Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02/03/2024, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20240221-en
General
-
Target
tmp.exe
-
Size
4.1MB
-
MD5
888a1c86f1f4db39987a66613ea87104
-
SHA1
82e70e1434c19c9cf84be6ed963009c13a7cd2f7
-
SHA256
6110c7a02fe334fd3cfda9a7be565b4bd3ce59661fba7b744fec1c5a8d46a229
-
SHA512
fb083f8ba9924cf739f0f020e1989b777f5b083bbdcff45255628bf798b7269231dcb06b9266cfd2d469f81b9d880730882146cf5c663c15f0b67cabb13c9b33
-
SSDEEP
98304:dwYpq65PX7G0lKZQA6S/odjsKFGzL17vqhAWe1eQ3l:FpH7GDt6t5E17vTWeYG
Malware Config
Signatures
-
Glupteba payload 22 IoCs
resource yara_rule behavioral2/memory/4376-2-0x0000000004590000-0x0000000004E7B000-memory.dmp family_glupteba behavioral2/memory/4376-3-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/4376-54-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/4376-55-0x0000000004590000-0x0000000004E7B000-memory.dmp family_glupteba behavioral2/memory/3848-58-0x0000000004560000-0x0000000004E4B000-memory.dmp family_glupteba behavioral2/memory/3848-59-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/3848-105-0x0000000004150000-0x0000000004553000-memory.dmp family_glupteba behavioral2/memory/3848-125-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/3848-137-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/3848-157-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-259-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-268-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-269-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-271-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-273-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-276-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-278-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-279-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-281-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-283-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-285-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba behavioral2/memory/2736-288-0x0000000000400000-0x00000000022E9000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1892 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 2736 csrss.exe 4660 injector.exe 3172 windefender.exe 4276 windefender.exe -
resource yara_rule behavioral2/files/0x000b00000002304c-262.dat upx behavioral2/memory/3172-267-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4276-270-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4276-274-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" tmp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN tmp.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss tmp.exe File created C:\Windows\rss\csrss.exe tmp.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2568 sc.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 928 4376 WerFault.exe 88 3216 3848 WerFault.exe 99 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1056 schtasks.exe 2764 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-162 = "Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" tmp.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" tmp.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" tmp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3392 powershell.exe 3392 powershell.exe 4376 tmp.exe 4376 tmp.exe 1364 powershell.exe 1364 powershell.exe 3848 tmp.exe 3848 tmp.exe 3848 tmp.exe 3848 tmp.exe 3848 tmp.exe 3848 tmp.exe 3848 tmp.exe 3848 tmp.exe 3848 tmp.exe 3848 tmp.exe 216 powershell.exe 216 powershell.exe 3380 powershell.exe 3380 powershell.exe 3888 powershell.exe 3888 powershell.exe 2732 powershell.exe 2732 powershell.exe 912 powershell.exe 912 powershell.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 2736 csrss.exe 2736 csrss.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 2736 csrss.exe 2736 csrss.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 2736 csrss.exe 2736 csrss.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe 4660 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3392 powershell.exe Token: SeDebugPrivilege 4376 tmp.exe Token: SeImpersonatePrivilege 4376 tmp.exe Token: SeDebugPrivilege 1364 powershell.exe Token: SeDebugPrivilege 216 powershell.exe Token: SeDebugPrivilege 3380 powershell.exe Token: SeDebugPrivilege 3888 powershell.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeDebugPrivilege 912 powershell.exe Token: SeSystemEnvironmentPrivilege 2736 csrss.exe Token: SeSecurityPrivilege 2568 sc.exe Token: SeSecurityPrivilege 2568 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4376 wrote to memory of 3392 4376 tmp.exe 95 PID 4376 wrote to memory of 3392 4376 tmp.exe 95 PID 4376 wrote to memory of 3392 4376 tmp.exe 95 PID 3848 wrote to memory of 1364 3848 tmp.exe 102 PID 3848 wrote to memory of 1364 3848 tmp.exe 102 PID 3848 wrote to memory of 1364 3848 tmp.exe 102 PID 3848 wrote to memory of 2116 3848 tmp.exe 104 PID 3848 wrote to memory of 2116 3848 tmp.exe 104 PID 2116 wrote to memory of 1892 2116 cmd.exe 106 PID 2116 wrote to memory of 1892 2116 cmd.exe 106 PID 3848 wrote to memory of 216 3848 tmp.exe 107 PID 3848 wrote to memory of 216 3848 tmp.exe 107 PID 3848 wrote to memory of 216 3848 tmp.exe 107 PID 3848 wrote to memory of 3380 3848 tmp.exe 109 PID 3848 wrote to memory of 3380 3848 tmp.exe 109 PID 3848 wrote to memory of 3380 3848 tmp.exe 109 PID 3848 wrote to memory of 2736 3848 tmp.exe 111 PID 3848 wrote to memory of 2736 3848 tmp.exe 111 PID 3848 wrote to memory of 2736 3848 tmp.exe 111 PID 2736 wrote to memory of 3888 2736 csrss.exe 114 PID 2736 wrote to memory of 3888 2736 csrss.exe 114 PID 2736 wrote to memory of 3888 2736 csrss.exe 114 PID 2736 wrote to memory of 2732 2736 csrss.exe 120 PID 2736 wrote to memory of 2732 2736 csrss.exe 120 PID 2736 wrote to memory of 2732 2736 csrss.exe 120 PID 2736 wrote to memory of 912 2736 csrss.exe 122 PID 2736 wrote to memory of 912 2736 csrss.exe 122 PID 2736 wrote to memory of 912 2736 csrss.exe 122 PID 2736 wrote to memory of 4660 2736 csrss.exe 125 PID 2736 wrote to memory of 4660 2736 csrss.exe 125 PID 3172 wrote to memory of 4892 3172 windefender.exe 132 PID 3172 wrote to memory of 4892 3172 windefender.exe 132 PID 3172 wrote to memory of 4892 3172 windefender.exe 132 PID 4892 wrote to memory of 2568 4892 cmd.exe 133 PID 4892 wrote to memory of 2568 4892 cmd.exe 133 PID 4892 wrote to memory of 2568 4892 cmd.exe 133 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1892
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:216
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1056
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:8
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:912
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4660
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2764
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3848 -s 7963⤵
- Program crash
PID:3216
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4376 -s 6242⤵
- Program crash
PID:928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4376 -ip 43761⤵PID:4276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3848 -ip 38481⤵PID:1880
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4276
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ffe642c6149f28599b5d9a8edd3748b1
SHA1301fc9ecc6f2bac93f355f424d6496eb121fac21
SHA2563da23861bb9b21be7505953cacd70f3fb5f299a0c12daed90c224f6d34227612
SHA5123a45e1f695d5dd7785fbb8747362551298cf8f12e0cff3bc294766cdb5d9d5050362be60c5b787923f9ebe6ac5d3bdad897da729d6b154468dc6ec78c79c9acf
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD542e25c84781198f941e2bc620c95697f
SHA17e97dcfd0bf298e3a2b03438732d6d54f7220b54
SHA256198566510cf34825bc848c997a77062f8fe464da3bca122f82dcb680cf61271b
SHA51254bef5a00bc0d255de3d4360c2492590e340172957d9b479d08376b665c065b7905fdf3a123193cbb9b1bf56aae3c138503cfa0d1ba42a85249778510cb00dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5965b874f8cdb2e8a460cb5105661e853
SHA123a3205fa658c9b3bb4d79a4535848127ea6c02f
SHA256258630d5080070e3bbb8475fa87b1e4fd183726722f9ed74840dd8fc4859259b
SHA5126eb1eb461897fb3d2466881e8d248fd2100d263d6670cdfa2133e9c5fab806a54a6d39d2f3e087a78af55abfb4decb4fa5fdec8d60632dd179b241ee69bc9b28
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e48fbc56997a6e947ad26b3181faf32d
SHA18a4dc8e629c5c1bc062d2ee1ea42a8166636bfc6
SHA25694e34b390eb1549c5eaa24755325b02a28d610c7faa35463b882245df1cd8960
SHA51224627aee5ff55c1d140d14d390cb4498fa4c69054270f91acc1ffd213bb1ed7f58c611deae5fffa7c7f5b7b288f7d36cefd6842cc1724f86212f311248a23f98
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD54e39770da142c00317ddbc17bbf49165
SHA1cbfeba6e4e2f1a97710af4e082691a6e12420d1e
SHA25677d3b3ebd6cda0866a71951d14113165a6738435f042d2baa13e46df6888d725
SHA5122af451e378cfbb150b3643f6dab2049ab8a553ef9d8795b95e251bbc160d0df18faf6b74245e06b2aa68cd0e9ebc5d6ff89af825cdd7c44b0af123bc46fbf28e
-
Filesize
1.3MB
MD508bf562937de2754855739d4dc9799e1
SHA10ceaaec3a5fee3a15be65e3dc21e2c14dbaede69
SHA256fa4d8b76aa2fb591efa31563507b850f29047698788ff16ef178a19a7478d254
SHA512923e82f5e7505b7d9562021b752c79b46bbbcc163590183ee35b8d74e4e9c8469b500d4391e2a5d79561781937d773136bf2a0ab86711556317cf754425a066b
-
Filesize
1.4MB
MD5336cf38e724d68322089645fc9526ae2
SHA1c1caaa51bd63bb1f29c91a5a4a120f676758d0fe
SHA256907b5ec75a2dbad1a2a22d279b29b26fa3b2e866b5253ab382a2e501120f5773
SHA512d440e6adbd248a3a922138fcc41b9a0894f9d0f8de108d10f6f3781971d29ad3980542ec90d4ab4b17ca12d89bc32b319922faedfd98b8455edf8e279650f946
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec