Malware Analysis Report

2025-08-06 03:33

Sample ID 240419-tgctjage45
Target dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350
SHA256 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350

Threat Level: Known bad

The file dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Adds Run key to start application

Checks installed software on the system

Manipulates WinMonFS driver.

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 16:01

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 16:01

Reported

2024-04-19 16:03

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2532 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2532 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2532 wrote to memory of 2096 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\system32\cmd.exe
PID 1388 wrote to memory of 3160 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\system32\cmd.exe
PID 3160 wrote to memory of 1980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 1980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1388 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1388 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\rss\csrss.exe
PID 1388 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\rss\csrss.exe
PID 1388 wrote to memory of 1804 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\rss\csrss.exe
PID 1804 wrote to memory of 4504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 4504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 4504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 4316 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 4316 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 4316 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 1044 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 1044 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 1044 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1804 wrote to memory of 3244 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1804 wrote to memory of 3244 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4944 wrote to memory of 4028 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 4028 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4944 wrote to memory of 4028 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4028 wrote to memory of 4536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4028 wrote to memory of 4536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4028 wrote to memory of 4536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe

"C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe

"C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 1774d613-34bf-43f9-8c09-cb0a28643f9e.uuid.dumppage.org udp
US 8.8.8.8:53 stun.stunprotocol.org udp
US 8.8.8.8:53 server1.dumppage.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
BG 185.82.216.111:443 server1.dumppage.org tcp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 43.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
BG 185.82.216.111:443 server1.dumppage.org tcp
US 8.8.8.8:53 159.113.53.23.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 stun.l.google.com udp
US 74.125.250.129:19302 stun.l.google.com udp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
N/A 127.0.0.1:3478 udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
BG 185.82.216.111:443 server1.dumppage.org tcp
US 8.8.8.8:53 249.138.73.23.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
N/A 127.0.0.1:31465 tcp
US 8.8.8.8:53 41.173.79.40.in-addr.arpa udp

Files

memory/2532-1-0x0000000003AF0000-0x0000000003EEF000-memory.dmp

memory/2532-2-0x0000000003EF0000-0x00000000047DB000-memory.dmp

memory/2532-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2096-4-0x0000000002EF0000-0x0000000002F26000-memory.dmp

memory/2096-5-0x0000000074790000-0x0000000074F40000-memory.dmp

memory/2096-6-0x0000000005120000-0x0000000005130000-memory.dmp

memory/2096-7-0x0000000005120000-0x0000000005130000-memory.dmp

memory/2096-8-0x0000000005760000-0x0000000005D88000-memory.dmp

memory/2096-9-0x0000000005500000-0x0000000005522000-memory.dmp

memory/2096-10-0x00000000056A0000-0x0000000005706000-memory.dmp

memory/2096-11-0x0000000005E00000-0x0000000005E66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dsqcmruz.w4h.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2096-21-0x0000000005FB0000-0x0000000006304000-memory.dmp

memory/2096-22-0x00000000064D0000-0x00000000064EE000-memory.dmp

memory/2096-23-0x0000000006510000-0x000000000655C000-memory.dmp

memory/2096-24-0x00000000068C0000-0x0000000006904000-memory.dmp

memory/2096-25-0x0000000007670000-0x00000000076E6000-memory.dmp

memory/2096-27-0x0000000007610000-0x000000000762A000-memory.dmp

memory/2096-26-0x0000000007D70000-0x00000000083EA000-memory.dmp

memory/2096-28-0x000000007F550000-0x000000007F560000-memory.dmp

memory/2096-31-0x00000000707B0000-0x0000000070B04000-memory.dmp

memory/2096-43-0x0000000007AB0000-0x0000000007B53000-memory.dmp

memory/2096-42-0x0000000005120000-0x0000000005130000-memory.dmp

memory/2096-41-0x0000000007A90000-0x0000000007AAE000-memory.dmp

memory/2096-30-0x0000000070630000-0x000000007067C000-memory.dmp

memory/2096-44-0x0000000007BA0000-0x0000000007BAA000-memory.dmp

memory/2096-29-0x0000000007A50000-0x0000000007A82000-memory.dmp

memory/2096-45-0x0000000007CB0000-0x0000000007D46000-memory.dmp

memory/2096-46-0x0000000007BB0000-0x0000000007BC1000-memory.dmp

memory/2096-47-0x0000000007BF0000-0x0000000007BFE000-memory.dmp

memory/2096-48-0x0000000007C10000-0x0000000007C24000-memory.dmp

memory/2096-49-0x0000000007C60000-0x0000000007C7A000-memory.dmp

memory/2096-50-0x0000000007C50000-0x0000000007C58000-memory.dmp

memory/2096-53-0x0000000074790000-0x0000000074F40000-memory.dmp

memory/1388-55-0x0000000003A00000-0x0000000003E00000-memory.dmp

memory/1388-56-0x0000000003E00000-0x00000000046EB000-memory.dmp

memory/2532-57-0x0000000003AF0000-0x0000000003EEF000-memory.dmp

memory/1388-58-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4592-64-0x0000000004C00000-0x0000000004C10000-memory.dmp

memory/4592-65-0x00000000059C0000-0x0000000005D14000-memory.dmp

memory/4592-66-0x0000000004C00000-0x0000000004C10000-memory.dmp

memory/2532-71-0x0000000003EF0000-0x00000000047DB000-memory.dmp

memory/4592-72-0x0000000074790000-0x0000000074F40000-memory.dmp

memory/4592-74-0x0000000070630000-0x000000007067C000-memory.dmp

memory/4592-73-0x000000007F730000-0x000000007F740000-memory.dmp

memory/4592-85-0x0000000006FD0000-0x0000000007073000-memory.dmp

memory/4592-75-0x0000000070D90000-0x00000000710E4000-memory.dmp

memory/2532-86-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4592-87-0x0000000004C00000-0x0000000004C10000-memory.dmp

memory/4592-88-0x00000000074C0000-0x00000000074D1000-memory.dmp

memory/4592-89-0x0000000007510000-0x0000000007524000-memory.dmp

memory/4592-92-0x0000000074790000-0x0000000074F40000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4568-95-0x0000000002F30000-0x0000000002F40000-memory.dmp

memory/4568-96-0x0000000002F30000-0x0000000002F40000-memory.dmp

memory/4568-106-0x0000000005ED0000-0x0000000006224000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6ff764feb3c0b2cb159dda27e4a129fb
SHA1 6408262e55010c05811adbd269a1bde394bb707f
SHA256 2bea865742304e18ba033973d7792da324a7f967ea160eab6b4034c7ebcd5f6d
SHA512 1dbc7f292bf54ab1bbccfbfedcff809638f5f1f4677e64dc079021d93c47d46031a2c4294073734e01fb3210870c1166d511c33ae5300c22bd09dd0ac92a7212

memory/4568-94-0x0000000074790000-0x0000000074F40000-memory.dmp

memory/4568-110-0x00000000707D0000-0x0000000070B24000-memory.dmp

memory/4568-109-0x0000000070630000-0x000000007067C000-memory.dmp

memory/1388-120-0x0000000003A00000-0x0000000003E00000-memory.dmp

memory/4568-108-0x000000007F7E0000-0x000000007F7F0000-memory.dmp

memory/4568-121-0x0000000002F30000-0x0000000002F40000-memory.dmp

memory/4568-122-0x0000000002F30000-0x0000000002F40000-memory.dmp

memory/4568-124-0x0000000074790000-0x0000000074F40000-memory.dmp

memory/4408-136-0x0000000074790000-0x0000000074F40000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f31357cb214a51ef9da7661f822f99d7
SHA1 a2be3144bf61988f2224dda747d19e120a7e76e1
SHA256 9b348c296cf7865f0026a7ba00b994ca576a3b18b616a86c33ca6badf2067c55
SHA512 486c0ef8ebe0f2fc6e512f23015d3c00236a7fd38de236e41a523151b6edda67312f6401faed28fa81e940ece7945ff37c3741ea86ee4476e214e6bc6450f9c8

memory/4408-135-0x0000000005890000-0x0000000005BE4000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 bc2b02717bb8d502b198bdd0a162c05a
SHA1 c1003e4d4870d3ecf9ed07640343da1755a3bfce
SHA256 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350
SHA512 22c96151c4c6a3376d4cb42fd70f2cdabafc61d2d7f5b4e6f1b8884cee00eaa421861f4b3d24be8790c94295c08b4ab56e2d9451ac7e2429a0f66e1570982f5c

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 86a0b62d2353157fa25f50962409c913
SHA1 a740ff1b6cd8df63e96015d4a5ccf9d78a5a5f10
SHA256 2bd1e3e5fc53a68e5f889f903d78ca6fd1e67f8ac13bf31725161e340c628d09
SHA512 c2c5b2156adec31620f0d30da33635e7cbda8053084d77d6e3ca99111b59607205934ba233f7f017cd3cb9e15520de6f63e3d977561c9de3e8fb96c6cbc9f353

memory/1388-188-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c763cd541f5014e052821b7f15f370e7
SHA1 4988bee6b6071a20f5a9d26af964eba80d15addc
SHA256 55e2993e15cdc3cf09352d010cd23e25cf019308ca92163b50dc069a290277ee
SHA512 af16d5b5e26dfabbeb2b30f743d655052ce86c0714dbf02bbe13cbdf16a50ad92f7e73da2bf4cd2e889fa9a5e843d83e0405f182dbe7d16a475246396df4a414

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7c5b87acf31c4bbf200bd4cf57404286
SHA1 d3003f07ae1eaf9cb11be7d42acc1da6f502712c
SHA256 2a4dc0dee19fccbb1c1b5810551481dc5be1dceda76dda6572a94cc0b7af8cb4
SHA512 223ada0ae336eb7aa74a5a397c8811e1f7f20cd72051d6c6bc74b86e2f0560c9e1eef5f5da4c9f4f9a47b541fe41b47f430915b7cf06c19dfea492b5267bd532

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1804-258-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4944-267-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1804-269-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/624-272-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1804-273-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1804-277-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/624-279-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1804-281-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1804-285-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1804-289-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1804-293-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1804-297-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1804-301-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1804-305-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1804-309-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1804-313-0x0000000000400000-0x0000000001DFD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 16:01

Reported

2024-04-19 16:03

Platform

win11-20240412-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-491 = "India Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-12 = "Azores Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3532 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3532 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3532 wrote to memory of 1176 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 488 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\system32\cmd.exe
PID 1904 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\system32\cmd.exe
PID 3088 wrote to memory of 3412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3088 wrote to memory of 3412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1904 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 3720 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 2456 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1904 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\rss\csrss.exe
PID 1904 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\rss\csrss.exe
PID 1904 wrote to memory of 880 N/A C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe C:\Windows\rss\csrss.exe
PID 880 wrote to memory of 4128 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 880 wrote to memory of 4128 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 880 wrote to memory of 4128 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 880 wrote to memory of 2416 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 880 wrote to memory of 2416 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 880 wrote to memory of 2416 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 880 wrote to memory of 228 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 880 wrote to memory of 228 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 880 wrote to memory of 228 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 880 wrote to memory of 4352 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 880 wrote to memory of 4352 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4484 wrote to memory of 2684 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 2684 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4484 wrote to memory of 2684 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2684 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2684 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2684 wrote to memory of 1972 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe

"C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe

"C:\Users\Admin\AppData\Local\Temp\dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 a459a3b8-7420-4c7d-904a-2f07771bdec0.uuid.dumppage.org udp
US 8.8.8.8:53 server14.dumppage.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server14.dumppage.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.111:443 server14.dumppage.org tcp
US 8.8.8.8:53 stun4.l.google.com udp
CH 172.217.210.127:19302 stun4.l.google.com udp
N/A 127.0.0.1:3478 udp
BG 185.82.216.111:443 server14.dumppage.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/3532-1-0x0000000003C40000-0x0000000004047000-memory.dmp

memory/3532-2-0x0000000004050000-0x000000000493B000-memory.dmp

memory/3532-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1176-5-0x0000000074640000-0x0000000074DF1000-memory.dmp

memory/1176-4-0x0000000000D90000-0x0000000000DC6000-memory.dmp

memory/1176-8-0x0000000004E10000-0x000000000543A000-memory.dmp

memory/1176-7-0x0000000002770000-0x0000000002780000-memory.dmp

memory/1176-6-0x0000000002770000-0x0000000002780000-memory.dmp

memory/1176-9-0x0000000004B60000-0x0000000004B82000-memory.dmp

memory/1176-10-0x0000000004C10000-0x0000000004C76000-memory.dmp

memory/1176-11-0x0000000004D80000-0x0000000004DE6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0tbo2jx3.od5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1176-20-0x0000000005630000-0x0000000005987000-memory.dmp

memory/1176-21-0x0000000005A20000-0x0000000005A3E000-memory.dmp

memory/1176-22-0x0000000005A70000-0x0000000005ABC000-memory.dmp

memory/1176-23-0x0000000005FE0000-0x0000000006026000-memory.dmp

memory/1176-24-0x0000000006E50000-0x0000000006E84000-memory.dmp

memory/1176-27-0x0000000070A30000-0x0000000070D87000-memory.dmp

memory/1176-26-0x00000000708B0000-0x00000000708FC000-memory.dmp

memory/1176-25-0x000000007F8D0000-0x000000007F8E0000-memory.dmp

memory/1176-36-0x0000000006E90000-0x0000000006EAE000-memory.dmp

memory/1176-38-0x0000000002770000-0x0000000002780000-memory.dmp

memory/1176-37-0x0000000006EB0000-0x0000000006F54000-memory.dmp

memory/1176-39-0x0000000007620000-0x0000000007C9A000-memory.dmp

memory/1176-40-0x0000000006FE0000-0x0000000006FFA000-memory.dmp

memory/1176-41-0x0000000007020000-0x000000000702A000-memory.dmp

memory/1176-42-0x00000000070E0000-0x0000000007176000-memory.dmp

memory/1176-43-0x0000000007050000-0x0000000007061000-memory.dmp

memory/1176-44-0x0000000007090000-0x000000000709E000-memory.dmp

memory/1176-45-0x00000000070A0000-0x00000000070B5000-memory.dmp

memory/1176-46-0x00000000071A0000-0x00000000071BA000-memory.dmp

memory/1176-47-0x0000000007180000-0x0000000007188000-memory.dmp

memory/1176-50-0x0000000074640000-0x0000000074DF1000-memory.dmp

memory/1904-52-0x0000000003B00000-0x0000000003EF9000-memory.dmp

memory/3532-53-0x0000000003C40000-0x0000000004047000-memory.dmp

memory/1904-54-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3532-56-0x0000000004050000-0x000000000493B000-memory.dmp

memory/488-66-0x0000000004A20000-0x0000000004A30000-memory.dmp

memory/488-65-0x0000000004A20000-0x0000000004A30000-memory.dmp

memory/488-67-0x0000000074640000-0x0000000074DF1000-memory.dmp

memory/488-55-0x00000000057E0000-0x0000000005B37000-memory.dmp

memory/3532-68-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/488-71-0x0000000070B00000-0x0000000070E57000-memory.dmp

memory/488-81-0x0000000006F10000-0x0000000006FB4000-memory.dmp

memory/488-80-0x0000000004A20000-0x0000000004A30000-memory.dmp

memory/488-70-0x00000000708B0000-0x00000000708FC000-memory.dmp

memory/488-69-0x000000007F570000-0x000000007F580000-memory.dmp

memory/488-82-0x0000000007260000-0x0000000007271000-memory.dmp

memory/488-83-0x00000000072B0000-0x00000000072C5000-memory.dmp

memory/488-86-0x0000000074640000-0x0000000074DF1000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/3720-90-0x0000000004E30000-0x0000000004E40000-memory.dmp

memory/3720-89-0x0000000004E30000-0x0000000004E40000-memory.dmp

memory/3720-88-0x0000000074640000-0x0000000074DF1000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8287c30408472b2394a82aefccc35345
SHA1 f184c227adb8e44d7e32d737d34141a131e3b6b3
SHA256 293c01531e625f915c336f63d7cce8d78fd880228318eadf7cb656d6ee9e2dc9
SHA512 3382345d22107187b8a0d9ebc4d4bc85245551b527da61e2dec2d93fc42d8e823a18f0f22dd013a125a0310f95907bc10670095079c5c943ef83ee43a812d012

memory/1904-111-0x0000000003B00000-0x0000000003EF9000-memory.dmp

memory/3720-112-0x0000000004E30000-0x0000000004E40000-memory.dmp

memory/3720-102-0x0000000070A30000-0x0000000070D87000-memory.dmp

memory/3720-101-0x00000000708B0000-0x00000000708FC000-memory.dmp

memory/3720-100-0x000000007F680000-0x000000007F690000-memory.dmp

memory/3720-114-0x0000000074640000-0x0000000074DF1000-memory.dmp

memory/2456-116-0x0000000074640000-0x0000000074DF1000-memory.dmp

memory/2456-126-0x0000000002D20000-0x0000000002D30000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ba44d431a6ff5ac825c5bb3ae5198f0d
SHA1 10e0b352509bbb8a71b307e9c1619a1ed84825e8
SHA256 2709f56d327413631c695c2c844b676759e6cd59d335f8811ca7e0bc1ec8ca30
SHA512 beeb0d7cf9f69d3873e940bbe229b88117ff0aa52054a56ad98d88c8bc012642e6e426024969415943743557b50a2a86a301c4703aa6b43640efa931d374a476

memory/2456-127-0x0000000002D20000-0x0000000002D30000-memory.dmp

memory/2456-125-0x0000000005CC0000-0x0000000006017000-memory.dmp

memory/2456-129-0x00000000708B0000-0x00000000708FC000-memory.dmp

memory/2456-130-0x0000000070A50000-0x0000000070DA7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 bc2b02717bb8d502b198bdd0a162c05a
SHA1 c1003e4d4870d3ecf9ed07640343da1755a3bfce
SHA256 dbabee1c61c5626ba626f1c5d95d988f8496e82d08df9569b834c8122aee0350
SHA512 22c96151c4c6a3376d4cb42fd70f2cdabafc61d2d7f5b4e6f1b8884cee00eaa421861f4b3d24be8790c94295c08b4ab56e2d9451ac7e2429a0f66e1570982f5c

memory/1904-147-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b63608f4100f5aa2e51849a41e26e8e1
SHA1 420a4350d0ba969ad702dc8295706c178229dc40
SHA256 08cbf4e65a5957ff8d7a35b3022f27a7f441a361264a5a7e84e6af8b7fddd96b
SHA512 ae5e37d9c9f7f6645721db33b030997053902fc69f1a03cd2a0038eba1569cce6504d2776d8ab93f43f2590bdb4debd67f3202aaec363cbb3370b3ce795dba0d

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ec29adcc9cf99468c2f94f070a7e3bfb
SHA1 16ad3da0593ab0474c0917e3897dc77909e569f2
SHA256 58baae516be4db62b91aa21856bf051450c3816e227c8bbb1f86cdf6d41c7830
SHA512 2af166e521413465ed81b88c39572a6b0d927c662da33c652b5b7f19c8dee08e04582cd7072b6ff1aa56071a6e387dcc2d1511eb6e24f0a8f04aab09d7372c60

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 73a8e7f53f1d4ab6f3e06f40a393958a
SHA1 4d9cabaf0864fe8dfb123f7609acc83402f8dd29
SHA256 4d319fb866267591978704cd006596cb5f83f25abe10b9a259672e3585038fb3
SHA512 1f4fb46430c5548b686327020d9b4f2db81c84c8a9dc88213d69bc0347852c17115d77f541a850fd206b2899f367c6b90e1d4181c6df1022ceb02820f040d2d2

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/880-240-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4484-248-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/880-250-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4932-252-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/880-253-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/880-256-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4932-258-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/880-259-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/880-262-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/880-265-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/880-268-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/880-271-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/880-274-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/880-277-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/880-280-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/880-283-0x0000000000400000-0x0000000001DFD000-memory.dmp