Analysis
-
max time kernel
155s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 19:25
Static task
static1
Behavioral task
behavioral1
Sample
a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe
Resource
win10v2004-20240412-en
General
-
Target
a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe
-
Size
4.2MB
-
MD5
c72d2ee8d193208f967ba4b03bb49e23
-
SHA1
9abdb78f0beba2baddade1fc11a1f044f238fd76
-
SHA256
a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576
-
SHA512
4aa3cb46e588863f96e7b0c7535a4c8d933c4c7d6d2d4220914665e6f5cc488620f46534dd1d36fc459c76fcd00e31ee44378439f06961c840d3b652c5ae2708
-
SSDEEP
98304:Tz8muvG4/7oo98xMphVIqHAQJ7eNfIWzS5gC960Xfu6ti9vBy29s:TzvuvT/7/zVIWAQdeNfIWzX0W6tA42i
Malware Config
Signatures
-
Glupteba payload 20 IoCs
resource yara_rule behavioral1/memory/2420-2-0x0000000005270000-0x0000000005B5B000-memory.dmp family_glupteba behavioral1/memory/2420-3-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/2420-29-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/2420-57-0x0000000005270000-0x0000000005B5B000-memory.dmp family_glupteba behavioral1/memory/2420-58-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/5040-60-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/5040-91-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/5040-110-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/5040-114-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/5040-161-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/532-223-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/532-266-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/532-275-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/532-281-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/532-285-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/532-289-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/532-292-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/532-296-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/532-301-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba behavioral1/memory/532-305-0x0000000000400000-0x000000000310E000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4432 netsh.exe -
Executes dropped EXE 5 IoCs
pid Process 532 csrss.exe 4092 injector.exe 3684 injector.exe 1528 windefender.exe 4588 windefender.exe -
resource yara_rule behavioral1/files/0x0008000000023429-271.dat upx behavioral1/memory/1528-276-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4588-290-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4588-302-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe File created C:\Windows\rss\csrss.exe a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1440 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4708 schtasks.exe 2892 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-571 = "China Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1336 powershell.exe 1336 powershell.exe 2420 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 2420 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 1516 powershell.exe 1516 powershell.exe 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 4412 powershell.exe 4412 powershell.exe 5060 powershell.exe 5060 powershell.exe 4012 powershell.exe 4012 powershell.exe 1308 powershell.exe 1308 powershell.exe 1052 powershell.exe 1052 powershell.exe 3684 injector.exe 3684 injector.exe 4092 injector.exe 4092 injector.exe 4092 injector.exe 3684 injector.exe 4092 injector.exe 3684 injector.exe 532 csrss.exe 532 csrss.exe 3684 injector.exe 3684 injector.exe 4092 injector.exe 4092 injector.exe 3684 injector.exe 3684 injector.exe 4092 injector.exe 4092 injector.exe 3684 injector.exe 3684 injector.exe 4092 injector.exe 4092 injector.exe 532 csrss.exe 532 csrss.exe 3684 injector.exe 3684 injector.exe 4092 injector.exe 4092 injector.exe 3684 injector.exe 3684 injector.exe 4092 injector.exe 4092 injector.exe 3684 injector.exe 3684 injector.exe 4092 injector.exe 4092 injector.exe 532 csrss.exe 532 csrss.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1336 powershell.exe Token: SeDebugPrivilege 2420 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Token: SeImpersonatePrivilege 2420 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe Token: SeDebugPrivilege 1516 powershell.exe Token: SeDebugPrivilege 4412 powershell.exe Token: SeDebugPrivilege 5060 powershell.exe Token: SeDebugPrivilege 4012 powershell.exe Token: SeDebugPrivilege 1308 powershell.exe Token: SeDebugPrivilege 1052 powershell.exe Token: SeSystemEnvironmentPrivilege 532 csrss.exe Token: SeSecurityPrivilege 1440 sc.exe Token: SeSecurityPrivilege 1440 sc.exe -
Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2420 wrote to memory of 1336 2420 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 89 PID 2420 wrote to memory of 1336 2420 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 89 PID 2420 wrote to memory of 1336 2420 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 89 PID 5040 wrote to memory of 1516 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 94 PID 5040 wrote to memory of 1516 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 94 PID 5040 wrote to memory of 1516 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 94 PID 5040 wrote to memory of 1152 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 97 PID 5040 wrote to memory of 1152 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 97 PID 1152 wrote to memory of 4432 1152 cmd.exe 99 PID 1152 wrote to memory of 4432 1152 cmd.exe 99 PID 5040 wrote to memory of 4412 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 100 PID 5040 wrote to memory of 4412 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 100 PID 5040 wrote to memory of 4412 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 100 PID 5040 wrote to memory of 5060 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 103 PID 5040 wrote to memory of 5060 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 103 PID 5040 wrote to memory of 5060 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 103 PID 5040 wrote to memory of 532 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 105 PID 5040 wrote to memory of 532 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 105 PID 5040 wrote to memory of 532 5040 a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe 105 PID 532 wrote to memory of 4012 532 csrss.exe 106 PID 532 wrote to memory of 4012 532 csrss.exe 106 PID 532 wrote to memory of 4012 532 csrss.exe 106 PID 532 wrote to memory of 1308 532 csrss.exe 112 PID 532 wrote to memory of 1308 532 csrss.exe 112 PID 532 wrote to memory of 1308 532 csrss.exe 112 PID 532 wrote to memory of 1052 532 csrss.exe 114 PID 532 wrote to memory of 1052 532 csrss.exe 114 PID 532 wrote to memory of 1052 532 csrss.exe 114 PID 532 wrote to memory of 4092 532 csrss.exe 116 PID 532 wrote to memory of 4092 532 csrss.exe 116 PID 532 wrote to memory of 3684 532 csrss.exe 118 PID 532 wrote to memory of 3684 532 csrss.exe 118 PID 1528 wrote to memory of 2900 1528 windefender.exe 124 PID 1528 wrote to memory of 2900 1528 windefender.exe 124 PID 1528 wrote to memory of 2900 1528 windefender.exe 124 PID 2900 wrote to memory of 1440 2900 cmd.exe 125 PID 2900 wrote to memory of 1440 2900 cmd.exe 125 PID 2900 wrote to memory of 1440 2900 cmd.exe 125 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe"C:\Users\Admin\AppData\Local\Temp\a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
-
C:\Users\Admin\AppData\Local\Temp\a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe"C:\Users\Admin\AppData\Local\Temp\a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4432
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4708
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2880
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4092
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3684
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2892
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4588
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ded6558a200fd8a6858bcf0a7783ff2b
SHA14f4d9a94384d4521e3603cf9bc89117483884c73
SHA2569a33bde5edfbe3eef189cdcf9be9ccf222227f0b6d3e4efc891776f3bacf8cd2
SHA5122e74e9554c6be1025606bb5051ee3e216f366ac8112be7341ece03babf8dbe10e93f70c2849b71ff328a650da774188d59c414ee75b3c22f79bcb2cbaed41396
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5daeb79a8cf8017ffa510e1d10b8c846a
SHA16d8c53d3a0b70875908b851a2736c55bbf4c0ccb
SHA2560dbf53b857a71b3632b665d3cd2d54b5218b039d44066fe5d777df743e387d72
SHA51239d3fe7dc23d4590efbd996b87a7e644ca53a0c5b4891299ab11cdd8b937869f71ac51808fd0379129b9786adc4b6565e6f07548fc1ae0f5e9ee7f58d32215d7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5c99e39a90297aaa43f0676d3272da3b6
SHA1d0fc8def42307dbe8f05781a4859bd0024111d6d
SHA25638f164875ee0e9f547340115b29bb7b450fb227162ac4124a18de4f275ae53dd
SHA512b3d94a1b9a2f949d8643ac33b4de3b0c28564929625d72a03c0b39d199dd5f1377a6f27b9378e9a37ca225e289eacf4caa750a6e61d7a21d4a9811e791f59b58
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e70f458b0c884ec1ff3311c0915dc95a
SHA1da5077293a3cf78e3fa6833be8f0b403ea8ac06a
SHA256a2f3362a01b556a63d5ccd8bc751f505a3adb47b4b63162b4b853645f59b14a4
SHA512a64b32569b42ef8866540296872866dada574c270b6ace088cc3dc679745cd447969728af5f77011bcef8e2443fdf39319424dddf460376e48e530a89c3180c5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f0715136a4b96cf367452f2160e3244b
SHA1419c371d9572f8850512d59575de7c9911708fef
SHA256cb68142f536a7f3419b1f64dee84bc64f5db84a2807b73c04d848babe611ba5c
SHA5129da0ed7aab46e7211425acfc47831fa2ad1bc5bfc32724b134a65b6a912f7939c65615e96dcce67796471668758f45d4bfe4f13f311d8b92365e44fd38bb1fd6
-
Filesize
4.2MB
MD5c72d2ee8d193208f967ba4b03bb49e23
SHA19abdb78f0beba2baddade1fc11a1f044f238fd76
SHA256a8a96801fbc59d67d6859771e722b3c7728d3f2d4bec7d5ead6c984342485576
SHA5124aa3cb46e588863f96e7b0c7535a4c8d933c4c7d6d2d4220914665e6f5cc488620f46534dd1d36fc459c76fcd00e31ee44378439f06961c840d3b652c5ae2708
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec