Analysis
-
max time kernel
98s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/04/2024, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe
Resource
win10v2004-20240226-en
General
-
Target
23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe
-
Size
4.2MB
-
MD5
8b65c04554fdc08623e5a74f8f9b9fd2
-
SHA1
2eda34fba02fde8495b70060623c64d8938c82e8
-
SHA256
23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15
-
SHA512
64d6cda2aef8d337d5561ce59170431bb76ca4a00ff66e7d61f2f77622f0e68ea5f31b7459321b3f161a182d943a0adb7c09c21c3defd70a23a4a00410bf3a86
-
SSDEEP
98304:mRe06RCZ8qdKnAdKFoI0tkW+Km95muXXLdVYjOy3P9UZ:rUuqUAddtM55murAiy9I
Malware Config
Signatures
-
Glupteba payload 15 IoCs
resource yara_rule behavioral1/memory/5080-2-0x00000000050C0000-0x00000000059AB000-memory.dmp family_glupteba behavioral1/memory/5080-3-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/5080-23-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/5080-56-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/5080-57-0x00000000050C0000-0x00000000059AB000-memory.dmp family_glupteba behavioral1/memory/3524-60-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/3524-94-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/3524-107-0x0000000003430000-0x0000000003837000-memory.dmp family_glupteba behavioral1/memory/3524-154-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/4436-191-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/4436-241-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/4436-261-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/4436-270-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/4436-272-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral1/memory/4436-274-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1224 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 4436 csrss.exe -
resource yara_rule behavioral1/files/0x000400000000073d-264.dat upx behavioral1/memory/2184-269-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1956-271-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1956-275-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe File created C:\Windows\rss\csrss.exe 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3828 sc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2316 5080 WerFault.exe 89 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4104 schtasks.exe 4336 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 1868 powershell.exe 1868 powershell.exe 5080 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 5080 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 1368 powershell.exe 1368 powershell.exe 1368 powershell.exe 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 4168 powershell.exe 4168 powershell.exe 4168 powershell.exe 3216 powershell.exe 3216 powershell.exe 3216 powershell.exe 3828 powershell.exe 3828 powershell.exe 3828 powershell.exe 2592 powershell.exe 2592 powershell.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1868 powershell.exe Token: SeDebugPrivilege 5080 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Token: SeImpersonatePrivilege 5080 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Token: SeDebugPrivilege 1368 powershell.exe Token: SeDebugPrivilege 4168 powershell.exe Token: SeDebugPrivilege 3216 powershell.exe Token: SeDebugPrivilege 3828 powershell.exe Token: SeDebugPrivilege 2592 powershell.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 5080 wrote to memory of 1868 5080 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 91 PID 5080 wrote to memory of 1868 5080 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 91 PID 5080 wrote to memory of 1868 5080 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 91 PID 3524 wrote to memory of 1368 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 105 PID 3524 wrote to memory of 1368 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 105 PID 3524 wrote to memory of 1368 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 105 PID 3524 wrote to memory of 4944 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 108 PID 3524 wrote to memory of 4944 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 108 PID 4944 wrote to memory of 1224 4944 cmd.exe 110 PID 4944 wrote to memory of 1224 4944 cmd.exe 110 PID 3524 wrote to memory of 4168 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 111 PID 3524 wrote to memory of 4168 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 111 PID 3524 wrote to memory of 4168 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 111 PID 3524 wrote to memory of 3216 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 113 PID 3524 wrote to memory of 3216 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 113 PID 3524 wrote to memory of 3216 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 113 PID 3524 wrote to memory of 4436 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 115 PID 3524 wrote to memory of 4436 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 115 PID 3524 wrote to memory of 4436 3524 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 115 PID 4436 wrote to memory of 3828 4436 csrss.exe 133 PID 4436 wrote to memory of 3828 4436 csrss.exe 133 PID 4436 wrote to memory of 3828 4436 csrss.exe 133 PID 4436 wrote to memory of 2592 4436 csrss.exe 122 PID 4436 wrote to memory of 2592 4436 csrss.exe 122 PID 4436 wrote to memory of 2592 4436 csrss.exe 122 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe"C:\Users\Admin\AppData\Local\Temp\23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Users\Admin\AppData\Local\Temp\23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe"C:\Users\Admin\AppData\Local\Temp\23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1224
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3216
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3828
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4104
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4724
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:2564
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:4400
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4336
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:2184
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:1392
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:3828
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 8682⤵
- Program crash
PID:2316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5080 -ip 50801⤵PID:4772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3716 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵PID:1972
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:1956
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5dec154e58554e5829b25f33ee6efa7f7
SHA19a88c3f7f4d63182a417097d637be7b6cebcad36
SHA256c7e352ac673d03055af94d4a3c594e34e1b732dda2aac8e0e9fa4e980a0e4a0b
SHA512588777c90f23b7d26edcaf72656b7a68930ae764602259b38ef81899898a0c2ee354fd2c923a157a3e75b07659fb9f9ca9da318e2a7e52b95e56e0a204b2a678
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a64ffea2a176caeb1e647bf3f528a8fe
SHA153a7b64d924790c1f21196bff9b8a6366ace5f96
SHA2561b57164c3a8dcb945390f6e4a5a7fcdd8c5a8a804466e44362bd18def9cc6e56
SHA51259d7d46ae8d39a1132ca7d9a60bff736dc396671a63f3baa759e4821543ecee8b841f05a105b786e85c7d59a2c5afa8561909f228fc9beee8f8547c3b0a3da3a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD500895e6e7114a28f7d9f699eeba2da82
SHA15e8cec1cf0a3331edd7cccf34218fbba5b1df6cb
SHA256fba1fe5a9d1a5449a1fab1f5c0c3fbfb2a6378786d50f21ae0590d2f05506e3a
SHA5120896d936d16aefa7016e4e0e87621c8c5d4f533b934ad2eafa68eb9ea755a1a6f46484e34680737f6534138d33348b7e590abec13f156fba24f96fbc61dbe2e2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5b7d8327239cb55aed03906e49faf5712
SHA11d4cb7b4cd2b34f51e12e1b5ff40e85492f24912
SHA25647ea54863608a815df53d00aaa5308bc76fb383aef37f0077f6c1811337ea64b
SHA51248fe06ac955abcebbc6838650de730577b9b01b4175929abd1f734f5b61b20a435ceda6b2570a94b8f518d7060c3a167b7bce64268a62948f35667b35a48538a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5d9c32e32250e177564c5c3f6cc40d107
SHA13263527b4b0a60f273bd3f3c018740266d2bb976
SHA256c29cee641d2201a54d9f696b5638f311ba4900c6a5055395f87c5185ab27685a
SHA5129e86a1e432b62d46197e78c578f646950d4a83c32c12b26c5fffec6b39e3a6a39efa00d871c2322aff01e2f06d42e165e95863ebb641fe332c434e72308a446b
-
Filesize
4.2MB
MD58b65c04554fdc08623e5a74f8f9b9fd2
SHA12eda34fba02fde8495b70060623c64d8938c82e8
SHA25623e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15
SHA51264d6cda2aef8d337d5561ce59170431bb76ca4a00ff66e7d61f2f77622f0e68ea5f31b7459321b3f161a182d943a0adb7c09c21c3defd70a23a4a00410bf3a86
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec