Analysis
-
max time kernel
193s -
max time network
192s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 15:41
Static task
static1
Behavioral task
behavioral1
Sample
05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe
Resource
win10v2004-20240412-en
General
-
Target
05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe
-
Size
4.2MB
-
MD5
c9b0b7a85b135c6095efbca7a4290013
-
SHA1
3c737be6da8d33d6849af153c29aa08c227058af
-
SHA256
05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c
-
SHA512
2f4a0b5be561ecaa1bc610abda3475dcd721c75c17809bf2699f9ed102f286692c0289da0af6d2a5d16c25d6ebaac7e12f907705040799eb35a438a098667c15
-
SSDEEP
98304:uz7Cg0ld9bGpeFIidtQ9zICqBAsCsR7hN5aqRYTU74:k7NcfZtQ9LJEd3aOYT+4
Malware Config
Signatures
-
Glupteba payload 12 IoCs
resource yara_rule behavioral1/memory/1552-2-0x0000000005260000-0x0000000005B4B000-memory.dmp family_glupteba behavioral1/memory/1552-3-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral1/memory/1552-4-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral1/memory/1552-5-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral1/memory/1552-14-0x0000000005260000-0x0000000005B4B000-memory.dmp family_glupteba behavioral1/memory/1552-62-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral1/memory/1552-70-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral1/memory/3276-73-0x0000000005130000-0x0000000005A1B000-memory.dmp family_glupteba behavioral1/memory/3276-74-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral1/memory/1552-75-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral1/memory/3276-76-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral1/memory/3276-104-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1200 netsh.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4720 powershell.exe 4720 powershell.exe 1552 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 1552 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 4260 powershell.exe 4260 powershell.exe 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 3820 powershell.exe 3820 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4720 powershell.exe Token: SeDebugPrivilege 1552 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Token: SeImpersonatePrivilege 1552 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe Token: SeDebugPrivilege 4260 powershell.exe Token: SeDebugPrivilege 3820 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1552 wrote to memory of 4720 1552 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 96 PID 1552 wrote to memory of 4720 1552 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 96 PID 1552 wrote to memory of 4720 1552 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 96 PID 3276 wrote to memory of 4260 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 105 PID 3276 wrote to memory of 4260 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 105 PID 3276 wrote to memory of 4260 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 105 PID 3276 wrote to memory of 456 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 107 PID 3276 wrote to memory of 456 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 107 PID 456 wrote to memory of 1200 456 cmd.exe 109 PID 456 wrote to memory of 1200 456 cmd.exe 109 PID 3276 wrote to memory of 3820 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 110 PID 3276 wrote to memory of 3820 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 110 PID 3276 wrote to memory of 3820 3276 05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe"C:\Users\Admin\AppData\Local\Temp\05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4720
-
-
C:\Users\Admin\AppData\Local\Temp\05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe"C:\Users\Admin\AppData\Local\Temp\05b8d3cf94680686a5b73128c11134b3b85c417c2f9eca5945dcbb4553413e4c.exe"2⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4260
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1200
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD53fbad1fe3e5a193e217ebbcd977f321f
SHA14c02aba22a4c4890ef4f265f0184499e55ba72cb
SHA256b444fc4fc6d856c941e85b75a77062ea328d691b488db639b79533ed5c87c003
SHA5126d0d4c66af3954ca5f7c5a17acfcfba232aeea4f5344060ba50d26abec77796b8496a5f78a5b0df9ac0b2e884d029e82b134b8ba1f7094082e32e1c561ea3e45