Analysis Overview
SHA256
db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630
Threat Level: Known bad
The file db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630 was found to be: Known bad.
Malicious Activity Summary
Glupteba
Glupteba payload
Modifies Windows Firewall
UPX packed file
Launches sc.exe
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-04-17 19:23
Signatures
Analysis: behavioral2
Detonation Overview
Submitted
2024-04-17 19:23
Reported
2024-04-17 19:26
Platform
win11-20240412-en
Max time kernel
3s
Max time network
148s
Command Line
Signatures
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3952 wrote to memory of 1176 | N/A | C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| PID 3952 wrote to memory of 1176 | N/A | C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
| PID 3952 wrote to memory of 1176 | N/A | C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe
"C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe
"C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\windefender.exe
C:\Windows\windefender.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 876d1574-701e-4ad3-ba07-16fe17a67675.uuid.theupdatetime.org | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 8.8.8.8:53 | server2.theupdatetime.org | udp |
| US | 162.159.134.233:443 | cdn.discordapp.com | tcp |
| BG | 185.82.216.108:443 | server2.theupdatetime.org | tcp |
| US | 172.67.221.71:443 | carsalessystem.com | tcp |
| NL | 74.125.128.127:19302 | stun2.l.google.com | udp |
| BG | 185.82.216.108:443 | server2.theupdatetime.org | tcp |
| BG | 185.82.216.108:443 | server2.theupdatetime.org | tcp |
Files
memory/3952-1-0x0000000004F70000-0x0000000005371000-memory.dmp
memory/3952-2-0x0000000005380000-0x0000000005C6B000-memory.dmp
memory/3952-3-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1176-4-0x0000000004AA0000-0x0000000004AD6000-memory.dmp
memory/1176-5-0x00000000740A0000-0x0000000074851000-memory.dmp
memory/1176-8-0x0000000005110000-0x000000000573A000-memory.dmp
memory/1176-7-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/1176-6-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/1176-9-0x0000000005060000-0x0000000005082000-memory.dmp
memory/1176-11-0x0000000005820000-0x0000000005886000-memory.dmp
memory/1176-10-0x0000000005740000-0x00000000057A6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_naavlbri.oft.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1176-20-0x00000000059D0000-0x0000000005D27000-memory.dmp
memory/1176-21-0x0000000005F20000-0x0000000005F3E000-memory.dmp
memory/1176-22-0x00000000063E0000-0x000000000642C000-memory.dmp
memory/1176-23-0x00000000062F0000-0x0000000006336000-memory.dmp
memory/1176-24-0x000000007F3C0000-0x000000007F3D0000-memory.dmp
memory/1176-25-0x0000000007350000-0x0000000007384000-memory.dmp
memory/1176-37-0x00000000073B0000-0x0000000007454000-memory.dmp
memory/1176-38-0x0000000000FA0000-0x0000000000FB0000-memory.dmp
memory/1176-36-0x0000000007390000-0x00000000073AE000-memory.dmp
memory/1176-27-0x00000000704E0000-0x0000000070837000-memory.dmp
memory/1176-26-0x0000000070310000-0x000000007035C000-memory.dmp
memory/1176-40-0x00000000074E0000-0x00000000074FA000-memory.dmp
memory/1176-39-0x0000000007B20000-0x000000000819A000-memory.dmp
memory/1176-41-0x0000000007520000-0x000000000752A000-memory.dmp
memory/1176-42-0x0000000007630000-0x00000000076C6000-memory.dmp
memory/1176-43-0x0000000007540000-0x0000000007551000-memory.dmp
memory/1176-44-0x0000000007590000-0x000000000759E000-memory.dmp
memory/1176-45-0x00000000075A0000-0x00000000075B5000-memory.dmp
memory/1176-46-0x00000000075F0000-0x000000000760A000-memory.dmp
memory/1176-47-0x0000000007610000-0x0000000007618000-memory.dmp
memory/1176-50-0x00000000740A0000-0x0000000074851000-memory.dmp
memory/1516-52-0x0000000004E90000-0x000000000528A000-memory.dmp
memory/1516-53-0x0000000000400000-0x000000000310E000-memory.dmp
memory/4808-62-0x0000000006120000-0x0000000006477000-memory.dmp
memory/4808-64-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/4808-63-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/1516-65-0x0000000005290000-0x0000000005B7B000-memory.dmp
memory/4808-66-0x00000000740A0000-0x0000000074851000-memory.dmp
memory/4808-67-0x0000000070310000-0x000000007035C000-memory.dmp
memory/4808-68-0x0000000070490000-0x00000000707E7000-memory.dmp
memory/3952-78-0x0000000004F70000-0x0000000005371000-memory.dmp
memory/4808-79-0x0000000005190000-0x00000000051A0000-memory.dmp
memory/4808-77-0x00000000077D0000-0x0000000007874000-memory.dmp
memory/4808-80-0x0000000007B10000-0x0000000007B21000-memory.dmp
memory/4808-81-0x0000000007B60000-0x0000000007B75000-memory.dmp
memory/4808-84-0x00000000740A0000-0x0000000074851000-memory.dmp
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | d0c46cad6c0778401e21910bd6b56b70 |
| SHA1 | 7be418951ea96326aca445b8dfe449b2bfa0dca6 |
| SHA256 | 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02 |
| SHA512 | 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949 |
memory/4524-87-0x0000000002AE0000-0x0000000002AF0000-memory.dmp
memory/4524-88-0x0000000002AE0000-0x0000000002AF0000-memory.dmp
memory/4524-86-0x00000000740A0000-0x0000000074851000-memory.dmp
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 2caf9ad8d2c450e246b5e26b3d8b43bd |
| SHA1 | 8fe7e88bdf1cc5d8bad7ab3a882aceed23986e9e |
| SHA256 | bdabb3ae64ef8754b81ed17c2697783d7593b8da60e8b10f14cfff82769947bf |
| SHA512 | 528463339db896552a5d712951c5bd95bc77ce3e2315591d53f9c6654c803b59f5f6e8d1bb2262239273cdcbde14a88d2cc7007e4e5378dcd5344ce7636765b9 |
memory/4524-98-0x0000000070310000-0x000000007035C000-memory.dmp
memory/4524-99-0x0000000070490000-0x00000000707E7000-memory.dmp
memory/4524-109-0x000000007F970000-0x000000007F980000-memory.dmp
memory/4524-111-0x0000000002AE0000-0x0000000002AF0000-memory.dmp
memory/4524-110-0x0000000002AE0000-0x0000000002AF0000-memory.dmp
memory/3952-108-0x0000000000400000-0x000000000310E000-memory.dmp
memory/396-114-0x00000000740A0000-0x0000000074851000-memory.dmp
memory/396-116-0x00000000048E0000-0x00000000048F0000-memory.dmp
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | b4d232f51218fd3ad7bafed512660647 |
| SHA1 | 0b8a6cb1e71ace58bdd0379b97067bbbf3839b1d |
| SHA256 | dd713dcbab62cdd73868022080c310ba540ecca40e649ceadb0424ab6337b73e |
| SHA512 | cc48f3b8a21d27e2e81e00f322051d75aa8c29ab578d1708cfb7a613d8528aa0e810f4fa593bba10b5c6a6e99f5925e732151a7da804a2c7fefb70c35dda7196 |
memory/396-115-0x00000000048E0000-0x00000000048F0000-memory.dmp
memory/4524-113-0x00000000740A0000-0x0000000074851000-memory.dmp
memory/396-127-0x0000000070310000-0x000000007035C000-memory.dmp
memory/396-128-0x0000000070490000-0x00000000707E7000-memory.dmp
memory/1516-137-0x0000000004E90000-0x000000000528A000-memory.dmp
memory/1516-138-0x0000000000400000-0x000000000310E000-memory.dmp
C:\Windows\rss\csrss.exe
| MD5 | fe52baec8cce5e139a516cab4ecb2931 |
| SHA1 | 7abd79065eb3c2accb559dbeb1615b61bdff3d96 |
| SHA256 | db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630 |
| SHA512 | 92858ce8de8a6af77848cfb3ea1e3212bda8806b1f7a59d9b08bb508800299f85d96662e2f64219cc308e84898b446fa6b2e862a96dc3f02b159387471a0f1ae |
memory/1516-147-0x0000000000400000-0x000000000310E000-memory.dmp
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 29ec7c89ac00d7b3e7e56a46b66faf4b |
| SHA1 | 16af5d89b03a8e80ff032d50d5afb800c6dd253b |
| SHA256 | 7dc1f1a9d247a88f516a0d40a0f0eee330761deeaf3350b9776dd407671a0b70 |
| SHA512 | a6a84850cb53f10b7bf688ffbded7a89847e129d0409dade2b9785c08444a9fe44421ba55f6c8d6c52fd34ea333478fbda28668ae48bf70927af14855c70dd05 |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | ce4a3d72020f43d1490dd2bf5f866d36 |
| SHA1 | 824fb10bc60dacfa9fadf0e7c043c20e0a131208 |
| SHA256 | 3f2a35bc696a913114080e2814c8df47adc9c9e8b03c0a36dea856106ee03d4b |
| SHA512 | 9aa7bc27dd3fe290e4b988f62d5e6c831622fb5010cb8c6d662a937d97fd9bcde2f783e6bc9b529275eaf165662124fc38fb906dd1dd4ea467d6f1b44f34b69f |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 2e3566ad195ccc61422cb11bf164dab7 |
| SHA1 | 3d8e1f590bd4981983e1e7128cae276667773e7e |
| SHA256 | 50d69aec127529fad606951bbde5924f9831224454dc44c1f32529963b466fdc |
| SHA512 | 8cbd9921791b0bbaa3955fc227e76fffa8233770622c8df4f1e93c6a0d0a6e334d6fc19938a561d9f6f71467e12dacf8b5f9d5289ecee7198150f21ce881889b |
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
| MD5 | d98e33b66343e7c96158444127a117f6 |
| SHA1 | bb716c5509a2bf345c6c1152f6e3e1452d39d50d |
| SHA256 | 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1 |
| SHA512 | 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5 |
memory/1220-243-0x0000000000400000-0x000000000310E000-memory.dmp
C:\Windows\windefender.exe
| MD5 | 8e67f58837092385dcf01e8a2b4f5783 |
| SHA1 | 012c49cfd8c5d06795a6f67ea2baf2a082cf8625 |
| SHA256 | 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa |
| SHA512 | 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec |
memory/2488-250-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/1220-253-0x0000000000400000-0x000000000310E000-memory.dmp
memory/2700-255-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/1220-256-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1220-259-0x0000000000400000-0x000000000310E000-memory.dmp
memory/2700-261-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/1220-262-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1220-265-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1220-268-0x0000000000400000-0x000000000310E000-memory.dmp
memory/2700-269-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/1220-271-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1220-274-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1220-277-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1220-280-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1220-283-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1220-286-0x0000000000400000-0x000000000310E000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2024-04-17 19:23
Reported
2024-04-17 19:26
Platform
win10v2004-20240412-en
Max time kernel
1s
Max time network
146s
Command Line
Signatures
Glupteba
Glupteba payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Modifies Windows Firewall
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\netsh.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Launches sc.exe
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\sc.exe | N/A |
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SYSTEM32\schtasks.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe
"C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe
"C:\Users\Admin\AppData\Local\Temp\db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:\Windows\windefender.exe
C:\Windows\windefender.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 134.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 204.79.197.237:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 237.197.79.204.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 60.166.213.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 407ae4a1-c5db-47bd-8f2a-85704357cb2c.uuid.theupdatetime.org | udp |
| US | 8.8.8.8:53 | stun4.l.google.com | udp |
| US | 8.8.8.8:53 | server4.theupdatetime.org | udp |
| US | 8.8.8.8:53 | cdn.discordapp.com | udp |
| US | 162.159.133.233:443 | cdn.discordapp.com | tcp |
| CH | 172.217.210.127:19302 | stun4.l.google.com | udp |
| BG | 185.82.216.108:443 | server4.theupdatetime.org | tcp |
| US | 8.8.8.8:53 | carsalessystem.com | udp |
| US | 172.67.221.71:443 | carsalessystem.com | tcp |
| US | 8.8.8.8:53 | 86.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| BG | 185.82.216.108:443 | server4.theupdatetime.org | tcp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| NL | 52.142.223.178:80 | tcp | |
| US | 8.8.8.8:53 | 21.236.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.90.14.23.in-addr.arpa | udp |
| BG | 185.82.216.108:443 | server4.theupdatetime.org | tcp |
Files
memory/1284-1-0x0000000004E70000-0x000000000526A000-memory.dmp
memory/1284-2-0x0000000005270000-0x0000000005B5B000-memory.dmp
memory/1284-3-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3976-4-0x0000000005060000-0x0000000005096000-memory.dmp
memory/3976-8-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/3976-7-0x00000000057F0000-0x0000000005E18000-memory.dmp
memory/3976-6-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/3976-5-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/3976-9-0x0000000005730000-0x0000000005752000-memory.dmp
memory/3976-11-0x0000000005E90000-0x0000000005EF6000-memory.dmp
memory/3976-10-0x0000000005E20000-0x0000000005E86000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ani0jpw4.p3y.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3976-21-0x0000000005F80000-0x00000000062D4000-memory.dmp
memory/3976-22-0x0000000006600000-0x000000000661E000-memory.dmp
memory/3976-23-0x0000000006660000-0x00000000066AC000-memory.dmp
memory/3976-24-0x0000000006B60000-0x0000000006BA4000-memory.dmp
memory/3976-25-0x0000000007930000-0x00000000079A6000-memory.dmp
memory/3976-26-0x0000000008030000-0x00000000086AA000-memory.dmp
memory/3976-27-0x00000000079D0000-0x00000000079EA000-memory.dmp
memory/3976-30-0x0000000070CF0000-0x0000000070D3C000-memory.dmp
memory/3976-29-0x0000000007B90000-0x0000000007BC2000-memory.dmp
memory/3976-28-0x000000007F0B0000-0x000000007F0C0000-memory.dmp
memory/3976-31-0x0000000070E90000-0x00000000711E4000-memory.dmp
memory/3976-42-0x00000000051B0000-0x00000000051C0000-memory.dmp
memory/3976-43-0x0000000007BF0000-0x0000000007C93000-memory.dmp
memory/3976-41-0x0000000007BD0000-0x0000000007BEE000-memory.dmp
memory/3976-44-0x0000000007CE0000-0x0000000007CEA000-memory.dmp
memory/3976-45-0x0000000007DA0000-0x0000000007E36000-memory.dmp
memory/3976-46-0x0000000007D00000-0x0000000007D11000-memory.dmp
memory/3976-47-0x0000000007D40000-0x0000000007D4E000-memory.dmp
memory/3976-48-0x0000000007D50000-0x0000000007D64000-memory.dmp
memory/3976-49-0x0000000007E40000-0x0000000007E5A000-memory.dmp
memory/3976-50-0x0000000007D90000-0x0000000007D98000-memory.dmp
memory/3976-53-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/4524-55-0x0000000004DF0000-0x00000000051F2000-memory.dmp
memory/4524-56-0x0000000005200000-0x0000000005AEB000-memory.dmp
memory/1284-57-0x0000000004E70000-0x000000000526A000-memory.dmp
memory/4524-58-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1600-68-0x0000000005AD0000-0x0000000005E24000-memory.dmp
memory/1600-70-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/1600-69-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/1600-72-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/1284-71-0x0000000005270000-0x0000000005B5B000-memory.dmp
memory/1600-74-0x0000000070E70000-0x00000000711C4000-memory.dmp
memory/1600-84-0x00000000071F0000-0x0000000007293000-memory.dmp
memory/1600-73-0x0000000070CF0000-0x0000000070D3C000-memory.dmp
memory/1600-87-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/1600-86-0x00000000049D0000-0x00000000049E0000-memory.dmp
memory/1284-85-0x0000000000400000-0x000000000310E000-memory.dmp
memory/1600-88-0x0000000007510000-0x0000000007521000-memory.dmp
memory/1600-89-0x0000000007560000-0x0000000007574000-memory.dmp
memory/1600-92-0x0000000074E50000-0x0000000075600000-memory.dmp
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 3d086a433708053f9bf9523e1d87a4e8 |
| SHA1 | b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28 |
| SHA256 | 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69 |
| SHA512 | 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd |
memory/116-95-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/116-94-0x0000000074E50000-0x0000000075600000-memory.dmp
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 6ee647f23cdb3b67279b6eebbab3738a |
| SHA1 | 792f89e770243dade606ba937fbe5e88cb085292 |
| SHA256 | da89a684d3e7d1f8b192ae43aab9a9ebd859e4fc72f025394c76be6b26fc344f |
| SHA512 | c39470d444aa93d685c9e319fcb199a33f6ad60b15c0cce82a3828471f4b995e4b533e3969565732708b57bc9a062146dd54431a8f9f7ddec5681c7de97470be |
memory/116-101-0x0000000005FF0000-0x0000000006344000-memory.dmp
memory/116-109-0x0000000071470000-0x00000000717C4000-memory.dmp
memory/116-120-0x00000000050F0000-0x0000000005100000-memory.dmp
memory/4524-119-0x0000000004DF0000-0x00000000051F2000-memory.dmp
memory/116-108-0x0000000070CF0000-0x0000000070D3C000-memory.dmp
memory/116-107-0x000000007EF20000-0x000000007EF30000-memory.dmp
memory/116-122-0x0000000074E50000-0x0000000075600000-memory.dmp
memory/3784-124-0x0000000002B30000-0x0000000002B40000-memory.dmp
memory/3784-123-0x0000000074E50000-0x0000000075600000-memory.dmp
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 4d2ccd31057a9bbcc77c6fe23bc8fb5e |
| SHA1 | b55ec47419a4a13b870f6b2200c82839a68a7410 |
| SHA256 | e87a9608e68dc0170a6db497e0fe80e49f144b3d83c9a7c686578f4ec8e8c0c7 |
| SHA512 | 0d85a2da13beac3474a42b9bf2e0b9c0e088ffcb768e9f61766fd5243b54828f997d14d4f5e8c58cb79275091e295079182802ee4866265e710246ebfe909eb3 |
memory/4524-135-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3784-137-0x0000000070CF0000-0x0000000070D3C000-memory.dmp
C:\Windows\rss\csrss.exe
| MD5 | fe52baec8cce5e139a516cab4ecb2931 |
| SHA1 | 7abd79065eb3c2accb559dbeb1615b61bdff3d96 |
| SHA256 | db9a714063665045d59dd4868aca9cc3a90896c869d317b424363a4eb82b1630 |
| SHA512 | 92858ce8de8a6af77848cfb3ea1e3212bda8806b1f7a59d9b08bb508800299f85d96662e2f64219cc308e84898b446fa6b2e862a96dc3f02b159387471a0f1ae |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | a534680e379ea59b51a414cf8709327c |
| SHA1 | 7c0ae799b5db47fe9c8134569e805a8471295c8e |
| SHA256 | 71acfd93932f240a7c72bc9b6b91cd5c8bdf8302b125aeee018d2d4675426a69 |
| SHA512 | bb7c8ac49f4e4384ddeb29ce86910202554104641c1c03cc4306d6bf62e215869c45bad9e9e965f186e39917e6c7da8deb7fcb3cec0479b15e38242247f1ac46 |
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | a130990fb710af3d521c0f9c804f1380 |
| SHA1 | d397f7ca50c8f4b80a210089c875c8611dfbf40f |
| SHA256 | 31f3fbcdaaf605c9b724f06b3111138993b4f913595d5c4e7b508c584d1e7757 |
| SHA512 | cdd2217e456873238ce92189b22d79f77dbca0ec467a62ec667e4321d690158793d79a790bfa73b9c92cb60de2ea4b30252f65b62b6a17649f0c5db19952168a |
memory/4524-216-0x0000000000400000-0x000000000310E000-memory.dmp
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
| MD5 | 06fe65f72d173878e08f237fe4a8f6f4 |
| SHA1 | c62af0121f2c6aae4a03ff5d6ab268aba8e73b21 |
| SHA256 | 69d443f6790aada4d8ee34a1797e0888d54808d5c6ed006c0fc0fa8f39d2e367 |
| SHA512 | 3cf1e132f3d769cf30726e4516ffd87c3b4f53661e127216b125cc43c075d9b2e7a1a1c4aaa9db30bdf508abc8ed2f14265c7a057cc4c5bb6cd2967af49c17fb |
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
| MD5 | d98e33b66343e7c96158444127a117f6 |
| SHA1 | bb716c5509a2bf345c6c1152f6e3e1452d39d50d |
| SHA256 | 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1 |
| SHA512 | 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5 |
memory/3668-251-0x0000000000400000-0x000000000310E000-memory.dmp
C:\Windows\windefender.exe
| MD5 | 8e67f58837092385dcf01e8a2b4f5783 |
| SHA1 | 012c49cfd8c5d06795a6f67ea2baf2a082cf8625 |
| SHA256 | 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa |
| SHA512 | 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec |
memory/1596-260-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3668-262-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3940-264-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3668-266-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3668-270-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3940-272-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3668-274-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3668-278-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3668-282-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3940-284-0x0000000000400000-0x00000000008DF000-memory.dmp
memory/3668-286-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3668-290-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3668-294-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3668-298-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3668-302-0x0000000000400000-0x000000000310E000-memory.dmp
memory/3668-306-0x0000000000400000-0x000000000310E000-memory.dmp