Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/04/2024, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe
Resource
win10v2004-20240412-en
General
-
Target
9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe
-
Size
4.2MB
-
MD5
81094d131377ab691d6f6283aa430ff3
-
SHA1
2682bab9ff90c6ffaa85ab1dd73a00b7b3d169e2
-
SHA256
9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db
-
SHA512
f6678d569036205dc78ac705d095ac0f8fd3442658ea28d693d884f0077aa0590be15e3ef5b180556d519d808839ee92654541a42d0105aee93275bd2af7db00
-
SSDEEP
98304:E11nBFm7L477O3ZxwksExFmebn837tJkH5flyKdl:ELnBF77OZOE3mebnMLQdl
Malware Config
Signatures
-
Glupteba payload 18 IoCs
resource yara_rule behavioral2/memory/696-2-0x0000000002F80000-0x000000000386B000-memory.dmp family_glupteba behavioral2/memory/696-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/696-46-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/696-53-0x0000000002F80000-0x000000000386B000-memory.dmp family_glupteba behavioral2/memory/696-54-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1368-58-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1368-91-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1368-98-0x0000000001170000-0x000000000156C000-memory.dmp family_glupteba behavioral2/memory/1368-117-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1368-144-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1368-151-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4252-216-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4252-247-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4252-257-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4252-260-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4252-263-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4252-266-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4252-269-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 768 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 4252 csrss.exe 3464 injector.exe 3680 windefender.exe 4324 windefender.exe -
resource yara_rule behavioral2/files/0x000200000002aa13-250.dat upx behavioral2/memory/3680-256-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4324-259-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4324-265-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\S-1-5-21-8492748-3358837828-1435473090-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe File created C:\Windows\rss\csrss.exe 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1620 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 104 schtasks.exe 792 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 104 powershell.exe 104 powershell.exe 696 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 696 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 4088 powershell.exe 4088 powershell.exe 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 3136 powershell.exe 3136 powershell.exe 1028 powershell.exe 1028 powershell.exe 2600 powershell.exe 2600 powershell.exe 4004 powershell.exe 4004 powershell.exe 324 powershell.exe 324 powershell.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 4252 csrss.exe 4252 csrss.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 4252 csrss.exe 4252 csrss.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 4252 csrss.exe 4252 csrss.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe 3464 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 104 powershell.exe Token: SeDebugPrivilege 696 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Token: SeImpersonatePrivilege 696 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe Token: SeDebugPrivilege 4088 powershell.exe Token: SeDebugPrivilege 3136 powershell.exe Token: SeDebugPrivilege 1028 powershell.exe Token: SeDebugPrivilege 2600 powershell.exe Token: SeDebugPrivilege 4004 powershell.exe Token: SeDebugPrivilege 324 powershell.exe Token: SeSystemEnvironmentPrivilege 4252 csrss.exe Token: SeSecurityPrivilege 1620 sc.exe Token: SeSecurityPrivilege 1620 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 696 wrote to memory of 104 696 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 82 PID 696 wrote to memory of 104 696 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 82 PID 696 wrote to memory of 104 696 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 82 PID 1368 wrote to memory of 4088 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 87 PID 1368 wrote to memory of 4088 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 87 PID 1368 wrote to memory of 4088 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 87 PID 1368 wrote to memory of 2944 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 89 PID 1368 wrote to memory of 2944 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 89 PID 2944 wrote to memory of 768 2944 cmd.exe 91 PID 2944 wrote to memory of 768 2944 cmd.exe 91 PID 1368 wrote to memory of 3136 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 92 PID 1368 wrote to memory of 3136 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 92 PID 1368 wrote to memory of 3136 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 92 PID 1368 wrote to memory of 1028 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 94 PID 1368 wrote to memory of 1028 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 94 PID 1368 wrote to memory of 1028 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 94 PID 1368 wrote to memory of 4252 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 96 PID 1368 wrote to memory of 4252 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 96 PID 1368 wrote to memory of 4252 1368 9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe 96 PID 4252 wrote to memory of 2600 4252 csrss.exe 97 PID 4252 wrote to memory of 2600 4252 csrss.exe 97 PID 4252 wrote to memory of 2600 4252 csrss.exe 97 PID 4252 wrote to memory of 4004 4252 csrss.exe 103 PID 4252 wrote to memory of 4004 4252 csrss.exe 103 PID 4252 wrote to memory of 4004 4252 csrss.exe 103 PID 4252 wrote to memory of 324 4252 csrss.exe 105 PID 4252 wrote to memory of 324 4252 csrss.exe 105 PID 4252 wrote to memory of 324 4252 csrss.exe 105 PID 4252 wrote to memory of 3464 4252 csrss.exe 107 PID 4252 wrote to memory of 3464 4252 csrss.exe 107 PID 3680 wrote to memory of 2112 3680 windefender.exe 113 PID 3680 wrote to memory of 2112 3680 windefender.exe 113 PID 3680 wrote to memory of 2112 3680 windefender.exe 113 PID 2112 wrote to memory of 1620 2112 cmd.exe 114 PID 2112 wrote to memory of 1620 2112 cmd.exe 114 PID 2112 wrote to memory of 1620 2112 cmd.exe 114 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe"C:\Users\Admin\AppData\Local\Temp\9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:104
-
-
C:\Users\Admin\AppData\Local\Temp\9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe"C:\Users\Admin\AppData\Local\Temp\9cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:768
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3136
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:104
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:444
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:324
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3464
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:792
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4324
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5346f2eb8c10a0239cabf79e3d6394771
SHA18715b0cf845aa5714efda9425e810f8131a48f62
SHA2562ff6eb527a1bea52c853a57a1a1bc81fdaa720fd1ce4fa2f16ce2f1e5d0e46a7
SHA512b92644bd7006d201a963ded1cd18393dc8993f1e945431e20e5d9853a5510b88fa0becbb8cbf4c9c032f167ace155b063ee4b8fba6d50a0d466df34e9095c267
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD514b9ce7b3b665e628dff2b51c9dce34b
SHA16e0f4ddff89cd65b6763a1a11c26cc99c2ed2588
SHA256b42d29b913a67ce5e9d391efa175809961c1a3dd923a683535205f0091652bf2
SHA512cbde23f370c446fde6c7ac3fc5723876c2c7b40036599cfc3793e2580daa3e521add7d98ad892ab4d78718a0c8474c7ba3d7b52e0cf6604141b12e320ebc8e67
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD560f3e23e4c207c1457f9ff0ac0aa0191
SHA164efc3cee1967cfc1697c2d8049407121d0fb3c6
SHA256ff38c0b0478c28c9ef05b67a297e57384423e49c69e7e4a2c6b1c258cc9bb845
SHA51244102e96466852ec22674d2abae96069da4693374d2747dafe8d18fdf780a15ffac0af26969c0bf52d4fd94663ae3268031efffda403b0d9df8f1fb4e264e9ab
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD520406fb9fcf45719fad4c44223024b0e
SHA18415872d93f31d672c8b47c87a6058a27f465a3c
SHA2565bff877af78b02dffd937817d061c8bbe7aa484c3cbefb7fc0a76544435c6830
SHA512235fe7d142254a78dcc55b8de118013ac163b72cf10966501e3adfa14f6487593e80155ccfc475c226b81ffcb3853bfa7466dc527a73cb74ca8529e979ec07c3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5cc5d9e57e18fbc4ed8a95a094a54a5f7
SHA13ee782e79558354f6c0bd41093172dc6a612f59c
SHA2566b23b16943b47d77e4d1fe373377c343b85c8a0734332e541fc6a38a2eb97fed
SHA512a76e74add925473fc42d7fde93d74918ff7474af567502bbbfb9ac49b639fec2eee60a9fc87de61e2fac6e58b396d2a785b04e54b3f1475d451a7723b249e5e8
-
Filesize
4.2MB
MD581094d131377ab691d6f6283aa430ff3
SHA12682bab9ff90c6ffaa85ab1dd73a00b7b3d169e2
SHA2569cf33dbf3eb1d2090bf76dcaa66e5bb14e9f81b4c22eceaf72df21bfa2e433db
SHA512f6678d569036205dc78ac705d095ac0f8fd3442658ea28d693d884f0077aa0590be15e3ef5b180556d519d808839ee92654541a42d0105aee93275bd2af7db00
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec