Analysis
-
max time kernel
157s -
max time network
164s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/04/2024, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe
Resource
win10v2004-20240226-en
General
-
Target
23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe
-
Size
4.2MB
-
MD5
8b65c04554fdc08623e5a74f8f9b9fd2
-
SHA1
2eda34fba02fde8495b70060623c64d8938c82e8
-
SHA256
23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15
-
SHA512
64d6cda2aef8d337d5561ce59170431bb76ca4a00ff66e7d61f2f77622f0e68ea5f31b7459321b3f161a182d943a0adb7c09c21c3defd70a23a4a00410bf3a86
-
SSDEEP
98304:mRe06RCZ8qdKnAdKFoI0tkW+Km95muXXLdVYjOy3P9UZ:rUuqUAddtM55murAiy9I
Malware Config
Signatures
-
Glupteba payload 16 IoCs
resource yara_rule behavioral2/memory/5036-2-0x0000000005160000-0x0000000005A4B000-memory.dmp family_glupteba behavioral2/memory/5036-3-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/5036-23-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/5036-52-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/5036-53-0x0000000005160000-0x0000000005A4B000-memory.dmp family_glupteba behavioral2/memory/404-55-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/404-87-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/404-123-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/404-145-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2780-181-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2780-240-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2780-247-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2780-252-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2780-254-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2780-256-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2780-258-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4284 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 2780 csrss.exe 3176 injector.exe 2704 windefender.exe 3100 windefender.exe -
resource yara_rule behavioral2/files/0x000200000002aa37-246.dat upx behavioral2/memory/2704-251-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3100-253-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3100-257-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4041115548-3858121278-1660933110-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\S-1-5-21-4041115548-3858121278-1660933110-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe File created C:\Windows\rss\csrss.exe 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 244 sc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5084 5036 WerFault.exe 78 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3420 schtasks.exe 1824 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3208 powershell.exe 3208 powershell.exe 5036 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 5036 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 4864 powershell.exe 4864 powershell.exe 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 4352 powershell.exe 4352 powershell.exe 4104 powershell.exe 4104 powershell.exe 2524 powershell.exe 2524 powershell.exe 1592 powershell.exe 1592 powershell.exe 900 powershell.exe 900 powershell.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 2780 csrss.exe 2780 csrss.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 2780 csrss.exe 2780 csrss.exe 3176 injector.exe 3176 injector.exe 2780 csrss.exe 2780 csrss.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe 3176 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3208 powershell.exe Token: SeDebugPrivilege 5036 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Token: SeImpersonatePrivilege 5036 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe Token: SeDebugPrivilege 4864 powershell.exe Token: SeDebugPrivilege 4352 powershell.exe Token: SeDebugPrivilege 4104 powershell.exe Token: SeDebugPrivilege 2524 powershell.exe Token: SeDebugPrivilege 1592 powershell.exe Token: SeDebugPrivilege 900 powershell.exe Token: SeSystemEnvironmentPrivilege 2780 csrss.exe Token: SeSecurityPrivilege 244 sc.exe Token: SeSecurityPrivilege 244 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 5036 wrote to memory of 3208 5036 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 81 PID 5036 wrote to memory of 3208 5036 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 81 PID 5036 wrote to memory of 3208 5036 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 81 PID 404 wrote to memory of 4864 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 95 PID 404 wrote to memory of 4864 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 95 PID 404 wrote to memory of 4864 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 95 PID 404 wrote to memory of 3764 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 97 PID 404 wrote to memory of 3764 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 97 PID 3764 wrote to memory of 4284 3764 cmd.exe 99 PID 3764 wrote to memory of 4284 3764 cmd.exe 99 PID 404 wrote to memory of 4352 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 101 PID 404 wrote to memory of 4352 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 101 PID 404 wrote to memory of 4352 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 101 PID 404 wrote to memory of 4104 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 103 PID 404 wrote to memory of 4104 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 103 PID 404 wrote to memory of 4104 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 103 PID 404 wrote to memory of 2780 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 105 PID 404 wrote to memory of 2780 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 105 PID 404 wrote to memory of 2780 404 23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe 105 PID 2780 wrote to memory of 2524 2780 csrss.exe 106 PID 2780 wrote to memory of 2524 2780 csrss.exe 106 PID 2780 wrote to memory of 2524 2780 csrss.exe 106 PID 2780 wrote to memory of 1592 2780 csrss.exe 113 PID 2780 wrote to memory of 1592 2780 csrss.exe 113 PID 2780 wrote to memory of 1592 2780 csrss.exe 113 PID 2780 wrote to memory of 900 2780 csrss.exe 115 PID 2780 wrote to memory of 900 2780 csrss.exe 115 PID 2780 wrote to memory of 900 2780 csrss.exe 115 PID 2780 wrote to memory of 3176 2780 csrss.exe 117 PID 2780 wrote to memory of 3176 2780 csrss.exe 117 PID 2704 wrote to memory of 3084 2704 windefender.exe 123 PID 2704 wrote to memory of 3084 2704 windefender.exe 123 PID 2704 wrote to memory of 3084 2704 windefender.exe 123 PID 3084 wrote to memory of 244 3084 cmd.exe 124 PID 3084 wrote to memory of 244 3084 cmd.exe 124 PID 3084 wrote to memory of 244 3084 cmd.exe 124 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe"C:\Users\Admin\AppData\Local\Temp\23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3208
-
-
C:\Users\Admin\AppData\Local\Temp\23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe"C:\Users\Admin\AppData\Local\Temp\23e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4284
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4352
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3420
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:996
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3176
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1824
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:244
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 6722⤵
- Program crash
PID:5084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5036 -ip 50361⤵PID:3976
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3100
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a24447ba16beeb6bae6e024c9d7df2d9
SHA16409a61a7bdd1772be96dfca5eda5ca24ef39ff4
SHA2560bc01089a524a542922a8ef4b5d14104a980ba9d06b9e385c26a965eab999371
SHA5120568dd25d6dd24ac1d93ed54577210025296d2f93516d7519e64918f1c054f0bf34edd5ad8d422fac7747a40a9115092a8a28252280f5205019395b2672f370e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5adcecb1b7161c88df2d59085077733f2
SHA176b75d1a05610dfd6871ba7ba8bee9bc3f99ab31
SHA256576c1cb77711bb627b8b06a3f4000a5b4ab4b77d0655709fb71b592a3ad16e59
SHA5127b99c21437a3f471f5f6273bdb9130b04d69ba0a608a669649010124f1edd9dec93b937aed9010a40faeb90f3842e922581088d0cb6cf8dc36b83c460e7147be
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a67ef0f6238a3d6e0bd4cd75e80a932a
SHA19bcb6475811459183867e45412739d49bbd0d2f2
SHA2564611a6f1f876d80de0129d7a62638787cf655a684f42c7165b950615286c98d6
SHA5125c50a66fe05016a3f9d0b19c487b23e46934423efc28e1c829c3476e641269200a6506f3c806a9e3a0b7168455324c2583582139d74377897947f65522c459d9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD552a8487b52362d9e74eebfa2acff52c6
SHA19ea19a79d7dc68fb4fd4b4d9436594b3cd1f49e7
SHA256e5c34d047fe1737f2c95f74664c3e65fb8e73875b7c8ff60e966713349c5accb
SHA5127e42c480f1b003f253e9db596e69a00d575e64d79206f9f4d75c4c56421e01789a0ae6c2e544e84c9b11aeb2e4e0854805383f7f0046b8622093760811d02a59
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5669e20bd2d47f85de65a74cce4971567
SHA1a8b9069164eac595ab364d47574f4c8436d06d4d
SHA2566c2878e1733934059a5822eb4d7bb9beef5ba3a399f609b243ad19a851889378
SHA512d95e57c804fab192c0f784a4fb71c85bdc047906f58bbc2e10d62511243e4f524ce9e992e8a6ef0ecbe86f83a7ce43ec1992e68f0f5577de101047dd1807b5a9
-
Filesize
4.2MB
MD58b65c04554fdc08623e5a74f8f9b9fd2
SHA12eda34fba02fde8495b70060623c64d8938c82e8
SHA25623e9be12f1a03f88ca40ca44e5c9727fa0379c277b2ffc7c54114ec7878f3e15
SHA51264d6cda2aef8d337d5561ce59170431bb76ca4a00ff66e7d61f2f77622f0e68ea5f31b7459321b3f161a182d943a0adb7c09c21c3defd70a23a4a00410bf3a86
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec