Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
17/04/2024, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe
Resource
win10v2004-20240226-en
General
-
Target
ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe
-
Size
4.2MB
-
MD5
5594fdcad21298194594303f3b63b781
-
SHA1
b57e7386916ccace46943bd8bbd6b6eedd964538
-
SHA256
ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9
-
SHA512
ec620d40e651b81a3586b571b6189e1587c701d4d8e799bcc903983fd33b5f53190b51f69e735e69be13f788743bd37e934f4fe809227533d9efa34536b1e4fb
-
SSDEEP
98304:uz7Cg0ld9bGpeFIidtQ9zICqBAsCsR7hN5aqRYTU7d:k7NcfZtQ9LJEd3aOYT+d
Malware Config
Signatures
-
Glupteba payload 19 IoCs
resource yara_rule behavioral2/memory/2652-2-0x0000000005250000-0x0000000005B3B000-memory.dmp family_glupteba behavioral2/memory/2652-3-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/1420-62-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2652-65-0x0000000005250000-0x0000000005B3B000-memory.dmp family_glupteba behavioral2/memory/2652-78-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/1420-145-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-242-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-252-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-255-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-258-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-261-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-264-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-267-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-270-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-273-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-276-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-279-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-282-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/2152-285-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4128 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 2152 csrss.exe 2236 injector.exe 3800 windefender.exe 1892 windefender.exe -
resource yara_rule behavioral2/files/0x000200000002a9b6-246.dat upx behavioral2/memory/3800-250-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1892-253-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1892-259-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1892-268-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe File created C:\Windows\rss\csrss.exe ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4820 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1668 schtasks.exe 1584 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-491 = "India Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3772 powershell.exe 3772 powershell.exe 2652 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 2652 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 4512 powershell.exe 4512 powershell.exe 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 3100 powershell.exe 3100 powershell.exe 4524 powershell.exe 4524 powershell.exe 3096 powershell.exe 3096 powershell.exe 4844 powershell.exe 4844 powershell.exe 4052 powershell.exe 4052 powershell.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2152 csrss.exe 2152 csrss.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2152 csrss.exe 2152 csrss.exe 2236 injector.exe 2236 injector.exe 2152 csrss.exe 2152 csrss.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe 2236 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3772 powershell.exe Token: SeDebugPrivilege 2652 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Token: SeImpersonatePrivilege 2652 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe Token: SeDebugPrivilege 4512 powershell.exe Token: SeDebugPrivilege 3100 powershell.exe Token: SeDebugPrivilege 4524 powershell.exe Token: SeDebugPrivilege 3096 powershell.exe Token: SeDebugPrivilege 4844 powershell.exe Token: SeDebugPrivilege 4052 powershell.exe Token: SeSystemEnvironmentPrivilege 2152 csrss.exe Token: SeSecurityPrivilege 4820 sc.exe Token: SeSecurityPrivilege 4820 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2652 wrote to memory of 3772 2652 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 103 PID 2652 wrote to memory of 3772 2652 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 103 PID 2652 wrote to memory of 3772 2652 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 103 PID 1420 wrote to memory of 4512 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 84 PID 1420 wrote to memory of 4512 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 84 PID 1420 wrote to memory of 4512 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 84 PID 1420 wrote to memory of 1956 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 86 PID 1420 wrote to memory of 1956 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 86 PID 1956 wrote to memory of 4128 1956 cmd.exe 88 PID 1956 wrote to memory of 4128 1956 cmd.exe 88 PID 1420 wrote to memory of 3100 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 89 PID 1420 wrote to memory of 3100 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 89 PID 1420 wrote to memory of 3100 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 89 PID 1420 wrote to memory of 4524 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 91 PID 1420 wrote to memory of 4524 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 91 PID 1420 wrote to memory of 4524 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 91 PID 1420 wrote to memory of 2152 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 93 PID 1420 wrote to memory of 2152 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 93 PID 1420 wrote to memory of 2152 1420 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe 93 PID 2152 wrote to memory of 3096 2152 csrss.exe 94 PID 2152 wrote to memory of 3096 2152 csrss.exe 94 PID 2152 wrote to memory of 3096 2152 csrss.exe 94 PID 2152 wrote to memory of 4844 2152 csrss.exe 100 PID 2152 wrote to memory of 4844 2152 csrss.exe 100 PID 2152 wrote to memory of 4844 2152 csrss.exe 100 PID 2152 wrote to memory of 4052 2152 csrss.exe 102 PID 2152 wrote to memory of 4052 2152 csrss.exe 102 PID 2152 wrote to memory of 4052 2152 csrss.exe 102 PID 2152 wrote to memory of 2236 2152 csrss.exe 104 PID 2152 wrote to memory of 2236 2152 csrss.exe 104 PID 3800 wrote to memory of 2404 3800 windefender.exe 110 PID 3800 wrote to memory of 2404 3800 windefender.exe 110 PID 3800 wrote to memory of 2404 3800 windefender.exe 110 PID 2404 wrote to memory of 4820 2404 cmd.exe 111 PID 2404 wrote to memory of 4820 2404 cmd.exe 111 PID 2404 wrote to memory of 4820 2404 cmd.exe 111 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe"C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe"C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4128
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4524
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1668
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1244
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:3772
-
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2236
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1584
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1892
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5afcc3da39842554c2ea7657fc076f8ae
SHA175fe6ff681b554e416b691ac6934f18457408a6e
SHA256720436345daa00a8f845422b4597b6ad7323be0140cea52bcf833d19f511b385
SHA512ea351ddc84acf906a304ccfdc624b2014856b353ac4c4deea4367e7612db795a388c7b3dfde98f9704c810c0b123879971c2ea5ccef2d281fb70910db243e593
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD52f73257b1ce34c4c5a45939e65df7d4f
SHA13441dfdebdb81c3da9d0ed09ea8f90a7c88841df
SHA256445da41f13e35ccc580e7b30ac9bdd52c7dabfc3c77d2d1df28c6af8b08ac583
SHA5125a405a1e65b568d66620077acf8b185374b5fd2e36a8acd48111eb825e31b590f85fcd68fc36afda32d2e39eb4af97645af04f71010dbfa08fee0996d257a4bc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD503160742e785795cd89b8ae50cc05340
SHA168599a1a8cef6f27c8fe3fb430bb43ea396d5ce9
SHA25680e211942d812813aaadeb069f6dc227f755b298bc188228de2103520cf97189
SHA512d02c9cc0c9c2b741a006303fe43e320be20b423dc04dac7327ad287ee4a49a57a986b0921d422ff2df399ca3f79ef216c62badcf8ccc3fcc80328687095e175c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD57240f0763e144cab5ade3039d104a8bf
SHA1367a80ab182bc53b2263364ead67bb5233a157fd
SHA256151813627a13090ca2e38e92ea980a5c20bdecd7ccdcdfb828904a8d47658405
SHA51297dda5085729c72de2c47564be93813e3a5fa1e020f96653af4cd831a3b96e7722dfbc1aa864e2dd6fe58367620a49fd0083d829d9a0f61e041746797fac2c17
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5cc218377a52e047bcef15ba3d087e026
SHA1f8fa8bbb04cdad5b34710c52a0cde0207df6b3fc
SHA2561ed1cbaf6ab2a32b4b40c7c1fdbb026d9385eda15e57252f333170a49cca54ec
SHA512b14450da26cb2c258da375ef474938edfb07cb2cb9eef4287befa8f28643fc423f82d8a310c2dc8abf731c655b8aae1385b4ce1c5b5fc1870eef6eb3e685aafc
-
Filesize
4.2MB
MD55594fdcad21298194594303f3b63b781
SHA1b57e7386916ccace46943bd8bbd6b6eedd964538
SHA256ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9
SHA512ec620d40e651b81a3586b571b6189e1587c701d4d8e799bcc903983fd33b5f53190b51f69e735e69be13f788743bd37e934f4fe809227533d9efa34536b1e4fb
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec