Malware Analysis Report

2025-03-14 22:52

Sample ID 240406-1fhrqacd27
Target 7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e
SHA256 7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e

Threat Level: Known bad

The file 7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Checks installed software on the system

Manipulates WinMonFS driver.

Adds Run key to start application

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Drops file in Windows directory

Program crash

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-06 21:35

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-06 21:35

Reported

2024-04-06 21:38

Platform

win10v2004-20240319-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-571 = "China Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3424 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 3152 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\system32\cmd.exe
PID 2256 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\system32\cmd.exe
PID 2448 wrote to memory of 4908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2448 wrote to memory of 4908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2256 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 336 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\rss\csrss.exe
PID 2256 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\rss\csrss.exe
PID 2256 wrote to memory of 4372 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\rss\csrss.exe
PID 4372 wrote to memory of 1400 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4372 wrote to memory of 1400 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4372 wrote to memory of 1400 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4372 wrote to memory of 1364 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4372 wrote to memory of 1364 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4372 wrote to memory of 1364 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4372 wrote to memory of 1884 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4372 wrote to memory of 1884 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4372 wrote to memory of 1884 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4372 wrote to memory of 2024 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4372 wrote to memory of 2024 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1400 wrote to memory of 3372 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1400 wrote to memory of 3372 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1400 wrote to memory of 3372 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3372 wrote to memory of 4368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3372 wrote to memory of 4368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3372 wrote to memory of 4368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe

"C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe

"C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4196 --field-trial-handle=2232,i,10468259530860544675,2192522633371581869,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2256 -ip 2256

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2256 -s 604

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 fa09c27f-604f-4f4c-bb28-6ff4a5e528eb.uuid.realupdate.ru udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 stun4.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server6.realupdate.ru udp
US 162.159.133.233:443 cdn.discordapp.com tcp
JP 74.125.27.12:19302 stun4.l.google.com udp
BG 185.82.216.96:443 server6.realupdate.ru tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 12.27.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.96:443 server6.realupdate.ru tcp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

memory/3424-1-0x0000000004D10000-0x000000000510A000-memory.dmp

memory/3424-2-0x0000000005110000-0x00000000059FB000-memory.dmp

memory/3424-3-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/3152-4-0x0000000005290000-0x00000000052C6000-memory.dmp

memory/3152-5-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/3152-6-0x00000000052E0000-0x00000000052F0000-memory.dmp

memory/3152-7-0x00000000052E0000-0x00000000052F0000-memory.dmp

memory/3152-8-0x0000000005920000-0x0000000005F48000-memory.dmp

memory/3152-9-0x0000000005890000-0x00000000058B2000-memory.dmp

memory/3152-10-0x00000000060C0000-0x0000000006126000-memory.dmp

memory/3152-11-0x0000000006130000-0x0000000006196000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qreizm3g.al1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3152-21-0x00000000062A0000-0x00000000065F4000-memory.dmp

memory/3152-22-0x0000000006910000-0x000000000692E000-memory.dmp

memory/3152-23-0x00000000069B0000-0x00000000069FC000-memory.dmp

memory/3152-24-0x0000000006E30000-0x0000000006E74000-memory.dmp

memory/3152-25-0x00000000052E0000-0x00000000052F0000-memory.dmp

memory/3152-26-0x0000000007BD0000-0x0000000007C46000-memory.dmp

memory/3152-27-0x00000000082D0000-0x000000000894A000-memory.dmp

memory/3152-28-0x0000000007C50000-0x0000000007C6A000-memory.dmp

memory/3152-30-0x0000000007E20000-0x0000000007E52000-memory.dmp

memory/3152-31-0x00000000706E0000-0x000000007072C000-memory.dmp

memory/3152-32-0x0000000070880000-0x0000000070BD4000-memory.dmp

memory/3152-43-0x0000000007E60000-0x0000000007F03000-memory.dmp

memory/3152-42-0x0000000007E00000-0x0000000007E1E000-memory.dmp

memory/3424-29-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/3152-45-0x0000000007F40000-0x0000000007F4A000-memory.dmp

memory/3152-44-0x000000007F590000-0x000000007F5A0000-memory.dmp

memory/3152-46-0x0000000008000000-0x0000000008096000-memory.dmp

memory/3152-47-0x0000000007F60000-0x0000000007F71000-memory.dmp

memory/3152-48-0x0000000007FA0000-0x0000000007FAE000-memory.dmp

memory/3152-49-0x0000000007FB0000-0x0000000007FC4000-memory.dmp

memory/3152-50-0x00000000080A0000-0x00000000080BA000-memory.dmp

memory/3152-51-0x0000000007FE0000-0x0000000007FE8000-memory.dmp

memory/3152-54-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/3424-55-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/3424-57-0x0000000005110000-0x00000000059FB000-memory.dmp

memory/2256-58-0x0000000004D20000-0x0000000005128000-memory.dmp

memory/2256-59-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/2732-60-0x00000000748E0000-0x0000000075090000-memory.dmp

memory/2732-61-0x00000000008F0000-0x0000000000900000-memory.dmp

memory/2732-62-0x0000000005460000-0x00000000057B4000-memory.dmp

memory/2732-72-0x0000000005FE0000-0x000000000602C000-memory.dmp

memory/2732-73-0x00000000008F0000-0x0000000000900000-memory.dmp

memory/2732-74-0x00000000707E0000-0x000000007082C000-memory.dmp

memory/2732-75-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/2732-85-0x0000000006C70000-0x0000000006D13000-memory.dmp

memory/2732-86-0x0000000006F80000-0x0000000006F91000-memory.dmp

memory/2732-87-0x0000000006FD0000-0x0000000006FE4000-memory.dmp

memory/2732-90-0x00000000748E0000-0x0000000075090000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/2248-92-0x00000000748E0000-0x0000000075090000-memory.dmp

memory/2248-93-0x00000000051E0000-0x00000000051F0000-memory.dmp

memory/2256-94-0x0000000004D20000-0x0000000005128000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 12c5720c3c8700b13399ab9e0d957457
SHA1 21da4cace0eb0e3b8d8fee3c983eb94d298447dd
SHA256 3e05f580fb927c42bf499e11f1d425a74a01f4c26857054ed0efb9af3f0f66f4
SHA512 6fa39e2b606ff608179b3dddcead4e6d0d89f82c7fe15fa31bf2a4919e15e2f642480e2894c25b4e8de9806b96f71af445ba10778d3318b237e9a2b103bef9c3

memory/2256-105-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/2248-106-0x00000000051E0000-0x00000000051F0000-memory.dmp

memory/2248-107-0x00000000707E0000-0x000000007082C000-memory.dmp

memory/2248-108-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/2248-119-0x000000007FB30000-0x000000007FB40000-memory.dmp

memory/2256-118-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/2248-121-0x00000000748E0000-0x0000000075090000-memory.dmp

memory/336-122-0x00000000748E0000-0x0000000075090000-memory.dmp

memory/336-123-0x0000000002800000-0x0000000002810000-memory.dmp

memory/336-124-0x0000000002800000-0x0000000002810000-memory.dmp

memory/336-134-0x0000000005820000-0x0000000005B74000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 57297ed05e8fa9a9f2d0d2781558e429
SHA1 0bbb50f332b2166f13982da4ac79671f8130e8d1
SHA256 9fc172431df942d45ff74da58f076dd2809df7b124c6e3895f5e1acb18f57793
SHA512 3c09101316dc6468b105b41b9aea7407601500175c26f2cff3a1a7beb0be552e17cb8d2608c55ee0fec2e6012848a8f4a49f448c4f64ab4d6967dfe7f508f090

memory/336-136-0x0000000002800000-0x0000000002810000-memory.dmp

memory/336-137-0x00000000707E0000-0x000000007082C000-memory.dmp

memory/336-138-0x0000000070960000-0x0000000070CB4000-memory.dmp

memory/2256-148-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/336-150-0x00000000748E0000-0x0000000075090000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 db4d85ae51687b913b4b0200c65c8859
SHA1 529ac2b2159c29a2512f9adfcee356f9f726e62e
SHA256 7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e
SHA512 131aca16fef48aab8103bbf07aa354076d8cbe57e82e5c8a65279e296d083ca508cd7328f91fd1f5e95728fc5b4419d246fbd96bce4a0ad9786d976ce2261cbd

memory/2256-155-0x0000000000400000-0x0000000002F4A000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 751061b9ee175097512eb94f64f729ae
SHA1 b68f9d07e209f8a438fc06f8c76a4a418bdcf718
SHA256 523d9f96e60cc2f5a20961059e41815a8b4d9042fd394e5b5b5681c53e70f4cd
SHA512 ed53b2291a7603c07584c19db333e3cb3730f4abc5f2de4729c9ddb99c77b275d571b545897a16d27610ab1e157ca38311d7e8739921672f0071110f27d4c8e9

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2d8ffe412c8922e0cb3b9c875e14b574
SHA1 49a94cdfc59300c36f8443d19b2ac905efcac779
SHA256 37853f4b72afadc520a02c537790d246ba05f4c6c799c6c883a6b5a95c2b534b
SHA512 3abbceb42a73980e372b27eb8495c372ad8058fe1579e86b03983927560e46be20a8556c77b92f2bdf9aa8ec436b27971aff5e659c67fcd4d10d907694a022bd

memory/4372-224-0x0000000000400000-0x0000000002F4A000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e55c9f2102d826f30a002fcf2bfa964e
SHA1 aa41fabe3a0e8944dedd9b9a81fb971f54113342
SHA256 bca7643d77e119b271d6b43c566efbc56fcfb373664eb0b3a7e972872b0718c9
SHA512 2ce4f7756845e3b5217316f4d6d8d64fcb5dceaa0b431106a37f2ff3b2a977bf37780aef91e10200962c95169f771d8545a0e054bff978bf206eaf8d8983f7fe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4372-256-0x0000000000400000-0x0000000002F4A000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1400-263-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4372-264-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/4612-265-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4372-266-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/4372-268-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/4612-269-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4372-270-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/4372-272-0x0000000000400000-0x0000000002F4A000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-06 21:35

Reported

2024-04-06 21:38

Platform

win11-20240221-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-647252928-2816094679-1307623958-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-385 = "Namibia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1068 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1068 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1068 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4412 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4412 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4412 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4412 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\system32\cmd.exe
PID 4412 wrote to memory of 636 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\system32\cmd.exe
PID 636 wrote to memory of 1936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 636 wrote to memory of 1936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4412 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4412 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4412 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4412 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4412 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4412 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4412 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\rss\csrss.exe
PID 4412 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\rss\csrss.exe
PID 4412 wrote to memory of 2164 N/A C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe C:\Windows\rss\csrss.exe
PID 2164 wrote to memory of 1912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2164 wrote to memory of 1912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2164 wrote to memory of 1912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2164 wrote to memory of 1556 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2164 wrote to memory of 1556 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2164 wrote to memory of 1556 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2164 wrote to memory of 4248 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2164 wrote to memory of 4248 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2164 wrote to memory of 4248 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2164 wrote to memory of 1428 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2164 wrote to memory of 1428 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2644 wrote to memory of 4300 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 4300 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2644 wrote to memory of 4300 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4300 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4300 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4300 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe

"C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe

"C:\Users\Admin\AppData\Local\Temp\7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1068 -ip 1068

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1068 -s 988

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun.l.google.com udp
BG 185.82.216.96:443 server8.realupdate.ru tcp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 172.67.221.71:443 carsalessystem.com tcp

Files

memory/1068-1-0x0000000004E70000-0x0000000005272000-memory.dmp

memory/1068-2-0x0000000005280000-0x0000000005B6B000-memory.dmp

memory/1068-3-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/2360-4-0x0000000005470000-0x00000000054A6000-memory.dmp

memory/2360-5-0x00000000745C0000-0x0000000074D71000-memory.dmp

memory/2360-6-0x0000000005620000-0x0000000005630000-memory.dmp

memory/2360-7-0x0000000005620000-0x0000000005630000-memory.dmp

memory/2360-8-0x0000000005C60000-0x000000000628A000-memory.dmp

memory/2360-9-0x0000000005A50000-0x0000000005A72000-memory.dmp

memory/2360-10-0x0000000005B00000-0x0000000005B66000-memory.dmp

memory/2360-11-0x0000000005BE0000-0x0000000005C46000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tj41rkgr.tp5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2360-20-0x0000000006410000-0x0000000006767000-memory.dmp

memory/2360-21-0x0000000006930000-0x000000000694E000-memory.dmp

memory/2360-22-0x0000000006980000-0x00000000069CC000-memory.dmp

memory/2360-23-0x0000000006EA0000-0x0000000006EE6000-memory.dmp

memory/2360-24-0x0000000005620000-0x0000000005630000-memory.dmp

memory/2360-26-0x0000000007D40000-0x0000000007D74000-memory.dmp

memory/2360-27-0x0000000070830000-0x000000007087C000-memory.dmp

memory/2360-28-0x00000000709B0000-0x0000000070D07000-memory.dmp

memory/2360-37-0x0000000007D80000-0x0000000007D9E000-memory.dmp

memory/1068-25-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/2360-38-0x000000007FDA0000-0x000000007FDB0000-memory.dmp

memory/2360-39-0x0000000007DA0000-0x0000000007E44000-memory.dmp

memory/2360-40-0x0000000008510000-0x0000000008B8A000-memory.dmp

memory/2360-41-0x0000000006C90000-0x0000000006CAA000-memory.dmp

memory/2360-42-0x0000000007F30000-0x0000000007F3A000-memory.dmp

memory/2360-43-0x0000000008040000-0x00000000080D6000-memory.dmp

memory/2360-44-0x0000000007F50000-0x0000000007F61000-memory.dmp

memory/1068-45-0x0000000004E70000-0x0000000005272000-memory.dmp

memory/2360-46-0x0000000007FA0000-0x0000000007FAE000-memory.dmp

memory/2360-47-0x0000000007FB0000-0x0000000007FC5000-memory.dmp

memory/2360-48-0x0000000008000000-0x000000000801A000-memory.dmp

memory/2360-49-0x0000000007EF0000-0x0000000007EF8000-memory.dmp

memory/2360-52-0x00000000745C0000-0x0000000074D71000-memory.dmp

memory/1068-53-0x0000000005280000-0x0000000005B6B000-memory.dmp

memory/1068-54-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/4412-56-0x0000000004E10000-0x000000000520A000-memory.dmp

memory/4412-57-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/2120-58-0x0000000074660000-0x0000000074E11000-memory.dmp

memory/2120-60-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

memory/2120-59-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

memory/2120-61-0x0000000005BB0000-0x0000000005F07000-memory.dmp

memory/2120-70-0x0000000006180000-0x00000000061CC000-memory.dmp

memory/2120-71-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

memory/2120-72-0x0000000070940000-0x000000007098C000-memory.dmp

memory/2120-73-0x000000007F1C0000-0x000000007F1D0000-memory.dmp

memory/2120-74-0x0000000070B90000-0x0000000070EE7000-memory.dmp

memory/2120-83-0x0000000007320000-0x00000000073C4000-memory.dmp

memory/2120-84-0x0000000007650000-0x0000000007661000-memory.dmp

memory/2120-85-0x00000000076A0000-0x00000000076B5000-memory.dmp

memory/2120-88-0x0000000074660000-0x0000000074E11000-memory.dmp

memory/4412-89-0x0000000000400000-0x0000000002F4A000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/3008-91-0x0000000074660000-0x0000000074E11000-memory.dmp

memory/4412-100-0x0000000000400000-0x0000000002F4A000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d1d33f4b68ea52336f749c054991872b
SHA1 3b9d994970a1578232a88f450a706f3e9a4c9bf8
SHA256 056b70b679be658de27e7ba0f6438953bf854c57921e5cb5f5b2681effbeadaa
SHA512 39128e318c14398f395439f23773041ae100ae62715b9068247d7acf07225dad12a69791ec4692718906066af1ebf69f7dad8ac5f606b2b36a461f05c4bd8493

memory/4412-102-0x0000000004E10000-0x000000000520A000-memory.dmp

memory/3008-104-0x0000000002AF0000-0x0000000002B00000-memory.dmp

memory/3008-103-0x0000000002AF0000-0x0000000002B00000-memory.dmp

memory/3008-105-0x0000000002AF0000-0x0000000002B00000-memory.dmp

memory/3008-107-0x000000007EFB0000-0x000000007EFC0000-memory.dmp

memory/3008-106-0x0000000070940000-0x000000007098C000-memory.dmp

memory/3008-108-0x0000000070B90000-0x0000000070EE7000-memory.dmp

memory/4412-117-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/3008-119-0x0000000074660000-0x0000000074E11000-memory.dmp

memory/3272-120-0x0000000074660000-0x0000000074E11000-memory.dmp

memory/3272-122-0x0000000004D90000-0x0000000004DA0000-memory.dmp

memory/3272-121-0x0000000004D90000-0x0000000004DA0000-memory.dmp

memory/3272-131-0x0000000005B70000-0x0000000005EC7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7f938c6d37db4ef13bdf367626c17cf9
SHA1 6c5c701fda0167a76dc31c736b331465f337332b
SHA256 ccd9df99d4b23769bdd147ebc44edcfd898d16c3f2a7338340dbafad3672f2d7
SHA512 42ff203f6a343e06f55569909f114e18f41f07000c2774384e04cfc46fe9f0938f7cd5a0e8e8862d245ef172818f50e10dcbfcf11b1e935399485ce5669ece1b

memory/3272-133-0x0000000004D90000-0x0000000004DA0000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 db4d85ae51687b913b4b0200c65c8859
SHA1 529ac2b2159c29a2512f9adfcee356f9f726e62e
SHA256 7a61f2f78f9900ab386cac6d6188603b8a05d1917cb26d74ba82c61ef06b157e
SHA512 131aca16fef48aab8103bbf07aa354076d8cbe57e82e5c8a65279e296d083ca508cd7328f91fd1f5e95728fc5b4419d246fbd96bce4a0ad9786d976ce2261cbd

memory/4412-150-0x0000000000400000-0x0000000002F4A000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c5a5fa5ff223c596272b38209da23543
SHA1 7ffa1719073a9e2c1ef0627d5af7b014b34e4096
SHA256 cf041810fcd557f7b4eb271ebbb0b88a5792ad76874966b471838bb40433f271
SHA512 4126c035934239c2d806d8e161f0998882dabeb992105c3bdaaa363509ca391606d65bac643c43ad0b76b8b52bfd797e88d8a9cb6ba39342fe259cef2d96dc9a

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a1c65076e4352b1c8351ac06801305f5
SHA1 ce71b1468b65dfdd15173e808a574ab96b679ac3
SHA256 11021934445913b978423bed3a48ccc59d54064fe21003bfbef506083bd5accb
SHA512 4411730623c8732fae62c7970e3e87c20b051bfdd20a00249d926660d7b8b982088e273a0634895b43cda2cbfae890d8889c95bacc6e48ec026cc02826682d0a

memory/2164-214-0x0000000000400000-0x0000000002F4A000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f8508ee6421314586555c5815e8d815d
SHA1 0b4bad3be7eda4d269a8decb9a14740e275e3acb
SHA256 6caae40dd8937001075fe73efe9d74adee0ea3ca7a5aed2f384ead603209ded7
SHA512 6cdd1d26d4432222dc70f3c17dfd438f8994d213ead008f173c492a1440601f8ad4c2938930d1d1c60489332934c392a28f012876120988a16d8f9d8cbf6360a

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2164-248-0x0000000000400000-0x0000000002F4A000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2644-256-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2164-257-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/2164-258-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/2928-259-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2164-261-0x0000000000400000-0x0000000002F4A000-memory.dmp

memory/2928-262-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2164-263-0x0000000000400000-0x0000000002F4A000-memory.dmp