glupteba | f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36

Analysis

max time kernel
300s
max time network
301s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Size

4.1MB
MD5

a420431057abe6cb559e28b67ea3a36c
SHA1

68e75ad18abefc971860c22229e99fd3c7ec95f0
SHA256

f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36
SHA512

43f10e90736ffb9e1a4f55e7dd13e4fd1113047841eff94286750cbbf060879167885e2c84f58205dfb777d49393c3edad8c678516c63174e0dd8631e8a5d66a
SSDEEP

98304:QL3qvPQpdwFSRzutOtVgrtE3GtiyAu5Gxkd:Qm3Q3+2AOtVStECE4GWd

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 36 IoCs

resource	yara_rule
behavioral1/memory/2856-2-0x00000000044E0000-0x0000000004DCB000-memory.dmp	family_glupteba
behavioral1/memory/2856-3-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2856-4-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2856-6-0x00000000044E0000-0x0000000004DCB000-memory.dmp	family_glupteba
behavioral1/memory/2444-9-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2444-18-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-22-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-113-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-118-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-149-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-158-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-160-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-162-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-164-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-166-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-168-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-170-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-172-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-174-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-176-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-178-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-180-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-182-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-184-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-186-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-188-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-190-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-192-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-194-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-196-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-198-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-200-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-202-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-204-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-206-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba
behavioral1/memory/2336-208-0x0000000000400000-0x00000000026BD000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe

Modifies boot configuration data using bcdedit 14 IoCs

pid	Process
1864	bcdedit.exe
568	bcdedit.exe
2744	bcdedit.exe
2084	bcdedit.exe
1896	bcdedit.exe
2228	bcdedit.exe
2288	bcdedit.exe
2112	bcdedit.exe
1964	bcdedit.exe
2320	bcdedit.exe
1036	bcdedit.exe
1548	bcdedit.exe
1908	bcdedit.exe
2752	bcdedit.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\Winmon.sys	csrss.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2816	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Executes dropped EXE 6 IoCs

pid	Process
2336	csrss.exe
2176	patch.exe
1244	injector.exe
2820	dsefix.exe
1040	windefender.exe
2492	windefender.exe

Loads dropped DLL 13 IoCs

pid	Process
2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
864	Process not Found
2176	patch.exe
2176	patch.exe
2176	patch.exe
2176	patch.exe
2176	patch.exe
2336	csrss.exe
2176	patch.exe
2176	patch.exe
2176	patch.exe
2336	csrss.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000016cb0-152.dat	upx
behavioral1/memory/1040-153-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/files/0x0008000000016cb0-155.dat	upx
behavioral1/memory/2492-156-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/1040-157-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2492-159-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2492-163-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2492-169-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMon driver. 1 IoCs

Roottkits write to WinMon to hide PIDs from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMon	csrss.exe

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
File created	C:\Windows\rss\csrss.exe	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20240229051000.cab	makecab.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1872	sc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2376	schtasks.exe
2468	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-521 = "N. Central Asia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-21 = "Cape Verde Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-162 = "Central Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-581 = "North Asia East Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-471 = "Ekaterinburg Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-492 = "India Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-522 = "N. Central Asia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-385 = "Namibia Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	patch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2856	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
2336	csrss.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
2336	csrss.exe
1244	injector.exe
1244	injector.exe
2336	csrss.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe
1244	injector.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
476	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Token: SeImpersonatePrivilege	2856	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
Token: SeSystemEnvironmentPrivilege	2336	csrss.exe
Token: SeSecurityPrivilege	1872	sc.exe
Token: SeSecurityPrivilege	1872	sc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2496	2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe	33
PID 2444 wrote to memory of 2496	2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe	33
PID 2444 wrote to memory of 2496	2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe	33
PID 2444 wrote to memory of 2496	2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe	33
PID 2496 wrote to memory of 2816	2496	cmd.exe	35
PID 2496 wrote to memory of 2816	2496	cmd.exe	35
PID 2496 wrote to memory of 2816	2496	cmd.exe	35
PID 2444 wrote to memory of 2336	2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe	36
PID 2444 wrote to memory of 2336	2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe	36
PID 2444 wrote to memory of 2336	2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe	36
PID 2444 wrote to memory of 2336	2444	f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe	36
PID 2336 wrote to memory of 1244	2336	csrss.exe	45
PID 2336 wrote to memory of 1244	2336	csrss.exe	45
PID 2336 wrote to memory of 1244	2336	csrss.exe	45
PID 2336 wrote to memory of 1244	2336	csrss.exe	45
PID 2176 wrote to memory of 1864	2176	patch.exe	47
PID 2176 wrote to memory of 1864	2176	patch.exe	47
PID 2176 wrote to memory of 1864	2176	patch.exe	47
PID 2176 wrote to memory of 568	2176	patch.exe	49
PID 2176 wrote to memory of 568	2176	patch.exe	49
PID 2176 wrote to memory of 568	2176	patch.exe	49
PID 2176 wrote to memory of 2744	2176	patch.exe	51
PID 2176 wrote to memory of 2744	2176	patch.exe	51
PID 2176 wrote to memory of 2744	2176	patch.exe	51
PID 2176 wrote to memory of 2084	2176	patch.exe	53
PID 2176 wrote to memory of 2084	2176	patch.exe	53
PID 2176 wrote to memory of 2084	2176	patch.exe	53
PID 2176 wrote to memory of 1896	2176	patch.exe	55
PID 2176 wrote to memory of 1896	2176	patch.exe	55
PID 2176 wrote to memory of 1896	2176	patch.exe	55
PID 2176 wrote to memory of 2228	2176	patch.exe	57
PID 2176 wrote to memory of 2228	2176	patch.exe	57
PID 2176 wrote to memory of 2228	2176	patch.exe	57
PID 2176 wrote to memory of 2288	2176	patch.exe	59
PID 2176 wrote to memory of 2288	2176	patch.exe	59
PID 2176 wrote to memory of 2288	2176	patch.exe	59
PID 2176 wrote to memory of 2112	2176	patch.exe	61
PID 2176 wrote to memory of 2112	2176	patch.exe	61
PID 2176 wrote to memory of 2112	2176	patch.exe	61
PID 2176 wrote to memory of 1964	2176	patch.exe	63
PID 2176 wrote to memory of 1964	2176	patch.exe	63
PID 2176 wrote to memory of 1964	2176	patch.exe	63
PID 2176 wrote to memory of 2320	2176	patch.exe	65
PID 2176 wrote to memory of 2320	2176	patch.exe	65
PID 2176 wrote to memory of 2320	2176	patch.exe	65
PID 2176 wrote to memory of 1036	2176	patch.exe	67
PID 2176 wrote to memory of 1036	2176	patch.exe	67
PID 2176 wrote to memory of 1036	2176	patch.exe	67
PID 2176 wrote to memory of 1548	2176	patch.exe	69
PID 2176 wrote to memory of 1548	2176	patch.exe	69
PID 2176 wrote to memory of 1548	2176	patch.exe	69
PID 2176 wrote to memory of 1908	2176	patch.exe	71
PID 2176 wrote to memory of 1908	2176	patch.exe	71
PID 2176 wrote to memory of 1908	2176	patch.exe	71
PID 2336 wrote to memory of 2752	2336	csrss.exe	73
PID 2336 wrote to memory of 2752	2336	csrss.exe	73
PID 2336 wrote to memory of 2752	2336	csrss.exe	73
PID 2336 wrote to memory of 2752	2336	csrss.exe	73
PID 2336 wrote to memory of 2820	2336	csrss.exe	75
PID 2336 wrote to memory of 2820	2336	csrss.exe	75
PID 2336 wrote to memory of 2820	2336	csrss.exe	75
PID 2336 wrote to memory of 2820	2336	csrss.exe	75
PID 1040 wrote to memory of 2312	1040	windefender.exe	82
PID 1040 wrote to memory of 2312	1040	windefender.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
"C:\Users\Admin\AppData\Local\Temp\f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856
- C:\Users\Admin\AppData\Local\Temp\f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe
  "C:\Users\Admin\AppData\Local\Temp\f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36.exe"
  2⤵
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:2816
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Manipulates WinMon driver.
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2376
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:2176
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1864
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:568
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2744
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2084
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1896
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2228
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2288
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2112
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1964
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2320
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1036
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1548
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1244
  - - C:\Windows\system32\bcdedit.exe
      C:\Windows\Sysnative\bcdedit.exe /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2752
  - - C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      4⤵
      Executes dropped EXE
      PID:2820
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2468
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1040
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:2312
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:1872

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240229051000.log C:\Windows\Logs\CBS\CbsPersist_20240229051000.cab
1⤵
- Drops file in Windows directory
PID:2636

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab42EC.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

Filesize
8.3MB

MD5
fd2727132edd0b59fa33733daa11d9ef

SHA1
63e36198d90c4c2b9b09dd6786b82aba5f03d29a

SHA256
3a72dbedc490773f90e241c8b3b839383a63ce36426a4f330a0f754b14b4d23e

SHA512
3e251be7d0e8db92d50092a4c4be3c74f42f3d564c72981f43a8e0fe06427513bfa0f67821a61a503a4f85741f0b150280389f8f4b4f01cdfd98edce5af29e6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

Filesize
492KB

MD5
fafbf2197151d5ce947872a4b0bcbe16

SHA1
a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

SHA256
feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

SHA512
acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4498.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
3.3MB

MD5
574f8c6ff69597d07e1a7c69e84c2478

SHA1
d33bcb011e6a095097778d9b272de79a6bdb85ac

SHA256
e0853dd6afb737b13a5ef009f38a0273643c581eb7e94d270072a257b33b7504

SHA512
7d1f5a3e32bd2de9c07a934e457ad1a28bde89b11da9e931bd8523a28892dfbf29389340c217a51588d6bb23be0e4f3b252ba3f5a41f11e3100807cbb11326e3

Download Submit
C:\Windows\rss\csrss.exe

Filesize
1.1MB

MD5
7a8f3d152c83f7ea49d757995cea954f

SHA1
5cef9dd284683f38cf4b45248932eb8a1be9db56

SHA256
0bf9c3ceffb73ecc035935bec041e663a6cfa9b7a7cb4cc05d5fb6cdd9dde33f

SHA512
301ac93142dddc6149322c0b616f7400035ff2be91230f0944582c1542085c1bd815c60ac60cd77f412153cedb5f5a236288b884ee187e8da24d87e311d07616

Download Submit
C:\Windows\rss\csrss.exe

Filesize
768KB

MD5
c145e6c71cac2bd5a3e951cd6a2c11c3

SHA1
c9dea933f9702ac702fdceff08398e8746a9d811

SHA256
6d15e2b9484159bc40f5aa63d10b392cd9149084df9321d7acba33a5dc4eca31

SHA512
2d645d6ff8f67e3a8b7e975bb096fb54525ad222580670af04c116de27cdee3a3ffe07ff8feabecf027d9c0c28ec9b0cada4ac405db5b817066062a75e0305aa

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
a420431057abe6cb559e28b67ea3a36c

SHA1
68e75ad18abefc971860c22229e99fd3c7ec95f0

SHA256
f267ec2e4e66638d959fcdb45dda48888a80711d5c1415e60dd1465437a4ce36

SHA512
43f10e90736ffb9e1a4f55e7dd13e4fd1113047841eff94286750cbbf060879167885e2c84f58205dfb777d49393c3edad8c678516c63174e0dd8631e8a5d66a

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
897KB

MD5
1a3f2145f211bd8def2d0ea900115025

SHA1
1700a7dffd5ead4d575114dd9343170a15bdf6ae

SHA256
fa3c3ae1b83ed407e4b3ca060ab2f94c97ba738b4d20c0b7804bac55ed97b866

SHA512
fd35e9d8984ee22a05e1dc2136fd04c7052c9da19bb4a74e779fc2c766dba20f7d3b3ca95dad2c9acdf52ac6b681fc2b6abfdbbb9c9c742032ea2027dfde7e34

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe

Filesize
94KB

MD5
d98e78fd57db58a11f880b45bb659767

SHA1
ab70c0d3bd9103c07632eeecee9f51d198ed0e76

SHA256
414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0

SHA512
aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\patch.exe

Filesize
1.7MB

MD5
13aaafe14eb60d6a718230e82c671d57

SHA1
e039dd924d12f264521b8e689426fb7ca95a0a7b

SHA256
f44a7deb678ae7bbaaadf88e4c620d7cdf7e6831a1656c456545b1c06feb4ef3

SHA512
ade02218c0fd1ef9290c3113cf993dd89e87d4fb66fa1b34afdc73c84876123cd742d2a36d8daa95e2a573d2aa7e880f3c8ba0c5c91916ed15e7c4f6ff847de3

Download Submit
\Users\Admin\AppData\Local\Temp\dbghelp.dll

Filesize
1.5MB

MD5
f0616fa8bc54ece07e3107057f74e4db

SHA1
b33995c4f9a004b7d806c4bb36040ee844781fca

SHA256
6e58fcf4d763022b1f79a3c448eb2ebd8ad1c15df3acf58416893f1cbc699026

SHA512
15242e3f5652d7f1d0e31cebadfe2f238ca3222f0e927eb7feb644ab2b3d33132cf2316ee5089324f20f72f1650ad5bb8dd82b96518386ce5b319fb5ceb8313c

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
4.5MB

MD5
598c9466bfb1e5717f72097c1faaaa7b

SHA1
3f33a69d6335b76e819c110bad3ffa1e34478d76

SHA256
ce1b393844b288abb13208b9f31a08b103c4e76a3b644e86feb10e7401720fe6

SHA512
56d16a00a8f69ae5a34fa1347058eb67171767a07894be4a33530e77e011af395f9981696efabb2d253e42b8e2606ed50274d4b8527ed5154efca26f76ef811f

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
3.9MB

MD5
2c5f678551d604d19f34d74a8ba46d5e

SHA1
23eedc2f305a031eea3b28f45601dc44b269cb15

SHA256
7c1fe5215e6e44ea36431e6314eaf1a00bc4c0bf003354c785229a87ded15fd8

SHA512
a52fe90e180779b57007e693b3a68346773f94a4609fb0c8a5333aaf15db88c455d88dfaeade0134cafbd636e1dd3bf14f51681760e56c9a705d2fc14881bddf

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
4.0MB

MD5
6128be4d983b3212338015c86de79a0c

SHA1
16cea5a8d4b703d09c20449318d016e3ef3c5881

SHA256
0fceb2a3f448f3e0156d987d1b2fd6222a6a9bfdb5436916e377bc777fefba65

SHA512
c56f5edcfc38861a5cfaa86d2f73fbf610e2cbc48900d53b32ad85745af130758aaf405a607960af6b50e6160831bfeba03fc10f1793efe914cd59a48068d59d

Download Submit
\Users\Admin\AppData\Local\Temp\osloader.exe

Filesize
591KB

MD5
e2f68dc7fbd6e0bf031ca3809a739346

SHA1
9c35494898e65c8a62887f28e04c0359ab6f63f5

SHA256
b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

SHA512
26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

Download Submit
\Users\Admin\AppData\Local\Temp\symsrv.dll

Filesize
163KB

MD5
5c399d34d8dc01741269ff1f1aca7554

SHA1
e0ceed500d3cef5558f3f55d33ba9c3a709e8f55

SHA256
e11e0f7804bfc485b19103a940be3d382f31c1378caca0c63076e27797d7553f

SHA512
8ff9d38b22d73c595cc417427b59f5ca8e1fb7b47a2fa6aef25322bf6e614d6b71339a752d779bd736b4c1057239100ac8cc62629fd5d6556785a69bcdc3d73d

Download Submit
\Windows\rss\csrss.exe

Filesize
1.2MB

MD5
8f332cd35efa837ead5def7a554f4d76

SHA1
c07c24b14962746fb6281e2e03b439c9b9cad79f

SHA256
c8810ed9e5b79d0bf0e0a14b00c00318bbf642d90d3acdf093226ab8ac1188f9

SHA512
3cd170fba13e1d49fdc50fcdcc9849fd18fe88a90370f5658c1f1e2fe1aa7a13c79d91a5687dd3a399db9a6d3b1b2da27ff753fa4515301dc88bf14047bbf488

Download Submit
\Windows\rss\csrss.exe

Filesize
2.5MB

MD5
18ed75acaadc27443549f3fff9849ce3

SHA1
bb5befc93702efbccb38b40cb653d9a4cac27eb7

SHA256
c46764002166ce552690470cf72b85423de2961162d2ebfc914458e85e26d49c

SHA512
1d6c2407c0247a08d75991dece7480654946d439d3d3d670645833279b5be673ff3cf61d99667a05d34474e1f97af65471445c6bf46f7a662738dd39064222aa

Download Submit
memory/1040-157-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1040-153-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2176-26-0x0000000000460000-0x0000000000A48000-memory.dmp

Filesize
5.9MB

Download
memory/2176-42-0x0000000000510000-0x0000000000AF8000-memory.dmp

Filesize
5.9MB

Download
memory/2176-129-0x0000000000460000-0x0000000000A48000-memory.dmp

Filesize
5.9MB

Download
memory/2336-160-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-170-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-186-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-184-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-208-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-113-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-117-0x0000000004210000-0x0000000004608000-memory.dmp

Filesize
4.0MB

Download
memory/2336-118-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-206-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-204-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-182-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-202-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-200-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-149-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-198-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-19-0x0000000004210000-0x0000000004608000-memory.dmp

Filesize
4.0MB

Download
memory/2336-196-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-194-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-20-0x0000000004210000-0x0000000004608000-memory.dmp

Filesize
4.0MB

Download
memory/2336-158-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-192-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-22-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-162-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-180-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-164-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-166-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-168-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-190-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-188-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-172-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-174-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-176-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2336-178-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2444-9-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2444-18-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2444-7-0x0000000003F40000-0x0000000004338000-memory.dmp

Filesize
4.0MB

Download
memory/2444-8-0x0000000003F40000-0x0000000004338000-memory.dmp

Filesize
4.0MB

Download
memory/2492-163-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2492-169-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2492-159-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2492-156-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2856-1-0x00000000040E0000-0x00000000044D8000-memory.dmp

Filesize
4.0MB

Download
memory/2856-2-0x00000000044E0000-0x0000000004DCB000-memory.dmp

Filesize
8.9MB

Download
memory/2856-3-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2856-4-0x0000000000400000-0x00000000026BD000-memory.dmp

Filesize
34.7MB

Download
memory/2856-0-0x00000000040E0000-0x00000000044D8000-memory.dmp

Filesize
4.0MB

Download
memory/2856-5-0x00000000040E0000-0x00000000044D8000-memory.dmp

Filesize
4.0MB

Download
memory/2856-6-0x00000000044E0000-0x0000000004DCB000-memory.dmp

Filesize
8.9MB

Download