Malware Analysis Report

2025-08-05 12:18

Sample ID 240419-2ndy6sad2w
Target b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398
SHA256 b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398

Threat Level: Known bad

The file b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Checks installed software on the system

Adds Run key to start application

Manipulates WinMonFS driver.

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Drops file in Windows directory

Program crash

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 22:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 22:43

Reported

2024-04-19 22:45

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5028 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5028 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5028 wrote to memory of 4364 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 4944 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\system32\cmd.exe
PID 4824 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\system32\cmd.exe
PID 4216 wrote to memory of 4764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4216 wrote to memory of 4764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4824 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4824 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\rss\csrss.exe
PID 4824 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\rss\csrss.exe
PID 4824 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\rss\csrss.exe
PID 2352 wrote to memory of 3016 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2352 wrote to memory of 3016 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2352 wrote to memory of 3016 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2352 wrote to memory of 4776 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2352 wrote to memory of 4776 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2352 wrote to memory of 4776 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2352 wrote to memory of 1148 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2352 wrote to memory of 1148 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2352 wrote to memory of 1148 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2352 wrote to memory of 1876 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2352 wrote to memory of 1876 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 456 wrote to memory of 2908 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 456 wrote to memory of 2908 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 456 wrote to memory of 2908 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2908 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2908 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2908 wrote to memory of 4984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe

"C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe

"C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4824 -ip 4824

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 852

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 67.32.209.4.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 0ce4cdc9-5e0f-472a-8dff-8e4173795c11.uuid.dumperstats.org udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 stun1.l.google.com udp
US 8.8.8.8:53 server2.dumperstats.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BE 172.253.120.127:19302 stun1.l.google.com udp
BG 185.82.216.111:443 server2.dumperstats.org tcp
US 8.8.8.8:53 127.120.253.172.in-addr.arpa udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
BG 185.82.216.111:443 server2.dumperstats.org tcp
US 8.8.8.8:53 48.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
BG 185.82.216.111:443 server2.dumperstats.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
N/A 127.0.0.1:31465 tcp

Files

memory/5028-1-0x0000000003C90000-0x0000000004094000-memory.dmp

memory/5028-2-0x00000000040A0000-0x000000000498B000-memory.dmp

memory/5028-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4364-4-0x0000000002FF0000-0x0000000003026000-memory.dmp

memory/4364-5-0x0000000074C80000-0x0000000075430000-memory.dmp

memory/4364-6-0x00000000030F0000-0x0000000003100000-memory.dmp

memory/4364-7-0x00000000030F0000-0x0000000003100000-memory.dmp

memory/4364-8-0x0000000005740000-0x0000000005D68000-memory.dmp

memory/4364-9-0x0000000005D70000-0x0000000005D92000-memory.dmp

memory/4364-10-0x0000000005ED0000-0x0000000005F36000-memory.dmp

memory/4364-11-0x0000000005FB0000-0x0000000006016000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3qjev0pa.jgl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4364-21-0x0000000006020000-0x0000000006374000-memory.dmp

memory/4364-22-0x00000000065E0000-0x00000000065FE000-memory.dmp

memory/4364-23-0x0000000006630000-0x000000000667C000-memory.dmp

memory/4364-24-0x0000000006A00000-0x0000000006A44000-memory.dmp

memory/4364-25-0x0000000007900000-0x0000000007976000-memory.dmp

memory/4364-27-0x00000000079A0000-0x00000000079BA000-memory.dmp

memory/4364-26-0x0000000008000000-0x000000000867A000-memory.dmp

memory/4364-28-0x000000007EEE0000-0x000000007EEF0000-memory.dmp

memory/4364-29-0x0000000007B60000-0x0000000007B92000-memory.dmp

memory/4364-30-0x0000000070B20000-0x0000000070B6C000-memory.dmp

memory/4364-31-0x0000000070CA0000-0x0000000070FF4000-memory.dmp

memory/4364-42-0x00000000030F0000-0x0000000003100000-memory.dmp

memory/4364-41-0x0000000007BA0000-0x0000000007BBE000-memory.dmp

memory/4364-43-0x0000000007BC0000-0x0000000007C63000-memory.dmp

memory/4364-44-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

memory/4364-45-0x00000000030F0000-0x0000000003100000-memory.dmp

memory/4364-46-0x0000000007DC0000-0x0000000007E56000-memory.dmp

memory/4364-47-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

memory/4364-48-0x0000000007D00000-0x0000000007D0E000-memory.dmp

memory/4364-49-0x0000000007D20000-0x0000000007D34000-memory.dmp

memory/4364-50-0x0000000007D70000-0x0000000007D8A000-memory.dmp

memory/4364-51-0x0000000007D60000-0x0000000007D68000-memory.dmp

memory/4364-54-0x0000000074C80000-0x0000000075430000-memory.dmp

memory/5028-55-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4824-57-0x0000000003990000-0x0000000003D97000-memory.dmp

memory/5028-58-0x00000000040A0000-0x000000000498B000-memory.dmp

memory/4824-59-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4944-60-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/4944-61-0x0000000005460000-0x0000000005470000-memory.dmp

memory/4944-64-0x00000000063A0000-0x00000000066F4000-memory.dmp

memory/4944-63-0x0000000005460000-0x0000000005470000-memory.dmp

memory/4944-73-0x0000000006A10000-0x0000000006A5C000-memory.dmp

memory/4944-76-0x00000000713C0000-0x0000000071714000-memory.dmp

memory/4944-75-0x0000000070C20000-0x0000000070C6C000-memory.dmp

memory/4944-74-0x000000007F5F0000-0x000000007F600000-memory.dmp

memory/4944-87-0x0000000007BC0000-0x0000000007C63000-memory.dmp

memory/4944-86-0x0000000005460000-0x0000000005470000-memory.dmp

memory/4944-88-0x0000000007ED0000-0x0000000007EE1000-memory.dmp

memory/4944-89-0x0000000007F20000-0x0000000007F34000-memory.dmp

memory/4944-92-0x0000000074D20000-0x00000000754D0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4356-95-0x00000000054E0000-0x00000000054F0000-memory.dmp

memory/4356-96-0x00000000054E0000-0x00000000054F0000-memory.dmp

memory/4356-94-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/4356-106-0x0000000006430000-0x0000000006784000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c7b91bdf8baf65722cf45c467c1ce656
SHA1 42c11181e65335b59e40f9ae693d7f3900da8719
SHA256 09a4d8b8d7a945fe74cd9e479d7cfab29ae55e92d7a7ef2788353dd26e20a310
SHA512 1f18b29385cddc0c136cfec8a75c38a551ab6dce01dadc7d35ef6169768335e332e28d2b1abaf759436ec7748825c821f8febc91f3e194cd8f874480ac594b45

memory/4356-109-0x0000000070C20000-0x0000000070C6C000-memory.dmp

memory/4356-121-0x00000000054E0000-0x00000000054F0000-memory.dmp

memory/4356-122-0x00000000054E0000-0x00000000054F0000-memory.dmp

memory/4824-120-0x0000000003990000-0x0000000003D97000-memory.dmp

memory/4356-110-0x0000000070DA0000-0x00000000710F4000-memory.dmp

memory/4356-108-0x000000007F7A0000-0x000000007F7B0000-memory.dmp

memory/4356-124-0x0000000074D20000-0x00000000754D0000-memory.dmp

memory/5036-125-0x0000000074D20000-0x00000000754D0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 345c9bcd04df13140cfc28f31ad1f0e8
SHA1 033e8445d066f934bde527b39ebfa9ea94dcb024
SHA256 02a24f52276f6562c81151ea310bd5814c471dedd1cf8d80cf2196c8cbeef6f1
SHA512 84e59565ef2863fb5d2accb325cee8f12d779f3a8b80ce82aa1292c7b003e85d71df7c5c81668c579a35343bba3cd375f1a77c6e42f26825e79958ae53a51d85

memory/5036-136-0x0000000002FA0000-0x0000000002FB0000-memory.dmp

memory/4824-135-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 26e6411d7a0c48c6eeb8c754597c3780
SHA1 5054f7863baed1540d99353fb7574fbbaed8ebb6
SHA256 b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398
SHA512 720324576e066820aead1cc2d40348701ad58e69789757c82452cbb5b898f4b037dc1d1f17ac88fb8e1c86e5f74d4ef3dd15178a9ce8d2ecd5e06f232edde157

memory/4824-160-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6564fb34fb9772657fd995c168b0acea
SHA1 c2398e62c0014ff7673fa81acb185568595550d4
SHA256 2fad9eac8c67b5253f7181042e82517803be4451d2303d8c559709e87e5d40c1
SHA512 882a4e705781a643483566e5e359e5ecdc547f8276e26972bab35bbb760cddbdfa13bd27469f680f766fc7f36d65e1c7258ce18aa4a6e865aeed44bc5d4a0b4c

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1ce975c68b61f63f22bad79213b653ae
SHA1 f7bf4e26aedbe9741a3dfebd0910d5ee272c6a96
SHA256 f60dac86dcb6eb927a5b83d25123353b20bf6b17401b24a42e4c302c61204f1d
SHA512 4fe13e0988e6e14d10a464dd42d2c9c75a108d1ae10470d539874d75d596895d8fca13abe33074e243b37851fe9a0c52737d39a32bcfb0ef7e8e719677d6ae96

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 866b7aef5a5360e0a392827fb359dfc6
SHA1 8b7a28a980959f6cf2130714045a63099c7636b1
SHA256 fe9b279d1346db0933ba6bac8d5a834c876eac49f1e01ec1c3717b8c9ce20d0e
SHA512 b00e7681d992adcc80c5dd79fc7a9ef3e3f15ce2b3d61352ec405d28dc67fcb460ad4e45877e1a4438aea99ab9627b1e8dd1607e7da8a9de60e08ab2c27f3f03

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2352-262-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/456-270-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2352-271-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2352-272-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2964-273-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2352-274-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2352-276-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2964-277-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2352-279-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2352-281-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2352-282-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2352-284-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2352-286-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2352-289-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2352-291-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2352-292-0x0000000000400000-0x0000000001E06000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 22:43

Reported

2024-04-19 22:45

Platform

win11-20240412-en

Max time kernel

150s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3328 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3328 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3328 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 352 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 352 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 352 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\system32\cmd.exe
PID 4320 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\system32\cmd.exe
PID 3780 wrote to memory of 1688 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3780 wrote to memory of 1688 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4320 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\rss\csrss.exe
PID 4320 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\rss\csrss.exe
PID 4320 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe C:\Windows\rss\csrss.exe
PID 2412 wrote to memory of 228 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2412 wrote to memory of 228 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2412 wrote to memory of 228 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2412 wrote to memory of 4764 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2412 wrote to memory of 4764 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2412 wrote to memory of 4764 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2412 wrote to memory of 2844 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2412 wrote to memory of 2844 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2412 wrote to memory of 2844 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2412 wrote to memory of 812 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2412 wrote to memory of 812 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3708 wrote to memory of 2292 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 2292 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 2292 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2292 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2292 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2292 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe

"C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe

"C:\Users\Admin\AppData\Local\Temp\b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4320 -ip 4320

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 888

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 beaab984-5c3b-40cb-b503-275968307542.uuid.dumperstats.org udp
US 8.8.8.8:53 server13.dumperstats.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
DE 81.3.27.44:3478 stun.ipfire.org udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server13.dumperstats.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
BG 185.82.216.111:443 server13.dumperstats.org tcp
BG 185.82.216.111:443 server13.dumperstats.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/3328-1-0x0000000003D10000-0x000000000410F000-memory.dmp

memory/3328-2-0x0000000004110000-0x00000000049FB000-memory.dmp

memory/3328-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3216-4-0x0000000003240000-0x0000000003276000-memory.dmp

memory/3216-5-0x0000000074400000-0x0000000074BB1000-memory.dmp

memory/3216-6-0x0000000003320000-0x0000000003330000-memory.dmp

memory/3216-8-0x00000000059D0000-0x0000000005FFA000-memory.dmp

memory/3216-7-0x0000000003320000-0x0000000003330000-memory.dmp

memory/3216-9-0x0000000005800000-0x0000000005822000-memory.dmp

memory/3216-10-0x0000000006000000-0x0000000006066000-memory.dmp

memory/3216-11-0x0000000006070000-0x00000000060D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bviaa1if.zcl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3216-20-0x00000000061A0000-0x00000000064F7000-memory.dmp

memory/3216-21-0x00000000066D0000-0x00000000066EE000-memory.dmp

memory/3216-22-0x0000000006710000-0x000000000675C000-memory.dmp

memory/3216-23-0x0000000006C70000-0x0000000006CB6000-memory.dmp

memory/3216-26-0x0000000070670000-0x00000000706BC000-memory.dmp

memory/3216-36-0x0000000007B40000-0x0000000007B5E000-memory.dmp

memory/3216-27-0x00000000707F0000-0x0000000070B47000-memory.dmp

memory/3216-38-0x0000000003320000-0x0000000003330000-memory.dmp

memory/3216-37-0x0000000007B60000-0x0000000007C04000-memory.dmp

memory/3216-25-0x0000000007B00000-0x0000000007B34000-memory.dmp

memory/3216-24-0x000000007F420000-0x000000007F430000-memory.dmp

memory/3216-39-0x00000000082D0000-0x000000000894A000-memory.dmp

memory/3216-40-0x0000000007C80000-0x0000000007C9A000-memory.dmp

memory/3216-41-0x0000000007CC0000-0x0000000007CCA000-memory.dmp

memory/3216-42-0x0000000007DD0000-0x0000000007E66000-memory.dmp

memory/3216-43-0x0000000007CF0000-0x0000000007D01000-memory.dmp

memory/3216-44-0x0000000007D30000-0x0000000007D3E000-memory.dmp

memory/3216-45-0x0000000007D40000-0x0000000007D55000-memory.dmp

memory/3216-46-0x0000000007D90000-0x0000000007DAA000-memory.dmp

memory/3216-47-0x0000000007DB0000-0x0000000007DB8000-memory.dmp

memory/3216-50-0x0000000074400000-0x0000000074BB1000-memory.dmp

memory/3328-51-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4320-53-0x0000000003C50000-0x000000000404B000-memory.dmp

memory/4320-55-0x0000000004050000-0x000000000493B000-memory.dmp

memory/3328-54-0x0000000004110000-0x00000000049FB000-memory.dmp

memory/4320-56-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/352-59-0x00000000047E0000-0x00000000047F0000-memory.dmp

memory/352-58-0x00000000047E0000-0x00000000047F0000-memory.dmp

memory/352-57-0x0000000074490000-0x0000000074C41000-memory.dmp

memory/352-68-0x00000000058B0000-0x0000000005C07000-memory.dmp

memory/352-69-0x0000000005D10000-0x0000000005D5C000-memory.dmp

memory/352-70-0x0000000070780000-0x00000000707CC000-memory.dmp

memory/352-71-0x0000000070900000-0x0000000070C57000-memory.dmp

memory/352-81-0x0000000006CA0000-0x0000000006D44000-memory.dmp

memory/352-80-0x00000000047E0000-0x00000000047F0000-memory.dmp

memory/352-82-0x0000000007200000-0x0000000007211000-memory.dmp

memory/352-83-0x0000000007250000-0x0000000007265000-memory.dmp

memory/352-86-0x0000000074490000-0x0000000074C41000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/4780-89-0x0000000004C90000-0x0000000004CA0000-memory.dmp

memory/4780-90-0x0000000004C90000-0x0000000004CA0000-memory.dmp

memory/4780-88-0x0000000074490000-0x0000000074C41000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f577d75d5d6d17d337f8c5d923ba36e6
SHA1 1a2ed7ca1ab7e67f19ed35d941059a99bb873a5d
SHA256 2349d822e73dc5160e5300cc574dd685d2be38c4ee90c3c0001ec0e6edb5b7bb
SHA512 706a859c41582a4546e233913bf788407935b997bd6839f9546fa413c27b35115c390c9d27bcbed4837831d5423349a4515f473976d709295835637422853b4e

memory/4780-101-0x0000000070780000-0x00000000707CC000-memory.dmp

memory/4320-100-0x0000000003C50000-0x000000000404B000-memory.dmp

memory/4780-103-0x000000007F440000-0x000000007F450000-memory.dmp

memory/4780-112-0x0000000004C90000-0x0000000004CA0000-memory.dmp

memory/4780-102-0x0000000070900000-0x0000000070C57000-memory.dmp

memory/4780-114-0x0000000074490000-0x0000000074C41000-memory.dmp

memory/2572-117-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

memory/2572-116-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

memory/2572-118-0x0000000005070000-0x00000000053C7000-memory.dmp

memory/2572-115-0x0000000074490000-0x0000000074C41000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5e012300b5539d2ed62130d847f93bb5
SHA1 e34c6e217ea29d279a57e50431f8607739ea1ef5
SHA256 c239be39f5959f118b134d49a21f4a5913544be174112f11ecdda87d7cd176b5
SHA512 a3ba132d4d361d775b2371ecea1ca380482268591c88b1d48a220f9715b8ad9b589145239819f4114f31935f8c6664bf8221a469249a01b0a424a41393d0d356

memory/4320-127-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2572-130-0x0000000070780000-0x00000000707CC000-memory.dmp

memory/2572-129-0x000000007F4C0000-0x000000007F4D0000-memory.dmp

memory/4320-148-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 26e6411d7a0c48c6eeb8c754597c3780
SHA1 5054f7863baed1540d99353fb7574fbbaed8ebb6
SHA256 b10c0352ab3e69f051e9f625d1f274d32e77b16646730d81daef21b5e96d1398
SHA512 720324576e066820aead1cc2d40348701ad58e69789757c82452cbb5b898f4b037dc1d1f17ac88fb8e1c86e5f74d4ef3dd15178a9ce8d2ecd5e06f232edde157

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d03ce5f3d21cdeb2222712b69052a350
SHA1 85ffcc73ced81b20571a9be26789c09f3911a213
SHA256 18e9709b1aa3d70bc4f38bfcf4e4c71ea203a47930c7f25533bef8db55911c75
SHA512 d034df2c73c5ec0475c77cf961638f2c8ca475ec50545cbd4a910589cf677285f8591885dc0d17300742584a076eef0922e571837a2e64f1b5cb6e24005e42b1

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6fb7369de513bafcc1c15be1212e94a5
SHA1 b5e4db4c64cfbec3aed0df857fda5791e507bf1d
SHA256 75f732468ea9c192213e8ce5c4ff33f07d2589f5a7715a0642097e57f2267b80
SHA512 c6f0826fcbff3a691c1b9d52c691d327277d69d09a14fd2c75ee51402470c0bce68122ec220cf8595316322c28e4713d0b0d4c6dfdbd6c4cf06009e0980d6116

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c1ac01793bf614755dba5423eafb4a67
SHA1 23d6a299bad96d8e0436960389ec9fb1d2a81c3f
SHA256 1318fa520c69e63253d8384821b97c944414951dd83524f6b3b6ee51be84e595
SHA512 62d9a4fe573c34a7cca69ba9591ca499feb36bdb67d7193c827da6c098ce4d0daf5fb8a9984aa4c852d5b37619c3097d59bb6f6695dcb1fccaf5e37eb171bb0b

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2412-245-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3708-252-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2412-254-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4080-255-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2412-256-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2412-258-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4080-259-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2412-260-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2412-262-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2412-263-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2412-266-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2412-268-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2412-270-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2412-272-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2412-273-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2412-276-0x0000000000400000-0x0000000001E06000-memory.dmp