glupteba | f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b

Analysis

max time kernel
299s
max time network
304s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Size

4.1MB
MD5

49fcef0438d1ddbc6f53f2103c7b4a33
SHA1

f425055c22acf139dfd4c68a77f6eabf709eeaca
SHA256

f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b
SHA512

d99cc195c8378d5c493630f18c425fe4cc1983bedbd458e86e8e8200641c9e6673f2cfc1a880ed1373d54c7222d38e069f050e590ae06c826a8f4f8918ad4a8c
SSDEEP

98304:hK4sikCKwOcAgetL/sGWSUIwWMfGs/QNIJvvOO0g5iA92HBd:zsiRlTOFUIwWMfGJN8vOtg0A+

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 37 IoCs

resource	yara_rule
behavioral1/memory/1300-2-0x0000000003E30000-0x000000000471B000-memory.dmp	family_glupteba
behavioral1/memory/1300-3-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/1300-4-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/1300-6-0x0000000003E30000-0x000000000471B000-memory.dmp	family_glupteba
behavioral1/memory/2636-9-0x0000000003FF0000-0x00000000048DB000-memory.dmp	family_glupteba
behavioral1/memory/2636-10-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2636-19-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-62-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-110-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-155-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-156-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-157-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-161-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-162-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-163-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-164-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-165-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-166-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-196-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-197-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-206-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-208-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-210-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-212-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-214-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-216-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-218-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-220-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-222-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-224-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-226-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-228-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-230-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-232-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-234-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-236-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba
behavioral1/memory/2396-238-0x0000000000400000-0x00000000022EC000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe

Modifies boot configuration data using bcdedit 14 IoCs

pid	Process
2844	bcdedit.exe
1192	bcdedit.exe
1372	bcdedit.exe
1668	bcdedit.exe
2240	bcdedit.exe
1780	bcdedit.exe
2424	bcdedit.exe
2484	bcdedit.exe
1412	bcdedit.exe
1976	bcdedit.exe
1988	bcdedit.exe
1672	bcdedit.exe
784	bcdedit.exe
956	bcdedit.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\Winmon.sys	csrss.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2644	netsh.exe

Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
evasion

Impair Defenses
T1562

Command and Scripting Interpreter
T1059

Executes dropped EXE 6 IoCs

pid	Process
2396	csrss.exe
1840	patch.exe
1612	injector.exe
2748	dsefix.exe
2828	windefender.exe
1992	windefender.exe

Loads dropped DLL 13 IoCs

pid	Process
2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
864	Process not Found
1840	patch.exe
1840	patch.exe
1840	patch.exe
1840	patch.exe
1840	patch.exe
2396	csrss.exe
1840	patch.exe
1840	patch.exe
1840	patch.exe
2396	csrss.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000016d84-200.dat	upx
behavioral1/memory/2828-201-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/1992-204-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2828-205-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/1992-207-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/1992-211-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/1992-217-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMon driver. 1 IoCs

Roottkits write to WinMon to hide PIDs from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMon	csrss.exe

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
File created	C:\Windows\rss\csrss.exe	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
File created	C:\Windows\Logs\CBS\CbsPersist_20240306050246.cab	makecab.exe
File created	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1480	sc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2052	schtasks.exe
1032	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-301 = "Romance Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-292 = "Central European Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-472 = "Ekaterinburg Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-521 = "N. Central Asia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-352 = "FLE Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-622 = "Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-22 = "Cape Verde Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-552 = "North Asia Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-551 = "North Asia Daylight Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-491 = "India Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-571 = "China Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-471 = "Ekaterinburg Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-422 = "Russian Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-582 = "North Asia East Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time"	windefender.exe

Modifies system certificate store 2 TTPs 11 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 1400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a32000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 040000000100000010000000e4a68ac854ac5242460afd72481b2a440f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a41400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f392000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47409000000010000000c000000300a06082b060105050703011d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c00b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f00740000000f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	csrss.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 0f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a42000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\Blob = 19000000010000001000000014c3bd3549ee225aece13734ad8ca0b81400000001000000140000004e2254201895e6e36ee60ffafab912ed06178f39030000000100000014000000df3c24f9bfd666761b268073fe06d1cc8d4f82a40f00000001000000200000004b4eb4b074298b828b5c003095a10b4523fb951c0c88348b09c53e5baba408a3040000000100000010000000e4a68ac854ac5242460afd72481b2a442000000001000000920300003082038e30820276a0030201020210033af1e6a711a9a0bb2864b11d09fae5300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204732301e170d3133303830313132303030305a170d3338303131353132303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bb37cd34dc7b6bc9b26890ad4a75ff46ba210a088df51954c9fb88dbf3aef23a89913c7ae6ab061a6bcfac2de85e092444ba629a7ed6a3a87ee054752005ac50b79c631a6c30dcda1f19b1d71edefdd7e0cb948337aeec1f434edd7b2cd2bd2ea52fe4a9b8ad3ad499a4b625e99b6b00609260ff4f214918f76790ab61069c8ff2bae9b4e992326bb5f357e85d1bcd8c1dab95049549f3352d96e3496ddd77e3fb494bb4ac5507a98f95b3b423bb4c6d45f0f6a9b29530b4fd4c558c274a57147c829dcd7392d3164a060c8c50d18f1e09be17a1e621cafd83e510bc83a50ac46728f67314143d4676c387148921344daf0f450ca649a1babb9cc5b1338329850203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604144e2254201895e6e36ee60ffafab912ed06178f39300d06092a864886f70d01010b05000382010100606728946f0e4863eb31ddea6718d5897d3cc58b4a7fe9bedb2b17dfb05f73772a3213398167428423f2456735ec88bff88fb0610c34a4ae204c84c6dbf835e176d9dfa642bbc74408867f3674245ada6c0d145935bdf249ddb61fc9b30d472a3d992fbb5cbbb5d420e1995f534615db689bf0f330d53e31e28d849ee38adada963e3513a55ff0f970507047411157194ec08fae06c49513172f1b259f75f2b18e99a16f13b14171fe882ac84f102055d7f31445e5e044f4ea879532930efe5346fa2c9dff8b22b94bd90945a4dea4b89a58dd1b7d529f8e59438881a49e26d56faddd0dc6377ded03921be5775f76ee3c8dc45d565ba2d9666eb33537e532b6	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	patch.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1300	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe
1612	injector.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Token: SeImpersonatePrivilege	1300	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
Token: SeSystemEnvironmentPrivilege	2396	csrss.exe
Token: SeSecurityPrivilege	1480	sc.exe
Token: SeSecurityPrivilege	1480	sc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2500	2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe	33
PID 2636 wrote to memory of 2500	2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe	33
PID 2636 wrote to memory of 2500	2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe	33
PID 2636 wrote to memory of 2500	2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe	33
PID 2500 wrote to memory of 2644	2500	cmd.exe	35
PID 2500 wrote to memory of 2644	2500	cmd.exe	35
PID 2500 wrote to memory of 2644	2500	cmd.exe	35
PID 2636 wrote to memory of 2396	2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe	36
PID 2636 wrote to memory of 2396	2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe	36
PID 2636 wrote to memory of 2396	2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe	36
PID 2636 wrote to memory of 2396	2636	f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe	36
PID 2396 wrote to memory of 1612	2396	csrss.exe	45
PID 2396 wrote to memory of 1612	2396	csrss.exe	45
PID 2396 wrote to memory of 1612	2396	csrss.exe	45
PID 2396 wrote to memory of 1612	2396	csrss.exe	45
PID 1840 wrote to memory of 2844	1840	patch.exe	49
PID 1840 wrote to memory of 2844	1840	patch.exe	49
PID 1840 wrote to memory of 2844	1840	patch.exe	49
PID 1840 wrote to memory of 1192	1840	patch.exe	51
PID 1840 wrote to memory of 1192	1840	patch.exe	51
PID 1840 wrote to memory of 1192	1840	patch.exe	51
PID 1840 wrote to memory of 1372	1840	patch.exe	53
PID 1840 wrote to memory of 1372	1840	patch.exe	53
PID 1840 wrote to memory of 1372	1840	patch.exe	53
PID 1840 wrote to memory of 1668	1840	patch.exe	55
PID 1840 wrote to memory of 1668	1840	patch.exe	55
PID 1840 wrote to memory of 1668	1840	patch.exe	55
PID 1840 wrote to memory of 2240	1840	patch.exe	57
PID 1840 wrote to memory of 2240	1840	patch.exe	57
PID 1840 wrote to memory of 2240	1840	patch.exe	57
PID 1840 wrote to memory of 1780	1840	patch.exe	59
PID 1840 wrote to memory of 1780	1840	patch.exe	59
PID 1840 wrote to memory of 1780	1840	patch.exe	59
PID 1840 wrote to memory of 2424	1840	patch.exe	61
PID 1840 wrote to memory of 2424	1840	patch.exe	61
PID 1840 wrote to memory of 2424	1840	patch.exe	61
PID 1840 wrote to memory of 2484	1840	patch.exe	63
PID 1840 wrote to memory of 2484	1840	patch.exe	63
PID 1840 wrote to memory of 2484	1840	patch.exe	63
PID 1840 wrote to memory of 1412	1840	patch.exe	65
PID 1840 wrote to memory of 1412	1840	patch.exe	65
PID 1840 wrote to memory of 1412	1840	patch.exe	65
PID 1840 wrote to memory of 1976	1840	patch.exe	67
PID 1840 wrote to memory of 1976	1840	patch.exe	67
PID 1840 wrote to memory of 1976	1840	patch.exe	67
PID 1840 wrote to memory of 1988	1840	patch.exe	69
PID 1840 wrote to memory of 1988	1840	patch.exe	69
PID 1840 wrote to memory of 1988	1840	patch.exe	69
PID 1840 wrote to memory of 1672	1840	patch.exe	71
PID 1840 wrote to memory of 1672	1840	patch.exe	71
PID 1840 wrote to memory of 1672	1840	patch.exe	71
PID 1840 wrote to memory of 784	1840	patch.exe	73
PID 1840 wrote to memory of 784	1840	patch.exe	73
PID 1840 wrote to memory of 784	1840	patch.exe	73
PID 2396 wrote to memory of 956	2396	csrss.exe	75
PID 2396 wrote to memory of 956	2396	csrss.exe	75
PID 2396 wrote to memory of 956	2396	csrss.exe	75
PID 2396 wrote to memory of 956	2396	csrss.exe	75
PID 2396 wrote to memory of 2748	2396	csrss.exe	77
PID 2396 wrote to memory of 2748	2396	csrss.exe	77
PID 2396 wrote to memory of 2748	2396	csrss.exe	77
PID 2396 wrote to memory of 2748	2396	csrss.exe	77
PID 2828 wrote to memory of 2996	2828	windefender.exe	84
PID 2828 wrote to memory of 2996	2828	windefender.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
"C:\Users\Admin\AppData\Local\Temp\f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300
- C:\Users\Admin\AppData\Local\Temp\f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe
  "C:\Users\Admin\AppData\Local\Temp\f7b559aba81a1e570a4b589ceffbd83cb9914d38a8e943a4c0c7ae21f30ee60b.exe"
  2⤵
  - Windows security bypass
  - Loads dropped DLL
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Modifies data under HKEY_USERS
      PID:2644
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Manipulates WinMon driver.
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1032
  - - C:\Windows\system32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:2676
  - - C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
      "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies system certificate store
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2844
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1192
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1372
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1668
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2240
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1780
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2424
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2484
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 1
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1412
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1976
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1988
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -timeout 0
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1672
    - - C:\Windows\system32\bcdedit.exe
        
        C:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:784
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1612
  - - C:\Windows\system32\bcdedit.exe
      C:\Windows\Sysnative\bcdedit.exe /v
      4⤵
      Modifies boot configuration data using bcdedit
      PID:956
  - - C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe
      4⤵
      Executes dropped EXE
      PID:2748
  - - C:\Windows\system32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2052
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:2996
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:1480

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240306050246.log C:\Windows\Logs\CBS\CbsPersist_20240306050246.cab
1⤵
- Drops file in Windows directory
PID:2492

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFE3E.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AAF33CF37E194E98957768CF9C02DE8E2\download.error

Filesize
691KB

MD5
34df56859a55b11a14686a5cd86d32d3

SHA1
523c07ebc9731ee9527f42e3d2f4e136dda307c8

SHA256
e72e6fb7565ae35359e9a66a05f8d1663c68fbbd0e44fff929278e5a02fabac2

SHA512
b6a5c46caa92988ba85aff1e8feb511ddf9b7ca69276775e89f334ae1e099c5debfdeb7371eb4a89d1f3ddf2c4ec953fa2d81774956396960fe2552d1611801b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Symbols\winload_prod.pdb\768283CA443847FB8822F9DB1F36ECC51\download.error

Filesize
492KB

MD5
fafbf2197151d5ce947872a4b0bcbe16

SHA1
a86eaa2dd9fc6d36fcfb41df7ead8d1166aea020

SHA256
feb122b7916a1e62a7a6ae8d25ea48a2efc86f6e6384f5526e18ffbfc5f5ff71

SHA512
acbd49a111704d001a4ae44d1a071d566452f92311c5c0099d57548eddc9b3393224792c602022df5c3dd19b0a1fb4eff965bf038c8783ae109336699f9d13f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFB3.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe

Filesize
240KB

MD5
28d46bf26b325f055e868953367b3fa5

SHA1
9e7d7cb2457988b25758b2b548de6b1bc470ca54

SHA256
3cf67442ad28c5211301bfd723433195e3b01ed26617f5b79603298030d96941

SHA512
155c1561aa16f7bc3a167532ea2d79641b36954462c907a2553f1a3a6b3f1ee2fd850929b11ef0c6536956804a2bf016739728d339b1f2f71b567e61888fa92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
842KB

MD5
12283ca380004e051879d760eef1c057

SHA1
de7b008b4fa0b35db6ee5857dd06c3e6c98cc3e4

SHA256
c88f9ca3d50c2282f0c89505d49751b3d52d79a43d35c5be069186199c8cef4e

SHA512
df88b954f6d54a9b997f1b95db2c8ed4ee773e4452b0b29a6fb5a48b243282ffb25ca79d3bc2162ff9c0a80cf28254b7af695eaadb2f854719ea66991a1ca085

Download Submit
C:\Windows\rss\csrss.exe

Filesize
1.7MB

MD5
eb280e72f9830ebfa3d8e78592669645

SHA1
83d5c39edf8f53f793d0f3b58f6c6c0f20330c96

SHA256
1a6a7305434af3bc2f227f524d81ff55cc8aea5ac40ebe8676138b2960aca062

SHA512
2616106f617104dceb7383f7ede5faaac954291c2741936008e1f28824cac94bc71c3b87703c96dfaf3d816616b54107d9e61cae05daec582a2a5123d1a45fed

Download Submit
C:\Windows\rss\csrss.exe

Filesize
1.7MB

MD5
6a5242f43caa6f6e06ef443999e269aa

SHA1
3bd88918fbf37e0a3c5e7f09e6317cce92c88f67

SHA256
918e3878ba2287ec73365ebb933552fc457d7ede0cd1552971a3b4dd42e0c13b

SHA512
e8e73024c0f2c4631c1839db5d09ac929a17b26c3d26952af522c7d23daeaf6fa538e90a34e5ef277df7dc8bc92085d398175de9b42f4fe0ece8dc99cc8365bf

Download Submit
C:\Windows\rss\csrss.exe

Filesize
495KB

MD5
ec19b88ff844d35c66183aba6eaf3eb4

SHA1
137c7693de280e854fe9efb4248e3cc78f91133b

SHA256
e556f2803633384f9f428f4738e84d2d66ce0ea50bde3758d94efb7da4957edd

SHA512
6a0004dbfe2ec79a2350e21a14fdc8f05d79a4e8049d8a1376b3147889c2b1aea579872aebe743482d5ec2d0fa372daf0bfa488dd516c4196ce28ae3022d95db

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe

Filesize
94KB

MD5
d98e78fd57db58a11f880b45bb659767

SHA1
ab70c0d3bd9103c07632eeecee9f51d198ed0e76

SHA256
414035cc96d8bcc87ed173852a839ffbb45882a98c7a6f7b821e1668891deef0

SHA512
aafbd3eee102d0b682c4c854d69d50bac077e48f7f0dd8a5f913c6c73027aed7231d99fc9d716511759800da8c4f0f394b318821e9e47f6e62e436c8725a7831

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
\Users\Admin\AppData\Local\Temp\csrss\patch.exe

Filesize
387KB

MD5
d8aca3c6659e250af5cff6c4253667eb

SHA1
ece15644444f50513bcf076b356f1df65bf3bdc5

SHA256
cb6563f36f9529dfa310b5e7d1b609d2d430395732da05367bc143403b62c201

SHA512
5f5048b35fcbc0d789d8af47b8c566c7b1281c9209f4ccee6a858f60d6061142179ce57286bd1618728237d6b0d69b7537867f48021938b021c16f05d055f042

Download Submit
\Users\Admin\AppData\Local\Temp\dbghelp.dll

Filesize
64KB

MD5
f4513d72ac6e35f3f6135e60b621d82e

SHA1
e2301be4b01bcaf948cdbb1a168c1f27c1599ad0

SHA256
e5287adf61be70a49542a4901de83635af24371cc48b5be2637ec1d8f1ed1a3b

SHA512
6f8ed46116170284f787266f1e83a580f144749120a35f7ea0428a313f8ecf54bc6b2a50eb8caeacae24adcd74837ada15522086063773ef285e6ae92b6e3df0

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
766KB

MD5
9874043a2a55286c0fdfd33aeb071096

SHA1
53ed8b8e90534073c7d71df352522e3f610cdbcf

SHA256
dd06fd578e2a0c50766fff951c6cd5ce74500124beff5a0ce8f068dcb7ee121d

SHA512
a30ba4ba264cc65a2dc698f5a22ab75b98befecf4242732e216b32d26af6215945ffb393894815c704b20ba882958332ebe911fa7c97e720f00a3d31f374bae7

Download Submit
\Users\Admin\AppData\Local\Temp\ntkrnlmp.exe

Filesize
726KB

MD5
07f39f5249f5d2e7b68a5f1f4760d40a

SHA1
fb81d576dd7c23c201555874b11c729cd62f2cc2

SHA256
5b9c1c774df02d343260550be3545992ed48d158c16875237693df7b93c6d8fb

SHA512
070d4251ad540260011e0210d7b3bcf8bcf1c446e78775ccccd89b022d5c34f38c1c68b0e67a068aef9298fa3402b653ea986e564b81c25c8f1ff4f0c7361919

Download Submit
\Users\Admin\AppData\Local\Temp\osloader.exe

Filesize
591KB

MD5
e2f68dc7fbd6e0bf031ca3809a739346

SHA1
9c35494898e65c8a62887f28e04c0359ab6f63f5

SHA256
b74cd24cef07f0226e7b777f7862943faee4cf288178b423d5344b0769dc15d4

SHA512
26256a12b5b8b3a40b34f18e081cdb45ea11845589c9d458a79385a4b8178f32164b417ddc9346fab8299bc6d4b9fedb620274c4edf9321424f37a2e2a6de579

Download Submit
\Users\Admin\AppData\Local\Temp\symsrv.dll

Filesize
145KB

MD5
5f856ac72f863e0b6619aee33de0dc27

SHA1
3405dc6e9841c817de4d0b74bdb7118ec49c7a84

SHA256
992b05c19b7c563576ca25a5300e5cc64f6934550292c4934f4c02f3cc87f3b2

SHA512
a17dc27b354cfd20ccc9500f26a55d55474fc01d91f402c71db5dcf3be9f3647a18b61234e32d1fab492cb993ad6827aa5db59b38b01d03d0ffa64ba20cdb6e0

Download Submit
\Windows\rss\csrss.exe

Filesize
1.5MB

MD5
f2c9d153938838fd0fde784509542456

SHA1
d1734b4b6e7373291cf8228caf2a302213317b83

SHA256
053c962e63a920a6e3918f28177bf77a7c0140d23538bdf8e4e9a3c819a58202

SHA512
6483a845dbbad3f6b118a3417fc7a2f3c21e5daaa9ba9c2162d9175da30863cbd5d8ec450c9bfbb6d753385d8afb35f6748717b42c7738bb8bfe784d07c58951

Download Submit
\Windows\rss\csrss.exe

Filesize
512KB

MD5
6dc4de1ca845684d62738029577941af

SHA1
789248fee78f81a8371536e6158341917702648e

SHA256
5dfdf21aa166d958695eedddf69f497e6ce6cfb38da8dee7eb3349eaad56ff54

SHA512
45633a933624b24ddaa260f26d33050f0e6aaeef70758758513df08a2c6be5edd40343e0f0800a9ecdcd51b17e789941690473bb8cd6d9218066790aa774f5fc

Download Submit
memory/1300-1-0x0000000003A30000-0x0000000003E28000-memory.dmp

Filesize
4.0MB

Download
memory/1300-0-0x0000000003A30000-0x0000000003E28000-memory.dmp

Filesize
4.0MB

Download
memory/1300-2-0x0000000003E30000-0x000000000471B000-memory.dmp

Filesize
8.9MB

Download
memory/1300-3-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/1300-4-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/1300-6-0x0000000003E30000-0x000000000471B000-memory.dmp

Filesize
8.9MB

Download
memory/1300-5-0x0000000003A30000-0x0000000003E28000-memory.dmp

Filesize
4.0MB

Download
memory/1840-83-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1840-69-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/1992-217-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1992-211-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1992-207-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/1992-204-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2396-155-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-197-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-156-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-157-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-161-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-162-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-163-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-164-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-165-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-166-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-62-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-61-0x0000000003CF0000-0x00000000040E8000-memory.dmp

Filesize
4.0MB

Download
memory/2396-22-0x0000000003CF0000-0x00000000040E8000-memory.dmp

Filesize
4.0MB

Download
memory/2396-238-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-196-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-224-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-236-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-234-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-232-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-230-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-206-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-228-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-208-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-210-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-226-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-212-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-214-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-216-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-110-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-218-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-220-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2396-222-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2636-7-0x0000000003BF0000-0x0000000003FE8000-memory.dmp

Filesize
4.0MB

Download
memory/2636-8-0x0000000003BF0000-0x0000000003FE8000-memory.dmp

Filesize
4.0MB

Download
memory/2636-9-0x0000000003FF0000-0x00000000048DB000-memory.dmp

Filesize
8.9MB

Download
memory/2636-10-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2636-19-0x0000000000400000-0x00000000022EC000-memory.dmp

Filesize
30.9MB

Download
memory/2636-20-0x0000000003BF0000-0x0000000003FE8000-memory.dmp

Filesize
4.0MB

Download
memory/2828-205-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2828-201-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download