Malware Analysis Report

2025-08-05 12:18

Sample ID 240419-2n3mjahe38
Target e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3
SHA256 e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3

Threat Level: Known bad

The file e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Checks installed software on the system

Adds Run key to start application

Manipulates WinMonFS driver.

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Launches sc.exe

Program crash

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 22:44

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 22:44

Reported

2024-04-19 22:47

Platform

win11-20240412-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-162 = "Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4392 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4392 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4392 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 1436 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\system32\cmd.exe
PID 2284 wrote to memory of 572 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\system32\cmd.exe
PID 572 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 572 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Conhost.exe
PID 2284 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 1404 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 4920 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2284 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\rss\csrss.exe
PID 2284 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\rss\csrss.exe
PID 2284 wrote to memory of 4876 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\rss\csrss.exe
PID 4876 wrote to memory of 4088 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4876 wrote to memory of 4088 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4876 wrote to memory of 4088 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4876 wrote to memory of 2232 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4876 wrote to memory of 2232 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4876 wrote to memory of 2232 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4876 wrote to memory of 3676 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4876 wrote to memory of 3676 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4876 wrote to memory of 3676 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4876 wrote to memory of 2992 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4876 wrote to memory of 2992 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4644 wrote to memory of 5028 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4644 wrote to memory of 5028 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4644 wrote to memory of 5028 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5028 wrote to memory of 428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5028 wrote to memory of 428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5028 wrote to memory of 428 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe

"C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3444 -ip 3444

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 2568

C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe

"C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4392 -ip 4392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 772

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2284 -ip 2284

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 928

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 5a6c5cd5-fe24-46c6-9eda-c38419eaf6b7.uuid.theupdatetime.org udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server8.theupdatetime.org udp
IT 142.251.27.127:19302 stun3.l.google.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server8.theupdatetime.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
BG 185.82.216.108:443 server8.theupdatetime.org tcp
BG 185.82.216.108:443 server8.theupdatetime.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/4392-1-0x0000000003CE0000-0x00000000040D9000-memory.dmp

memory/4392-2-0x00000000040E0000-0x00000000049CB000-memory.dmp

memory/4392-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3444-4-0x0000000002B20000-0x0000000002B56000-memory.dmp

memory/3444-6-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

memory/3444-7-0x0000000002BE0000-0x0000000002BF0000-memory.dmp

memory/3444-5-0x0000000074D20000-0x00000000754D1000-memory.dmp

memory/3444-8-0x0000000005250000-0x000000000587A000-memory.dmp

memory/3444-9-0x0000000005880000-0x00000000058A2000-memory.dmp

memory/3444-13-0x0000000005990000-0x00000000059F6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uo222u5b.iey.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3444-10-0x0000000005920000-0x0000000005986000-memory.dmp

memory/3444-20-0x0000000005AC0000-0x0000000005E17000-memory.dmp

memory/3444-21-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

memory/3444-22-0x00000000060A0000-0x00000000060EC000-memory.dmp

memory/3444-23-0x0000000006590000-0x00000000065D6000-memory.dmp

memory/3444-24-0x000000007F350000-0x000000007F360000-memory.dmp

memory/3444-26-0x0000000070F90000-0x0000000070FDC000-memory.dmp

memory/3444-37-0x0000000007500000-0x00000000075A4000-memory.dmp

memory/3444-36-0x00000000074E0000-0x00000000074FE000-memory.dmp

memory/3444-27-0x0000000071110000-0x0000000071467000-memory.dmp

memory/3444-25-0x00000000074A0000-0x00000000074D4000-memory.dmp

memory/3444-39-0x0000000007630000-0x000000000764A000-memory.dmp

memory/3444-38-0x0000000007C70000-0x00000000082EA000-memory.dmp

memory/3444-40-0x0000000007670000-0x000000000767A000-memory.dmp

memory/3444-41-0x0000000074D20000-0x00000000754D1000-memory.dmp

memory/4392-43-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2284-44-0x0000000003D10000-0x000000000410F000-memory.dmp

memory/4392-45-0x00000000040E0000-0x00000000049CB000-memory.dmp

memory/2284-46-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1436-47-0x0000000074DC0000-0x0000000075571000-memory.dmp

memory/1436-48-0x0000000004800000-0x0000000004810000-memory.dmp

memory/1436-49-0x0000000004800000-0x0000000004810000-memory.dmp

memory/1436-50-0x0000000005740000-0x0000000005A97000-memory.dmp

memory/1436-59-0x0000000005CD0000-0x0000000005D1C000-memory.dmp

memory/1436-61-0x00000000710A0000-0x00000000710EC000-memory.dmp

memory/1436-62-0x00000000712F0000-0x0000000071647000-memory.dmp

memory/1436-71-0x0000000004800000-0x0000000004810000-memory.dmp

memory/1436-72-0x0000000006E60000-0x0000000006F04000-memory.dmp

memory/1436-60-0x000000007FD30000-0x000000007FD40000-memory.dmp

memory/1436-73-0x0000000007290000-0x0000000007326000-memory.dmp

memory/1436-74-0x00000000071B0000-0x00000000071C1000-memory.dmp

memory/1436-75-0x00000000071F0000-0x00000000071FE000-memory.dmp

memory/1436-77-0x0000000007240000-0x000000000725A000-memory.dmp

memory/1436-76-0x0000000007200000-0x0000000007215000-memory.dmp

memory/1436-78-0x0000000007260000-0x0000000007268000-memory.dmp

memory/1436-81-0x0000000074DC0000-0x0000000075571000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/1404-85-0x0000000004A00000-0x0000000004A10000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 28767577834e9e3e26ad56ebfe7df01a
SHA1 4e6f7788cd540ab1351292028ca7e61558905e93
SHA256 935bb0ba5a3dad2fc5ece3e7e0f6f407fd9c81d46dfedc74c2fd236073204e58
SHA512 b8521491c0868fe89172ece1ca4e2681e0f7218d12e8cf3afe69132b61328da3ddfdff95a5b348dc21b12f4397e7f37bf44aa538123d582f4a7dd60513bfd9e1

memory/1404-94-0x0000000005A00000-0x0000000005D57000-memory.dmp

memory/1404-84-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/1404-83-0x0000000074DC0000-0x0000000075571000-memory.dmp

memory/1404-107-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/1404-98-0x00000000719E0000-0x0000000071D37000-memory.dmp

memory/1404-97-0x00000000710A0000-0x00000000710EC000-memory.dmp

memory/1404-108-0x0000000004A00000-0x0000000004A10000-memory.dmp

memory/1404-96-0x000000007FA20000-0x000000007FA30000-memory.dmp

memory/1404-110-0x0000000074DC0000-0x0000000075571000-memory.dmp

memory/4920-111-0x0000000074DC0000-0x0000000075571000-memory.dmp

memory/4920-112-0x0000000005BE0000-0x0000000005F37000-memory.dmp

memory/2284-121-0x0000000003D10000-0x000000000410F000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5f4f26a2c0960e8e55d43d37ca57c930
SHA1 1457e32ef5afe287c26c23726b63be93af0eec63
SHA256 f7bdb6ee0bd5bca91b2131da402551795ed7915fb25fe28450acf639368606c5
SHA512 62a5b0311517fa2543e2f00c095a4dcc808d6f362d6bde6ce15d276e9d34c30150455e9290fd98bca628928a4325dd75d7796315972d5cca87a0b519fd15bc3e

memory/4920-123-0x0000000002980000-0x0000000002990000-memory.dmp

memory/4920-122-0x0000000002980000-0x0000000002990000-memory.dmp

memory/4920-125-0x00000000710A0000-0x00000000710EC000-memory.dmp

memory/4920-136-0x000000007F570000-0x000000007F580000-memory.dmp

memory/2284-127-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4920-126-0x0000000071A50000-0x0000000071DA7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 29f5b3dbfec146e667a0706d36251069
SHA1 a062eb876d339b850714792eed620c53354daeab
SHA256 e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3
SHA512 887243d23c42d45a7620587c76359121e0f8a99169b66d4e14eb7c68b70c14866ffae0d713fcb4ee6a7fc8cf3f2baad9b8bef0345dcdddb236ec574fdcdebbf3

memory/2284-146-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 17e7c02be6d9f2c77693cb71dae32de7
SHA1 7cd26b2b8e3c6287a03d33c92d6eba6aa2f25b1d
SHA256 feb53bdd6a3c0082fbe923de25f5f1f57360f59a33b12ad50d2bc2a5057c0572
SHA512 d11fed25aef97546451391f5fb34eaca0e8794723779f46c07f4f89c9e023d8b1206744714ecade7406d425babda577cc197d15825c2eaef7efb3245829a5d84

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 357a0532b80c7370bc61da68bb85958f
SHA1 d34c6f7236d25a3fad02ac59c937bd3b94dbcba3
SHA256 2338e208276275a591c41852e7dfac29093eb34d65764824d3ffa1614105c92f
SHA512 9095c8279d2158dbbd8b38f2389f41b9724d726096e7f030a22bf77dc948f2d47ecdb48023fe4093643902063d5359886fe3cf1a667bc796bfe84ccfa735e347

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a40c8ac4250a2a656e6190582bb31dd5
SHA1 83eea589dbabdcea073fdfac8dc61cb9417cc1c9
SHA256 bd0d64f60589b9b4c9aa64fd9a0e16dde6085b6bc26d43a1e73872a105e4a662
SHA512 9909f20f5f85765eb56a08540773b4c746b5df113da6c47d8fdf98c5d58cf2f6104a2b8e93fa90db4d19ac45eeabc5bae093f4913fdb25a591a7bd9db0b9cfbb

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4876-241-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4644-249-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4876-250-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4876-251-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2988-252-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4876-254-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2988-255-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4876-256-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4876-258-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4876-259-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4876-261-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4876-264-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4876-266-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4876-268-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4876-269-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4876-272-0x0000000000400000-0x0000000001E06000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 22:44

Reported

2024-04-19 22:47

Platform

win10v2004-20240412-en

Max time kernel

150s

Max time network

137s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2842 = "Saratov Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3716 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3716 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3716 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1976 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1976 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1976 wrote to memory of 4884 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1976 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\system32\cmd.exe
PID 1976 wrote to memory of 2332 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\system32\cmd.exe
PID 2332 wrote to memory of 1268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2332 wrote to memory of 1268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1976 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1976 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1976 wrote to memory of 5016 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1976 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1976 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1976 wrote to memory of 3200 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1976 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\rss\csrss.exe
PID 1976 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\rss\csrss.exe
PID 1976 wrote to memory of 4376 N/A C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe C:\Windows\rss\csrss.exe
PID 4376 wrote to memory of 2368 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 2368 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 2368 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 1620 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 1620 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 1620 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 4616 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 4616 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 4616 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4376 wrote to memory of 1892 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4376 wrote to memory of 1892 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 5056 wrote to memory of 2084 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 2084 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5056 wrote to memory of 2084 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2084 wrote to memory of 1804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2084 wrote to memory of 1804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2084 wrote to memory of 1804 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe

"C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe

"C:\Users\Admin\AppData\Local\Temp\e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 198.32.209.4.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 01386195-585e-4555-9dd5-c9e41d385ff7.uuid.theupdatetime.org udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 stun1.l.google.com udp
US 8.8.8.8:53 server5.theupdatetime.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
BE 172.253.120.127:19302 stun1.l.google.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server5.theupdatetime.org tcp
US 8.8.8.8:53 127.120.253.172.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 217.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
BG 185.82.216.108:443 server5.theupdatetime.org tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/3716-1-0x0000000003D10000-0x0000000004118000-memory.dmp

memory/3716-2-0x0000000004120000-0x0000000004A0B000-memory.dmp

memory/3716-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2980-4-0x0000000002960000-0x0000000002996000-memory.dmp

memory/2980-5-0x0000000074A30000-0x00000000751E0000-memory.dmp

memory/2980-6-0x0000000002A40000-0x0000000002A50000-memory.dmp

memory/2980-7-0x0000000002A40000-0x0000000002A50000-memory.dmp

memory/2980-8-0x00000000050D0000-0x00000000056F8000-memory.dmp

memory/2980-9-0x0000000005050000-0x0000000005072000-memory.dmp

memory/2980-10-0x0000000005770000-0x00000000057D6000-memory.dmp

memory/2980-11-0x00000000058D0000-0x0000000005936000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xghefw2y.iji.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2980-17-0x0000000005940000-0x0000000005C94000-memory.dmp

memory/2980-22-0x0000000005F30000-0x0000000005F4E000-memory.dmp

memory/2980-23-0x0000000005FB0000-0x0000000005FFC000-memory.dmp

memory/2980-24-0x0000000006480000-0x00000000064C4000-memory.dmp

memory/2980-25-0x0000000007230000-0x00000000072A6000-memory.dmp

memory/2980-26-0x0000000007930000-0x0000000007FAA000-memory.dmp

memory/2980-27-0x00000000072D0000-0x00000000072EA000-memory.dmp

memory/2980-28-0x000000007F6C0000-0x000000007F6D0000-memory.dmp

memory/2980-29-0x0000000007490000-0x00000000074C2000-memory.dmp

memory/2980-30-0x00000000708D0000-0x000000007091C000-memory.dmp

memory/2980-31-0x0000000070FD0000-0x0000000071324000-memory.dmp

memory/2980-42-0x0000000002A40000-0x0000000002A50000-memory.dmp

memory/2980-41-0x00000000074D0000-0x00000000074EE000-memory.dmp

memory/2980-44-0x00000000074F0000-0x0000000007593000-memory.dmp

memory/2980-43-0x0000000002A40000-0x0000000002A50000-memory.dmp

memory/2980-45-0x00000000075E0000-0x00000000075EA000-memory.dmp

memory/2980-46-0x00000000076F0000-0x0000000007786000-memory.dmp

memory/2980-47-0x00000000075F0000-0x0000000007601000-memory.dmp

memory/2980-48-0x0000000007630000-0x000000000763E000-memory.dmp

memory/2980-49-0x0000000007650000-0x0000000007664000-memory.dmp

memory/2980-50-0x0000000007690000-0x00000000076AA000-memory.dmp

memory/2980-51-0x0000000007680000-0x0000000007688000-memory.dmp

memory/2980-54-0x0000000074A30000-0x00000000751E0000-memory.dmp

memory/3716-55-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1976-57-0x0000000003B80000-0x0000000003F87000-memory.dmp

memory/1976-58-0x0000000003F90000-0x000000000487B000-memory.dmp

memory/3716-59-0x0000000004120000-0x0000000004A0B000-memory.dmp

memory/1976-60-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4884-61-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/4884-62-0x0000000002550000-0x0000000002560000-memory.dmp

memory/4884-63-0x0000000002550000-0x0000000002560000-memory.dmp

memory/4884-69-0x0000000005860000-0x0000000005BB4000-memory.dmp

memory/4884-74-0x0000000005E70000-0x0000000005EBC000-memory.dmp

memory/4884-75-0x000000007FA80000-0x000000007FA90000-memory.dmp

memory/4884-76-0x00000000709D0000-0x0000000070A1C000-memory.dmp

memory/4884-77-0x0000000071170000-0x00000000714C4000-memory.dmp

memory/4884-88-0x0000000002550000-0x0000000002560000-memory.dmp

memory/4884-87-0x0000000007090000-0x0000000007133000-memory.dmp

memory/4884-89-0x0000000002550000-0x0000000002560000-memory.dmp

memory/4884-90-0x0000000007390000-0x00000000073A1000-memory.dmp

memory/4884-91-0x00000000073E0000-0x00000000073F4000-memory.dmp

memory/4884-94-0x0000000074AD0000-0x0000000075280000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/5016-96-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/5016-97-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/5016-98-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/5016-108-0x0000000006130000-0x0000000006484000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1628b78d4ef8131efe3089aaefda5c74
SHA1 3d74911d0535a641667448eeb20aea38987425ec
SHA256 a0aaed0dcb0a8e0e569e6b626bc29211143b16d476e9c51920ea635a9865448d
SHA512 eb2a8beb4eb2f4a733daca4427b5a477bbd18c5edf8750e77a718c02ac338fee35613dfb82f7dfe77bbc8ceeef85e3159abb4bbd6cf7eba4e55d94865946d848

memory/5016-111-0x0000000070B50000-0x0000000070EA4000-memory.dmp

memory/5016-110-0x00000000709D0000-0x0000000070A1C000-memory.dmp

memory/1976-121-0x0000000003B80000-0x0000000003F87000-memory.dmp

memory/5016-123-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/3200-124-0x0000000074AD0000-0x0000000075280000-memory.dmp

memory/1976-134-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5a7e235cacb452fdeff6611b93a1c170
SHA1 b2e7dd75fc0202ffce79d9ccf4de6dcb4edc1b82
SHA256 aa8af4e5951af03422ebd20d140fe3782c1629767eaf65c4dcec962fdc4e359f
SHA512 001e369dfb3abaf447a47297b2a2bb67ff61a5dabf40a3959f769e8ee4f146ddf647fd21b19f611d145a2ae6111d90256af3655fb471e87c172fce58065aaa7a

memory/3200-136-0x000000007F7E0000-0x000000007F7F0000-memory.dmp

memory/3200-137-0x00000000709D0000-0x0000000070A1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 29f5b3dbfec146e667a0706d36251069
SHA1 a062eb876d339b850714792eed620c53354daeab
SHA256 e8f8d26d2f48ed0cf31d557901ca3c27c304e6364649f4daec2dcc7e796a46b3
SHA512 887243d23c42d45a7620587c76359121e0f8a99169b66d4e14eb7c68b70c14866ffae0d713fcb4ee6a7fc8cf3f2baad9b8bef0345dcdddb236ec574fdcdebbf3

memory/1976-155-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e8f0c1f1e2ae8f605a29ace26834df0e
SHA1 93dec7bdb5edc9fbc1021be25614dda810b69456
SHA256 8871b4389561cbed4e7a9d9eb121c91b17a6c9228103f3368215cc69b870c8fc
SHA512 b698ad80192f99f321ba55ba1afeb359bdab66171b765dc7f00baa805686ea80cd57777ff596f51d1cc20afdf93a61f829bc83516126aacac2edbdb4b968a319

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3f5eba9552bfb64bb7225e1a35d43aba
SHA1 b03996075d17083b77fec832ea739975e9526d0b
SHA256 0e4d1066a85317e40ca5cce8e6bd2f168322b2740e80a020a4d8eb110abc5fdb
SHA512 87c1b7649e5d0e293210bcf78fd7f8e6db6e19fb838d6cdcc35e825080e9d7a5c9ad65ae504d82dc7aa682359c567b6a6fc964362a228af3abc8540d5973c055

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0ec1cfab713067243532b9b8e0955ab5
SHA1 dd374067999fe89674af806937accf766e8bad0a
SHA256 8de79ae3097c5b89236dab639d7048b02e1575c450cd1e9dc4d4fbecc103f83f
SHA512 429a37315a5458e00cd037df1527bec1cecdc9eaca76c5a99307b9b97c4f1720e73818ebff6ba881981f4854f0e8165d829b6e4bf6f5594e31787e08e5d87932

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4376-258-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/5056-266-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4376-267-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4644-268-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4376-269-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4376-271-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4644-272-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4376-273-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4376-275-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4376-277-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4644-278-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4376-279-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4376-281-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4376-283-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4376-285-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4376-287-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4376-289-0x0000000000400000-0x0000000001E06000-memory.dmp