Malware Analysis Report

2025-08-10 17:22

Sample ID 240417-s4g64afg3w
Target ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9
SHA256 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9

Threat Level: Known bad

The file ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Checks installed software on the system

Manipulates WinMonFS driver.

Adds Run key to start application

Drops file in System32 directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-17 15:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-17 15:40

Reported

2024-04-17 15:43

Platform

win10v2004-20240226-en

Max time kernel

155s

Max time network

160s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-492 = "India Standard Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1368 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1368 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1368 wrote to memory of 2872 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\system32\cmd.exe
PID 5096 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\system32\cmd.exe
PID 4816 wrote to memory of 4140 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4816 wrote to memory of 4140 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5096 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5096 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\rss\csrss.exe
PID 5096 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\rss\csrss.exe
PID 5096 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\rss\csrss.exe
PID 3284 wrote to memory of 2300 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3284 wrote to memory of 2300 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3284 wrote to memory of 2300 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3284 wrote to memory of 5012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3284 wrote to memory of 5012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3284 wrote to memory of 5012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3284 wrote to memory of 3352 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3284 wrote to memory of 3352 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3284 wrote to memory of 3352 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3284 wrote to memory of 3776 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3284 wrote to memory of 3776 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4784 wrote to memory of 1136 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 1136 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 1136 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1136 wrote to memory of 3532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1136 wrote to memory of 3532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1136 wrote to memory of 3532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe

"C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe

"C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
GB 216.58.201.106:443 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 18.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 219.183.117.104.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 746b9782-1b48-414c-a0e9-55347d749e38.uuid.myfastupdate.org udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 server3.myfastupdate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server3.myfastupdate.org tcp
US 15.197.250.192:3478 stun.sipgate.net udp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 192.250.197.15.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.111:443 server3.myfastupdate.org tcp

Files

memory/1368-1-0x0000000004EC0000-0x00000000052BF000-memory.dmp

memory/1368-2-0x00000000052C0000-0x0000000005BAB000-memory.dmp

memory/1368-3-0x0000000000400000-0x0000000003118000-memory.dmp

memory/1368-4-0x0000000000400000-0x0000000003118000-memory.dmp

memory/2872-5-0x0000000074470000-0x0000000074C20000-memory.dmp

memory/2872-6-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

memory/2872-7-0x0000000002C70000-0x0000000002CA6000-memory.dmp

memory/2872-8-0x00000000053A0000-0x00000000059C8000-memory.dmp

memory/2872-10-0x0000000005270000-0x0000000005292000-memory.dmp

memory/2872-11-0x0000000005AD0000-0x0000000005B36000-memory.dmp

memory/1368-9-0x0000000000400000-0x0000000003118000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i2z20rsf.opj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2872-12-0x0000000005B40000-0x0000000005BA6000-memory.dmp

memory/1368-18-0x0000000004EC0000-0x00000000052BF000-memory.dmp

memory/2872-19-0x0000000005C90000-0x0000000005FE4000-memory.dmp

memory/2872-24-0x0000000006270000-0x000000000628E000-memory.dmp

memory/2872-25-0x0000000006350000-0x000000000639C000-memory.dmp

memory/1368-26-0x00000000052C0000-0x0000000005BAB000-memory.dmp

memory/2872-27-0x00000000067B0000-0x00000000067F4000-memory.dmp

memory/2872-29-0x00000000075F0000-0x0000000007666000-memory.dmp

memory/2872-30-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

memory/2872-31-0x0000000007D30000-0x00000000083AA000-memory.dmp

memory/2872-32-0x00000000076B0000-0x00000000076CA000-memory.dmp

memory/2872-33-0x000000007F9E0000-0x000000007F9F0000-memory.dmp

memory/2872-34-0x0000000007890000-0x00000000078C2000-memory.dmp

memory/2872-35-0x0000000070310000-0x000000007035C000-memory.dmp

memory/2872-36-0x0000000070700000-0x0000000070A54000-memory.dmp

memory/2872-46-0x0000000007870000-0x000000000788E000-memory.dmp

memory/2872-47-0x00000000078D0000-0x0000000007973000-memory.dmp

memory/2872-48-0x00000000079C0000-0x00000000079CA000-memory.dmp

memory/2872-49-0x0000000007A80000-0x0000000007B16000-memory.dmp

memory/2872-50-0x00000000079E0000-0x00000000079F1000-memory.dmp

memory/1368-51-0x0000000000400000-0x0000000003118000-memory.dmp

memory/2872-52-0x0000000074470000-0x0000000074C20000-memory.dmp

memory/2872-53-0x0000000007A20000-0x0000000007A2E000-memory.dmp

memory/2872-54-0x0000000007A30000-0x0000000007A44000-memory.dmp

memory/2872-55-0x0000000007B20000-0x0000000007B3A000-memory.dmp

memory/2872-56-0x0000000007A60000-0x0000000007A68000-memory.dmp

memory/2872-59-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

memory/2872-60-0x0000000074470000-0x0000000074C20000-memory.dmp

memory/5096-62-0x0000000004E60000-0x000000000525B000-memory.dmp

memory/5096-63-0x0000000000400000-0x0000000003118000-memory.dmp

memory/1368-64-0x0000000000400000-0x0000000003118000-memory.dmp

memory/3004-65-0x0000000074470000-0x0000000074C20000-memory.dmp

memory/3004-66-0x0000000000E90000-0x0000000000EA0000-memory.dmp

memory/3004-67-0x0000000000E90000-0x0000000000EA0000-memory.dmp

memory/3004-77-0x00000000057E0000-0x0000000005B34000-memory.dmp

memory/5096-78-0x0000000000400000-0x0000000003118000-memory.dmp

memory/3004-79-0x0000000000E90000-0x0000000000EA0000-memory.dmp

memory/3004-81-0x0000000070310000-0x000000007035C000-memory.dmp

memory/3004-82-0x00000000704B0000-0x0000000070804000-memory.dmp

memory/3004-92-0x0000000006E30000-0x0000000006ED3000-memory.dmp

memory/3004-93-0x000000007FC90000-0x000000007FCA0000-memory.dmp

memory/3004-94-0x0000000007140000-0x0000000007151000-memory.dmp

memory/3004-95-0x00000000071B0000-0x00000000071C4000-memory.dmp

memory/3004-98-0x0000000074470000-0x0000000074C20000-memory.dmp

memory/5096-99-0x0000000004E60000-0x000000000525B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/5096-101-0x0000000000400000-0x0000000003118000-memory.dmp

memory/4876-107-0x0000000074470000-0x0000000074C20000-memory.dmp

memory/4876-109-0x0000000002E70000-0x0000000002E80000-memory.dmp

memory/4876-108-0x00000000061B0000-0x0000000006504000-memory.dmp

memory/4876-115-0x0000000002E70000-0x0000000002E80000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b3806b288c92b79e3aa6914f34f537d1
SHA1 0cb6f42b64a81cf889a371a74d235b4b7d6eca50
SHA256 6d3c3686ca5d3160941b5156244d25c2bf93956a25f97e8979277c827d7b0230
SHA512 22d0ddffc90fe6ba59e0bc53b983adecb1d8f698dd8d0fc0993e38a08410ca58132596fc22cca2cd0777d0ab765ff83284937760a53508c0bb28c7765bf0caf1

memory/4876-117-0x0000000002E70000-0x0000000002E80000-memory.dmp

memory/4876-118-0x0000000070310000-0x000000007035C000-memory.dmp

memory/4876-119-0x0000000070A70000-0x0000000070DC4000-memory.dmp

memory/4876-130-0x0000000074470000-0x0000000074C20000-memory.dmp

memory/4412-131-0x0000000074470000-0x0000000074C20000-memory.dmp

memory/4412-132-0x00000000024B0000-0x00000000024C0000-memory.dmp

memory/4412-133-0x00000000024B0000-0x00000000024C0000-memory.dmp

memory/4412-139-0x00000000054B0000-0x0000000005804000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 cc82baa60df1c22a792808bcaac8d4eb
SHA1 42305af25d2d424b85e1902497bf9f1a4cdb04e1
SHA256 18a6cd06b1c13e77c7b3f9c0ded086c85eb55dbd21d812c2c57f37ee0c1f5767
SHA512 6b91cf041799227966c151bbdf5e72c80e7f80ab99931ba5e93f51adb4093093ca952da3c60b0ca83096161591b884d31b5c7d1a1ea4ad5223501505205619db

memory/4412-145-0x00000000024B0000-0x00000000024C0000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 5594fdcad21298194594303f3b63b781
SHA1 b57e7386916ccace46943bd8bbd6b6eedd964538
SHA256 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9
SHA512 ec620d40e651b81a3586b571b6189e1587c701d4d8e799bcc903983fd33b5f53190b51f69e735e69be13f788743bd37e934f4fe809227533d9efa34536b1e4fb

memory/5096-165-0x0000000000400000-0x0000000003118000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d32af4651bbb91d55de2ee7a49928b28
SHA1 73cb4a2fb143ce083cc9e689651783c5e62641b5
SHA256 b7912dba215ad843eb98bbb837838610cdbced1e17c7b96d7098871da225cea1
SHA512 c1e9971e97f815ff8ad510973132c0778daf4a5ef0a628a1c9cb7f4afdf9557d01d77b3e48dc36682ceafbbe701514415bec3ca075759145188a720469f6b443

memory/3284-198-0x0000000000400000-0x0000000003118000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e28169a314f7ec10f5081023922a7f3c
SHA1 938cfd636e52b7b426936b3a88f9ac3aa4874e89
SHA256 a281f73175222e2531d83698fce66b63d113586c1a15709dc0379cec7ffd4c25
SHA512 0b8daed6aaf2a575d63ec285e20a9c78f1427374767e9cd8bbb793ba6c292002f35cff99bd7106eb0f9b95da321917245450bdfa3f0ce8399c4ef5c35819277f

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 51e63a06c624e87f7968af167dae2b5f
SHA1 ba2369a6b23dde98400a8e09400db96946229a5f
SHA256 d9691afec42d11ed865030747a734bd25bad7298cdd4bc9152b23d037978ff8e
SHA512 48ad6875cf9bb5c0c2467d81de300838d7c90186bc70e450f124e5443edd5d663adab32ed71abc6d06d981c51d85049a4265dcd546f529d9f4f4c7e3e720d28b

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3284-267-0x0000000000400000-0x0000000003118000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3284-273-0x0000000000400000-0x0000000003118000-memory.dmp

memory/4784-278-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3284-280-0x0000000000400000-0x0000000003118000-memory.dmp

memory/3192-281-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3284-283-0x0000000000400000-0x0000000003118000-memory.dmp

memory/3284-286-0x0000000000400000-0x0000000003118000-memory.dmp

memory/3192-287-0x0000000000400000-0x00000000008DF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-17 15:40

Reported

2024-04-17 15:43

Platform

win11-20240412-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-491 = "India Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2652 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\System32\Conhost.exe
PID 2652 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\System32\Conhost.exe
PID 2652 wrote to memory of 3772 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\System32\Conhost.exe
PID 1420 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\system32\cmd.exe
PID 1420 wrote to memory of 1956 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\system32\cmd.exe
PID 1956 wrote to memory of 4128 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1956 wrote to memory of 4128 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1420 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 4524 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\rss\csrss.exe
PID 1420 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\rss\csrss.exe
PID 1420 wrote to memory of 2152 N/A C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe C:\Windows\rss\csrss.exe
PID 2152 wrote to memory of 3096 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 3096 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 3096 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 4844 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 4844 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 4844 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 4052 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 4052 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 4052 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2236 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2152 wrote to memory of 2236 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3800 wrote to memory of 2404 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3800 wrote to memory of 2404 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3800 wrote to memory of 2404 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 4820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2404 wrote to memory of 4820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2404 wrote to memory of 4820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe

"C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe

"C:\Users\Admin\AppData\Local\Temp\ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 7cea7443-9ae0-452e-aa1e-668f49bf7d68.uuid.myfastupdate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server14.myfastupdate.org udp
US 162.159.129.233:443 cdn.discordapp.com tcp
CH 172.217.210.127:19302 stun4.l.google.com udp
BG 185.82.216.111:443 server14.myfastupdate.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.111:443 server14.myfastupdate.org tcp
BG 185.82.216.111:443 server14.myfastupdate.org tcp
BG 185.82.216.111:443 server14.myfastupdate.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/2652-1-0x0000000004E50000-0x000000000524A000-memory.dmp

memory/2652-2-0x0000000005250000-0x0000000005B3B000-memory.dmp

memory/2652-3-0x0000000000400000-0x0000000003118000-memory.dmp

memory/3772-5-0x0000000074AB0000-0x0000000075261000-memory.dmp

memory/3772-8-0x0000000005A00000-0x000000000602A000-memory.dmp

memory/3772-7-0x0000000003390000-0x00000000033A0000-memory.dmp

memory/3772-6-0x0000000003390000-0x00000000033A0000-memory.dmp

memory/3772-4-0x00000000030A0000-0x00000000030D6000-memory.dmp

memory/3772-9-0x00000000056D0000-0x00000000056F2000-memory.dmp

memory/3772-11-0x0000000005850000-0x00000000058B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xqgqgax0.esx.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3772-10-0x0000000005770000-0x00000000057D6000-memory.dmp

memory/3772-20-0x0000000006070000-0x00000000063C7000-memory.dmp

memory/3772-21-0x0000000006570000-0x000000000658E000-memory.dmp

memory/3772-22-0x00000000065B0000-0x00000000065FC000-memory.dmp

memory/3772-23-0x0000000006B00000-0x0000000006B46000-memory.dmp

memory/3772-27-0x0000000070EC0000-0x0000000071217000-memory.dmp

memory/3772-36-0x00000000079F0000-0x0000000007A0E000-memory.dmp

memory/3772-38-0x0000000007A10000-0x0000000007AB4000-memory.dmp

memory/3772-37-0x0000000003390000-0x00000000033A0000-memory.dmp

memory/3772-40-0x0000000007B40000-0x0000000007B5A000-memory.dmp

memory/3772-41-0x0000000007B80000-0x0000000007B8A000-memory.dmp

memory/3772-39-0x0000000008180000-0x00000000087FA000-memory.dmp

memory/3772-42-0x0000000007C90000-0x0000000007D26000-memory.dmp

memory/3772-43-0x0000000007BA0000-0x0000000007BB1000-memory.dmp

memory/3772-26-0x0000000070D20000-0x0000000070D6C000-memory.dmp

memory/3772-25-0x00000000079B0000-0x00000000079E4000-memory.dmp

memory/3772-24-0x000000007FCD0000-0x000000007FCE0000-memory.dmp

memory/3772-45-0x0000000007C00000-0x0000000007C15000-memory.dmp

memory/3772-46-0x0000000007C50000-0x0000000007C6A000-memory.dmp

memory/3772-44-0x0000000007BF0000-0x0000000007BFE000-memory.dmp

memory/3772-47-0x0000000007C70000-0x0000000007C78000-memory.dmp

memory/3772-50-0x0000000074AB0000-0x0000000075261000-memory.dmp

memory/1420-52-0x0000000004E40000-0x0000000005242000-memory.dmp

memory/2652-53-0x0000000004E50000-0x000000000524A000-memory.dmp

memory/1420-62-0x0000000000400000-0x0000000003118000-memory.dmp

memory/4512-63-0x0000000004D50000-0x0000000004D60000-memory.dmp

memory/4512-64-0x0000000004D50000-0x0000000004D60000-memory.dmp

memory/2652-65-0x0000000005250000-0x0000000005B3B000-memory.dmp

memory/4512-66-0x0000000074AB0000-0x0000000075261000-memory.dmp

memory/4512-68-0x0000000070EC0000-0x0000000071217000-memory.dmp

memory/4512-77-0x0000000007430000-0x00000000074D4000-memory.dmp

memory/4512-67-0x0000000070D20000-0x0000000070D6C000-memory.dmp

memory/4512-80-0x0000000004D50000-0x0000000004D60000-memory.dmp

memory/4512-81-0x0000000007760000-0x0000000007771000-memory.dmp

memory/4512-79-0x0000000004D50000-0x0000000004D60000-memory.dmp

memory/2652-78-0x0000000000400000-0x0000000003118000-memory.dmp

memory/4512-82-0x00000000077B0000-0x00000000077C5000-memory.dmp

memory/4512-85-0x0000000074AB0000-0x0000000075261000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/3100-89-0x0000000002DE0000-0x0000000002DF0000-memory.dmp

memory/3100-88-0x0000000002DE0000-0x0000000002DF0000-memory.dmp

memory/3100-99-0x0000000005E50000-0x00000000061A7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 cc218377a52e047bcef15ba3d087e026
SHA1 f8fa8bbb04cdad5b34710c52a0cde0207df6b3fc
SHA256 1ed1cbaf6ab2a32b4b40c7c1fdbb026d9385eda15e57252f333170a49cca54ec
SHA512 b14450da26cb2c258da375ef474938edfb07cb2cb9eef4287befa8f28643fc423f82d8a310c2dc8abf731c655b8aae1385b4ce1c5b5fc1870eef6eb3e685aafc

memory/3100-87-0x0000000074AB0000-0x0000000075261000-memory.dmp

memory/3100-111-0x0000000002DE0000-0x0000000002DF0000-memory.dmp

memory/3100-102-0x0000000070EA0000-0x00000000711F7000-memory.dmp

memory/3100-101-0x0000000070D20000-0x0000000070D6C000-memory.dmp

memory/3100-100-0x000000007FBA0000-0x000000007FBB0000-memory.dmp

memory/4524-114-0x0000000074AB0000-0x0000000075261000-memory.dmp

memory/4524-117-0x0000000004A10000-0x0000000004A20000-memory.dmp

memory/4524-123-0x0000000005890000-0x0000000005BE7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 afcc3da39842554c2ea7657fc076f8ae
SHA1 75fe6ff681b554e416b691ac6934f18457408a6e
SHA256 720436345daa00a8f845422b4597b6ad7323be0140cea52bcf833d19f511b385
SHA512 ea351ddc84acf906a304ccfdc624b2014856b353ac4c4deea4367e7612db795a388c7b3dfde98f9704c810c0b123879971c2ea5ccef2d281fb70910db243e593

memory/4524-116-0x0000000004A10000-0x0000000004A20000-memory.dmp

memory/1420-115-0x0000000004E40000-0x0000000005242000-memory.dmp

memory/3100-113-0x0000000074AB0000-0x0000000075261000-memory.dmp

memory/4524-129-0x000000007F2F0000-0x000000007F300000-memory.dmp

memory/4524-128-0x0000000070D20000-0x0000000070D6C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 5594fdcad21298194594303f3b63b781
SHA1 b57e7386916ccace46943bd8bbd6b6eedd964538
SHA256 ff99a7d2f54832f2c6e7d2e4d69a04184e2a45ebbbda9251734bcc2aab51caa9
SHA512 ec620d40e651b81a3586b571b6189e1587c701d4d8e799bcc903983fd33b5f53190b51f69e735e69be13f788743bd37e934f4fe809227533d9efa34536b1e4fb

memory/1420-145-0x0000000000400000-0x0000000003118000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2f73257b1ce34c4c5a45939e65df7d4f
SHA1 3441dfdebdb81c3da9d0ed09ea8f90a7c88841df
SHA256 445da41f13e35ccc580e7b30ac9bdd52c7dabfc3c77d2d1df28c6af8b08ac583
SHA512 5a405a1e65b568d66620077acf8b185374b5fd2e36a8acd48111eb825e31b590f85fcd68fc36afda32d2e39eb4af97645af04f71010dbfa08fee0996d257a4bc

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 03160742e785795cd89b8ae50cc05340
SHA1 68599a1a8cef6f27c8fe3fb430bb43ea396d5ce9
SHA256 80e211942d812813aaadeb069f6dc227f755b298bc188228de2103520cf97189
SHA512 d02c9cc0c9c2b741a006303fe43e320be20b423dc04dac7327ad287ee4a49a57a986b0921d422ff2df399ca3f79ef216c62badcf8ccc3fcc80328687095e175c

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7240f0763e144cab5ade3039d104a8bf
SHA1 367a80ab182bc53b2263364ead67bb5233a157fd
SHA256 151813627a13090ca2e38e92ea980a5c20bdecd7ccdcdfb828904a8d47658405
SHA512 97dda5085729c72de2c47564be93813e3a5fa1e020f96653af4cd831a3b96e7722dfbc1aa864e2dd6fe58367620a49fd0083d829d9a0f61e041746797fac2c17

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2152-242-0x0000000000400000-0x0000000003118000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3800-250-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2152-252-0x0000000000400000-0x0000000003118000-memory.dmp

memory/1892-253-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2152-255-0x0000000000400000-0x0000000003118000-memory.dmp

memory/2152-258-0x0000000000400000-0x0000000003118000-memory.dmp

memory/1892-259-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2152-261-0x0000000000400000-0x0000000003118000-memory.dmp

memory/2152-264-0x0000000000400000-0x0000000003118000-memory.dmp

memory/2152-267-0x0000000000400000-0x0000000003118000-memory.dmp

memory/1892-268-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2152-270-0x0000000000400000-0x0000000003118000-memory.dmp

memory/2152-273-0x0000000000400000-0x0000000003118000-memory.dmp

memory/2152-276-0x0000000000400000-0x0000000003118000-memory.dmp

memory/2152-279-0x0000000000400000-0x0000000003118000-memory.dmp

memory/2152-282-0x0000000000400000-0x0000000003118000-memory.dmp

memory/2152-285-0x0000000000400000-0x0000000003118000-memory.dmp