Analysis
-
max time kernel
28s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
17/04/2024, 20:02
Static task
static1
Behavioral task
behavioral1
Sample
15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe
Resource
win10v2004-20240412-en
General
-
Target
15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe
-
Size
4.2MB
-
MD5
421ce3b54c30edc47c9edb329fe3caba
-
SHA1
a3849aa448f85e2974bd69e139153740f94a9cae
-
SHA256
15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf
-
SHA512
90ce952052891da627e4446771986f5123d603e5b453b0c2e06814f06d54544c7d441ae4afd2dcd536dc684cd003f86964e07a6e137ad06bef3d6e6a71263419
-
SSDEEP
98304:ZU4Iq03aI5N3yqqHwBEspKQ2DvCGo03KUue+TD:rIh7By/QBEsp+2hnfD
Malware Config
Signatures
-
Glupteba payload 19 IoCs
resource yara_rule behavioral2/memory/3364-2-0x00000000053A0000-0x0000000005C8B000-memory.dmp family_glupteba behavioral2/memory/3364-3-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3688-53-0x0000000005230000-0x0000000005B1B000-memory.dmp family_glupteba behavioral2/memory/3688-54-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3364-80-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3688-175-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-240-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-251-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-255-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-259-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-263-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-267-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-271-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-275-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-279-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-283-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-287-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-291-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba behavioral2/memory/3372-295-0x0000000000400000-0x0000000003118000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 916 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 3372 csrss.exe 5108 injector.exe 1272 windefender.exe 2880 windefender.exe -
resource yara_rule behavioral2/files/0x000200000002a9d0-245.dat upx behavioral2/memory/1272-249-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2880-253-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2880-262-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2880-274-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe File created C:\Windows\rss\csrss.exe 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4480 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3408 schtasks.exe 2288 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 5040 powershell.exe 5040 powershell.exe 3364 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 3364 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 2564 powershell.exe 2564 powershell.exe 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 4564 powershell.exe 4564 powershell.exe 3512 powershell.exe 3512 powershell.exe 4420 powershell.exe 4420 powershell.exe 3908 powershell.exe 3908 powershell.exe 4300 powershell.exe 4300 powershell.exe 5108 injector.exe 5108 injector.exe 5108 injector.exe 5108 injector.exe 5108 injector.exe 5108 injector.exe 3372 csrss.exe 3372 csrss.exe 5108 injector.exe 5108 injector.exe 5108 injector.exe 5108 injector.exe 5108 injector.exe 5108 injector.exe 3372 csrss.exe 3372 csrss.exe 5108 injector.exe 5108 injector.exe 5108 injector.exe 5108 injector.exe 3372 csrss.exe 3372 csrss.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 5040 powershell.exe Token: SeDebugPrivilege 3364 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Token: SeImpersonatePrivilege 3364 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe Token: SeDebugPrivilege 2564 powershell.exe Token: SeDebugPrivilege 4564 powershell.exe Token: SeDebugPrivilege 3512 powershell.exe Token: SeDebugPrivilege 4420 powershell.exe Token: SeDebugPrivilege 3908 powershell.exe Token: SeDebugPrivilege 4300 powershell.exe Token: SeSystemEnvironmentPrivilege 3372 csrss.exe Token: SeSecurityPrivilege 4480 sc.exe Token: SeSecurityPrivilege 4480 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3364 wrote to memory of 5040 3364 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 79 PID 3364 wrote to memory of 5040 3364 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 79 PID 3364 wrote to memory of 5040 3364 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 79 PID 3688 wrote to memory of 2564 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 84 PID 3688 wrote to memory of 2564 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 84 PID 3688 wrote to memory of 2564 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 84 PID 3688 wrote to memory of 2220 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 86 PID 3688 wrote to memory of 2220 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 86 PID 2220 wrote to memory of 916 2220 cmd.exe 88 PID 2220 wrote to memory of 916 2220 cmd.exe 88 PID 3688 wrote to memory of 4564 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 89 PID 3688 wrote to memory of 4564 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 89 PID 3688 wrote to memory of 4564 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 89 PID 3688 wrote to memory of 3512 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 91 PID 3688 wrote to memory of 3512 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 91 PID 3688 wrote to memory of 3512 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 91 PID 3688 wrote to memory of 3372 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 93 PID 3688 wrote to memory of 3372 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 93 PID 3688 wrote to memory of 3372 3688 15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe 93 PID 3372 wrote to memory of 4420 3372 csrss.exe 94 PID 3372 wrote to memory of 4420 3372 csrss.exe 94 PID 3372 wrote to memory of 4420 3372 csrss.exe 94 PID 3372 wrote to memory of 3908 3372 csrss.exe 99 PID 3372 wrote to memory of 3908 3372 csrss.exe 99 PID 3372 wrote to memory of 3908 3372 csrss.exe 99 PID 3372 wrote to memory of 4300 3372 csrss.exe 102 PID 3372 wrote to memory of 4300 3372 csrss.exe 102 PID 3372 wrote to memory of 4300 3372 csrss.exe 102 PID 3372 wrote to memory of 5108 3372 csrss.exe 104 PID 3372 wrote to memory of 5108 3372 csrss.exe 104 PID 1272 wrote to memory of 2492 1272 windefender.exe 110 PID 1272 wrote to memory of 2492 1272 windefender.exe 110 PID 1272 wrote to memory of 2492 1272 windefender.exe 110 PID 2492 wrote to memory of 4480 2492 cmd.exe 111 PID 2492 wrote to memory of 4480 2492 cmd.exe 111 PID 2492 wrote to memory of 4480 2492 cmd.exe 111 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe"C:\Users\Admin\AppData\Local\Temp\15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5040
-
-
C:\Users\Admin\AppData\Local\Temp\15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe"C:\Users\Admin\AppData\Local\Temp\15b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:916
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3408
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4716
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5108
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2288
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4480
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
PID:2880
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5aa96a21638c4ae2948d82824f1bc421a
SHA108f1c0c8f473fcef3efeb6b6ebafdfe9f509708b
SHA256d2244ec36cbfe57b959944d3fda8c63e41378d2ce7b797068da9083ebc77e96c
SHA512d6bb3ffa25a48931730a4d79916f4eff149590845936e11dda247e1e9e8b1afaa3fb49dd0764a5a513c985427e449069178c0e9b4f856cff84830e0f6bfb9da8
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5287f1950e2966efdf430ac26105bc5c0
SHA1586344b28e0f91c8871bf33dd4db0166ede91ab6
SHA2566ea6f6b27f35ddae991f08588e755970c6427f1a4954784de1a164f2c1304173
SHA5125fc7919741ea3066c5d02b91d8414cd89f6e6cd9c32fa7248918522029466c976d051ff58ec00c1ed39bae531924be438b5613b9ab115e70cd279c48049a2ef2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD56d06242089377d6fb0fb4f61cdb73f5b
SHA1f5a021a4b4c119dc0dc84a5664daa40fb3bcbf20
SHA2561bf3559d74b304dff6690e4453d6f92fafc597fee461172da0544349699bb6a4
SHA51277b0e2edb5cc643e46ba927e00a90a78878c5803dd7efac939b51972def1fab462836aed519ec171c3e631e2a492412dc3254a085d5c86059f0385a8974b73db
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD593827a4864178476a95d6d215bc60931
SHA1aa5fd637a90c13a6803a415d24d0e56e5b8fbb2a
SHA256d57380c14d6627a8e29da515d5221eeef7d8b590b40a390693cd37c79ee30912
SHA512dc9906b645bd60ff18be4c2ef10d8b9cc76253b81e841515a27196b66b6f3858eb182f082e7dc172faf33d9370395eed1390c3623a3b99f7f72f7c1a84ee3d69
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5170eaf1ed78b18292d59e240bbc01441
SHA1d1e3d2124c6c0126e1b53812b8285ea2e3a98b9c
SHA256ef0ea57fd9c58613c648e4ab04a1ccba40c855abb8e6611009228bf7c9739e1e
SHA512afa73b0f95d596e23dbea12ced6c7055553422104d336afece54647db6c70c02c11b9c04f92b8c2438e5dd2d5dce29b704bf53f4e2661b4a370385e663fd4caf
-
Filesize
4.2MB
MD5421ce3b54c30edc47c9edb329fe3caba
SHA1a3849aa448f85e2974bd69e139153740f94a9cae
SHA25615b70a60a66a0aeceddbce87466e08d5e9ac74dc1e6d458b26c80aee95924ccf
SHA51290ce952052891da627e4446771986f5123d603e5b453b0c2e06814f06d54544c7d441ae4afd2dcd536dc684cd003f86964e07a6e137ad06bef3d6e6a71263419
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec