4f4f
SHA1 5e6b38f3a839910f4d67f26a74de0b64efb1c13e
SHA512 a8d40c82158814fa8b0fbf45b004f5b335850c8aaed6bca373af56d8aab444ffd4e112cec4d5927c8fa814ba913ad7ef05324212cd8f57447979b8faccb80d02
SSDEEP 49152:Q8CGTrD2DmiPjt3TBXJHHg+jD9tdTTdrL:Q8CG3D2xBXV1v
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 1.9MB
SHA256 88bcd139688979f64362f0b408465323ae643fb0f6a453d93ddfe2cb15b798dc
MD5 bfc50083493412ba70334f1df7687e2d
SHA1 1f5ec6fd643427600d75dbf6f1926d77e56b3559
SHA512 20993283f83a1ed4022d4e05bd43113ee085dc2505c708a24d0cf75425887577e55ce07825c749447dd00ad79821fa98f2db2a2131bffa20f123eabe74be917e
SSDEEP 49152:Q8CGTrD2DmiPjt3TBXJHHg+jD9tdTTdro:Q8CG3D2xBXV1U
MD5 SHA1 SHA512 SSDEEP

Submit Download

ntkrnlmp.exe

Path \Users\Admin\AppData\Local\Temp\ntkrnlmp.exe
Size 45KB
SHA256 ae7482df4f163c9d74df5f0ba85cfa7c0269b2b314eecfda2fac97ee221afe62
MD5 a2ffb158525c7da4e10893e6b3794b5f
SHA1 a853c7d026bb688b65fe5bf26e6fb033c4fd1c6d
SHA512 9f907b7b83842d42896e577097f6810f96b0bf4b2df1498742666061a55b4d77f66ee5cda5b1d78faad66f605c87db482c15429c964436f8b06d7a1e9ec06a85
SSDEEP 768:k3IO1diWSvQLxK9SQtEgzeYJNRxVV3aDgx4V/4SrraFw+vH8Oar33yPvEDeq:c1QWSMKbJNRxn3vuV/HraCc81uKeq
MD5 SHA1 SHA512 SSDEEP

Submit Download

osloader.exe

Path \Users\Admin\AppData\Local\Temp\osloader.exe
Size 591KB
SHA256 b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4
MD5 e2f68dc7fbd6e0bf031ca3809a739346
SHA1 9c35494898e65c8a62887f28e04c0359ab6f63f5
SHA512 26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579
SSDEEP 12288:g3SAVNtsCiPdRpuHq83wf1PKWZlZQUUFoqn6F7H4:giAJsC6dbuHq8G1PK6lZvL+6NY
MD5 SHA1 SHA512 SSDEEP

Submit Download

symsrv.dll

Path \Users\Admin\AppData\Local\Temp\symsrv.dll
Size 140KB
SHA256 ff6141a2665dc1eb48aaf30d251306d7e24c8abb979e9533dc65e199713a8c16
MD5 48ea733e46a598c00ac0f95d93bcecc8
SHA1 627cbad6bee349bbaae7c491119c16b525bcc436
SHA512 5d5c269b776378a2f5c1bdc6f6f49a5e13ad698028703e5ea9f93608315e1db9cf85a09962dbec4d657422c8c698c66c769fbddfcbedbbfdc721fd58147b5879
SSDEEP 3072:XFg2VNLKO+Qgd/T0hexf+fs7ketCv5mQTeKBSccrfjZDC:XFg2TLT+h9xf+f+c4fVDC
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Windows\rss\csrss.exe
Size 256KB
SHA256 b4d7bc5b98b5b63c57b5e310ab51e8fb01a9ce1c2fdb612a8cd5bdb2e8b07647
MD5 de33ac3df71cf5710504cdf9d5a5b18f
SHA1 b712340a8393ba21c3b281fa20d5d95cd152c996
SHA512 df5e5a0fdac7eebd8bdd02bc4fc9a6b9e34218435aa47546f28c32d0970a953d7a2b03b12ad3752b71e903ece9ed93339c4ec5f629126053591344d9d2bf324c
SSDEEP 6144:ebaczgFVR1RbA8ANcyKxV4BIir1TW7FmNPnRE:mzgFXj88IcyKb4BID7FmZRE
MD5 SHA1 SHA512 SSDEEP

Submit Download

csrss.exe

Path \Windows\rss\csrss.exe
Size 2.6MB
SHA256 bd4ebf845b277f32a59bb86f6427a904529fe39424be81c5086f5077d7a4348c
MD5 be0c659c2959d76c7168bc5f4e876e7c
SHA1 a1dec16d0d53f36a8023abf30852069b4eb27321
SHA512 e64379e639c60a586398ccc522819c68479e323f785116587d231e4ef51c1233a84a7b3e6c082827c0596d5712b389deff358309cbe5d8370e952ccd09d042b5
SSDEEP 49152:/IQyKb4qqWUabuSv4cgTOaXVuSYsf8LlSv9ZUmA8Y+6uqZBtZsOZejOpFPXjI:/IQ9b+1nBcZaXVDYsl1+n8YXugXgmFPc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/760-153-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/760-157-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/1192-44-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/1192-30-0x0000000140000000-0x00000001405E8000-memory.dmp

Download

memory/1480-156-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/1480-163-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/1480-169-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/1480-159-0x0000000000400000-0x00000000008DF000-memory.dmp

Download

memory/1940-9-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1940-18-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1940-21-0x0000000002770000-0x0000000002B68000-memory.dmp

Download

memory/1940-5-0x0000000002770000-0x0000000002B68000-memory.dmp

Download

memory/1940-7-0x0000000002770000-0x0000000002B68000-memory.dmp

Download

memory/2348-1-0x00000000026E0000-0x0000000002AD8000-memory.dmp

Download

memory/2348-0-0x00000000026E0000-0x0000000002AD8000-memory.dmp

Download

memory/2348-2-0x0000000002AE0000-0x00000000033CB000-memory.dmp

Download

memory/2348-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2348-8-0x00000000026E0000-0x0000000002AD8000-memory.dmp

Download

memory/2348-6-0x0000000002AE0000-0x00000000033CB000-memory.dmp

Download

memory/2348-4-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-148-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-160-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-118-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-152-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-117-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-116-0x00000000027D0000-0x0000000002BC8000-memory.dmp

Download

memory/2892-101-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-158-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-19-0x00000000027D0000-0x0000000002BC8000-memory.dmp

Download

memory/2892-23-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-162-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-20-0x00000000027D0000-0x0000000002BC8000-memory.dmp

Download

memory/2892-164-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-166-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-168-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-22-0x0000000002BD0000-0x00000000034BB000-memory.dmp

Download

memory/2892-170-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-172-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-174-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/2892-176-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download