Malware Analysis Report

2025-08-06 03:33

Sample ID 240419-thd3zshd7z
Target 1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24
SHA256 1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24

Threat Level: Known bad

The file 1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Manipulates WinMonFS driver.

Checks installed software on the system

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 16:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 16:03

Reported

2024-04-19 16:05

Platform

win10v2004-20240412-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2842 = "Saratov Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 404 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 404 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 404 wrote to memory of 4036 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\system32\cmd.exe
PID 348 wrote to memory of 1552 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 348 wrote to memory of 1552 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2604 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2604 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\rss\csrss.exe
PID 2604 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\rss\csrss.exe
PID 2604 wrote to memory of 1936 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\rss\csrss.exe
PID 1936 wrote to memory of 2740 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 2740 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 2740 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 4544 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 4544 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 4544 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 2996 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 2996 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 2996 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 3976 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1936 wrote to memory of 3976 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4724 wrote to memory of 1112 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4724 wrote to memory of 1112 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4724 wrote to memory of 1112 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1112 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1112 wrote to memory of 884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe

"C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe

"C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 206.221.208.4.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 d438999c-49bc-4852-b0c8-b4473b04869e.uuid.statscreate.org udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 stun.stunprotocol.org udp
US 8.8.8.8:53 server11.statscreate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server11.statscreate.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
N/A 127.0.0.1:3478 udp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.96:443 server11.statscreate.org tcp
US 8.8.8.8:53 stun1.l.google.com udp
BE 172.253.120.127:19302 stun1.l.google.com udp
US 8.8.8.8:53 127.120.253.172.in-addr.arpa udp
US 8.8.8.8:53 249.138.73.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 52.111.227.13:443 tcp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BG 185.82.216.96:443 server11.statscreate.org tcp
US 8.8.8.8:53 24.173.189.20.in-addr.arpa udp

Files

memory/404-1-0x0000000003B40000-0x0000000003F3F000-memory.dmp

memory/404-2-0x0000000003F40000-0x000000000482B000-memory.dmp

memory/404-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4036-4-0x0000000002D90000-0x0000000002DC6000-memory.dmp

memory/4036-5-0x0000000074650000-0x0000000074E00000-memory.dmp

memory/4036-6-0x0000000002DE0000-0x0000000002DF0000-memory.dmp

memory/4036-7-0x0000000005770000-0x0000000005D98000-memory.dmp

memory/4036-8-0x00000000055D0000-0x00000000055F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g13ghdlu.wr1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4036-9-0x0000000005DA0000-0x0000000005E06000-memory.dmp

memory/4036-15-0x0000000006070000-0x00000000060D6000-memory.dmp

memory/4036-20-0x0000000006260000-0x00000000065B4000-memory.dmp

memory/4036-21-0x0000000006740000-0x000000000675E000-memory.dmp

memory/4036-22-0x0000000006790000-0x00000000067DC000-memory.dmp

memory/4036-23-0x0000000006C90000-0x0000000006CD4000-memory.dmp

memory/4036-24-0x0000000007860000-0x00000000078D6000-memory.dmp

memory/4036-25-0x0000000007F60000-0x00000000085DA000-memory.dmp

memory/4036-26-0x0000000007900000-0x000000000791A000-memory.dmp

memory/4036-27-0x000000007F2E0000-0x000000007F2F0000-memory.dmp

memory/4036-28-0x0000000007CC0000-0x0000000007CF2000-memory.dmp

memory/4036-29-0x00000000704F0000-0x000000007053C000-memory.dmp

memory/4036-30-0x0000000070670000-0x00000000709C4000-memory.dmp

memory/4036-40-0x0000000002DE0000-0x0000000002DF0000-memory.dmp

memory/4036-41-0x0000000007D00000-0x0000000007D1E000-memory.dmp

memory/4036-42-0x0000000007D20000-0x0000000007DC3000-memory.dmp

memory/4036-43-0x0000000007E10000-0x0000000007E1A000-memory.dmp

memory/4036-44-0x00000000085E0000-0x0000000008676000-memory.dmp

memory/4036-45-0x0000000007E20000-0x0000000007E31000-memory.dmp

memory/4036-46-0x0000000007E60000-0x0000000007E6E000-memory.dmp

memory/4036-47-0x0000000007E80000-0x0000000007E94000-memory.dmp

memory/4036-48-0x0000000007ED0000-0x0000000007EEA000-memory.dmp

memory/4036-49-0x0000000007EC0000-0x0000000007EC8000-memory.dmp

memory/4036-52-0x0000000074650000-0x0000000074E00000-memory.dmp

memory/404-53-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2604-55-0x00000000039A0000-0x0000000003D99000-memory.dmp

memory/404-56-0x0000000003F40000-0x000000000482B000-memory.dmp

memory/2604-57-0x0000000003EA0000-0x000000000478B000-memory.dmp

memory/2604-58-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1416-59-0x00000000746F0000-0x0000000074EA0000-memory.dmp

memory/1416-60-0x0000000005060000-0x0000000005070000-memory.dmp

memory/1416-61-0x0000000005060000-0x0000000005070000-memory.dmp

memory/1416-71-0x00000000061E0000-0x0000000006534000-memory.dmp

memory/1416-72-0x0000000006B70000-0x0000000006BBC000-memory.dmp

memory/1416-73-0x000000007F1F0000-0x000000007F200000-memory.dmp

memory/1416-74-0x00000000705F0000-0x000000007063C000-memory.dmp

memory/1416-75-0x0000000070770000-0x0000000070AC4000-memory.dmp

memory/1416-85-0x0000000007850000-0x00000000078F3000-memory.dmp

memory/1416-86-0x0000000005060000-0x0000000005070000-memory.dmp

memory/1416-87-0x0000000005060000-0x0000000005070000-memory.dmp

memory/1416-88-0x0000000007B60000-0x0000000007B71000-memory.dmp

memory/1416-89-0x0000000007BB0000-0x0000000007BC4000-memory.dmp

memory/1416-92-0x00000000746F0000-0x0000000074EA0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4408-94-0x00000000746F0000-0x0000000074EA0000-memory.dmp

memory/4408-95-0x0000000002C20000-0x0000000002C30000-memory.dmp

memory/4408-96-0x0000000002C20000-0x0000000002C30000-memory.dmp

memory/4408-106-0x0000000005C30000-0x0000000005F84000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 96e87a791c1f5f8f7c18236c10d1968c
SHA1 c194ad8941cf4a8fb1d7905eba68e752d2bf11c4
SHA256 0ec0c83f437b281176c98fa7be5daca24912c2a9c98506b2469e76954f07732f
SHA512 d5c3b4da4a00bbd2a55cd6353f302a408f674800a8e914aefc6619255e5d47a9618d1556f31f29a995d0dbbce17ffebc881fec90cb37ff7ccdd425cce1d63dc6

memory/4408-108-0x000000007F7B0000-0x000000007F7C0000-memory.dmp

memory/4408-109-0x00000000705F0000-0x000000007063C000-memory.dmp

memory/4408-110-0x00000000707B0000-0x0000000070B04000-memory.dmp

memory/2604-120-0x00000000039A0000-0x0000000003D99000-memory.dmp

memory/4408-122-0x0000000002C20000-0x0000000002C30000-memory.dmp

memory/4408-121-0x0000000002C20000-0x0000000002C30000-memory.dmp

memory/4408-124-0x00000000746F0000-0x0000000074EA0000-memory.dmp

memory/2604-125-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2916-126-0x00000000746F0000-0x0000000074EA0000-memory.dmp

memory/2916-127-0x0000000004E80000-0x0000000004E90000-memory.dmp

memory/2916-128-0x0000000004E80000-0x0000000004E90000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 74843988bce6b95a91bddd750a546488
SHA1 e9292486a3de6fb191a76d2047dec2a66cdee10b
SHA256 d36d07cc896e717c241440ec39c9c912b6db426a40942d531a43c66e531f7256
SHA512 f4187c958c44583028e3910ec392f37b0c2bf470e91b65f96620efed68477243fb21184d125491155dea5fafe627e0f69e63fa89b5576553e0cc8f1a08c3712e

C:\Windows\rss\csrss.exe

MD5 b8947ec96c77f712ceb8dcb85e2621ab
SHA1 dc9f1d753a8b3d02d4755b1a3f02267f6ca874a4
SHA256 1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24
SHA512 f17ed41f871dc5feb99e3fae79698b1152e9196717c54fd35d74c11b24f82830fb7c51ded288bde06ab9762c33494bc5e0b1d8a6a9a1417d6d48e1b9be0a7b47

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9ef67897f447b27f4268e3e479a0cb42
SHA1 4ecf16f479dc5245a1895a17cb9f6b280c941f31
SHA256 1783aa026d61b7c34dbb2613ea441f438b10b2eb2c0df547cb0080926e9201e6
SHA512 7c40355b36195226882f859ae85e53ad0422e3fc1a297d798ea518ca735482f6b3cbf57fcfd3b39a79fac9c7594b2dc082866145de8702c414b6697905baa5f1

memory/2604-195-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c229bae3cfbdd03626a6625f9db32d36
SHA1 3d592ff577ea55f876637a985f86d7a336025d13
SHA256 eb792f477ff98ba11e807e47a380f2f02ea9014763d53506ef0d25545524e9b7
SHA512 ed661439bcb4927b439897949cee3cf72cc01261d5ceaa63cc9479b98f5d79ec01f6d6841bd7e6391bd1453fd419a821065547a4effdb153ffd5f6603b5be857

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 642859cf30709cf5353fa42074381e54
SHA1 94056acb0a291fae324d2f290e9acca156995e8b
SHA256 62efa7f8e2f5a29ae2c7e695d66dd77b3677c423949f10dea9bf506ccb919dce
SHA512 a5bb0d8796eb73f4d6efd4dc07ff44af940e6afb2c1555a51fd0dfc4cd31f16fde72d73d4ee30cf27eb4f9f5cdbc85cb31a25bacebbc555fdbb4fcc4036dbe56

memory/1936-257-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1936-267-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4724-272-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1936-274-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1152-275-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1936-277-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1936-280-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1152-281-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1936-283-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1936-286-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1936-289-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1152-290-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1936-292-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1936-295-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1936-298-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1936-301-0x0000000000400000-0x0000000001DFD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 16:03

Reported

2024-04-19 16:05

Platform

win11-20240412-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3532 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3532 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3532 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2464 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2464 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2464 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2464 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\system32\cmd.exe
PID 2464 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\system32\cmd.exe
PID 1272 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1272 wrote to memory of 1640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2464 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2464 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2464 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2464 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2464 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2464 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2464 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\rss\csrss.exe
PID 2464 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\rss\csrss.exe
PID 2464 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe C:\Windows\rss\csrss.exe
PID 2012 wrote to memory of 2116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 3024 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 3024 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 3024 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2976 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2976 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2976 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 3336 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2012 wrote to memory of 3336 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2720 wrote to memory of 2620 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2620 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2620 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2620 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2620 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2620 wrote to memory of 3396 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe

"C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe

"C:\Users\Admin\AppData\Local\Temp\1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 13739a7c-96b9-402a-a0ef-afb893de1080.uuid.statscreate.org udp
US 8.8.8.8:53 server14.statscreate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
CH 172.217.210.127:19302 stun4.l.google.com udp
BG 185.82.216.96:443 server14.statscreate.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.96:443 server14.statscreate.org tcp
BG 185.82.216.96:443 server14.statscreate.org tcp
BG 185.82.216.96:443 server14.statscreate.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/3532-1-0x0000000003C90000-0x000000000408F000-memory.dmp

memory/3532-2-0x0000000004090000-0x000000000497B000-memory.dmp

memory/3532-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/580-4-0x0000000005350000-0x0000000005386000-memory.dmp

memory/580-6-0x0000000005AD0000-0x00000000060FA000-memory.dmp

memory/580-5-0x0000000074890000-0x0000000075041000-memory.dmp

memory/580-7-0x0000000005490000-0x00000000054A0000-memory.dmp

memory/580-8-0x0000000005A40000-0x0000000005A62000-memory.dmp

memory/580-9-0x0000000006170000-0x00000000061D6000-memory.dmp

memory/580-10-0x00000000061E0000-0x0000000006246000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cn2dbqsk.egv.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/580-19-0x0000000006310000-0x0000000006667000-memory.dmp

memory/580-20-0x00000000067F0000-0x000000000680E000-memory.dmp

memory/580-21-0x00000000068B0000-0x00000000068FC000-memory.dmp

memory/580-22-0x0000000006DB0000-0x0000000006DF6000-memory.dmp

memory/580-24-0x000000007FAA0000-0x000000007FAB0000-memory.dmp

memory/580-23-0x0000000007C30000-0x0000000007C64000-memory.dmp

memory/580-25-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/580-26-0x0000000070D30000-0x0000000071087000-memory.dmp

memory/580-37-0x0000000007C90000-0x0000000007D34000-memory.dmp

memory/580-36-0x0000000005490000-0x00000000054A0000-memory.dmp

memory/580-35-0x0000000007C70000-0x0000000007C8E000-memory.dmp

memory/580-38-0x0000000008400000-0x0000000008A7A000-memory.dmp

memory/580-39-0x0000000007DC0000-0x0000000007DDA000-memory.dmp

memory/580-40-0x0000000007E00000-0x0000000007E0A000-memory.dmp

memory/580-41-0x0000000007F10000-0x0000000007FA6000-memory.dmp

memory/580-42-0x0000000007E20000-0x0000000007E31000-memory.dmp

memory/580-43-0x0000000007E70000-0x0000000007E7E000-memory.dmp

memory/580-44-0x0000000007E80000-0x0000000007E95000-memory.dmp

memory/580-45-0x0000000007ED0000-0x0000000007EEA000-memory.dmp

memory/580-46-0x0000000007EF0000-0x0000000007EF8000-memory.dmp

memory/580-49-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2464-51-0x0000000003B30000-0x0000000003F2F000-memory.dmp

memory/3532-52-0x0000000003C90000-0x000000000408F000-memory.dmp

memory/2464-53-0x0000000003F30000-0x000000000481B000-memory.dmp

memory/2464-54-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1860-55-0x0000000074890000-0x0000000075041000-memory.dmp

memory/1860-56-0x0000000004970000-0x0000000004980000-memory.dmp

memory/1860-66-0x00000000057C0000-0x0000000005B17000-memory.dmp

memory/1860-65-0x0000000004970000-0x0000000004980000-memory.dmp

memory/1860-68-0x0000000070CA0000-0x0000000070FF7000-memory.dmp

memory/1860-67-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/3532-77-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1860-78-0x000000007F030000-0x000000007F040000-memory.dmp

memory/1860-79-0x0000000004970000-0x0000000004980000-memory.dmp

memory/1860-81-0x0000000006CA0000-0x0000000006D44000-memory.dmp

memory/1860-80-0x0000000004970000-0x0000000004980000-memory.dmp

memory/1860-82-0x00000000071D0000-0x00000000071E1000-memory.dmp

memory/1860-83-0x0000000007220000-0x0000000007235000-memory.dmp

memory/1860-86-0x0000000074890000-0x0000000075041000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/1552-89-0x0000000074890000-0x0000000075041000-memory.dmp

memory/1552-92-0x0000000004990000-0x00000000049A0000-memory.dmp

memory/1552-93-0x0000000005800000-0x0000000005B57000-memory.dmp

memory/1552-97-0x0000000004990000-0x00000000049A0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 96a584cf60a4c11d934818dc1ac29d33
SHA1 201145bc5cad491e01fce6584765d120f6c96a0e
SHA256 1b45d5666d5690f748da7ed3dc06c6b91455e54ee16ae525cc287630abf67581
SHA512 430e4249cf89c13d01cea8863d9bcfd135826c4169ae48958eafd77bba143c90f985f69df91d0d99fa3d7367c1aafb91dde069f02eabbdbe39cdb333f01ad692

memory/1552-102-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/1552-103-0x0000000070D10000-0x0000000071067000-memory.dmp

memory/2464-112-0x0000000003B30000-0x0000000003F2F000-memory.dmp

memory/1552-114-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2576-116-0x0000000002F10000-0x0000000002F20000-memory.dmp

memory/2576-115-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2576-117-0x0000000005E10000-0x0000000006167000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 19a6192563c8a5416dd1203720480fec
SHA1 2875c28d40bbb8a015d5d47e4c5b84eb273051eb
SHA256 1f1a6bc552be29ea8d22d04791b60c2a6331dc06b3a5e66df96e7e1df5378a54
SHA512 6f1f20161f8eabd73c7e78cbd52b9f7428c850dc4c70fd92f08e32782fb9ee2ac7d9c38a8884f6dfa1d7cc1b8e913cf538c438ec89bd1b68a9c3f58cf09f6f41

memory/2576-127-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/2464-129-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2576-128-0x0000000070D50000-0x00000000710A7000-memory.dmp

memory/2576-138-0x000000007F860000-0x000000007F870000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 b8947ec96c77f712ceb8dcb85e2621ab
SHA1 dc9f1d753a8b3d02d4755b1a3f02267f6ca874a4
SHA256 1c0520690790115cbcbc23a0c6972f2b59bff66b4994d9d84a12cbd45722ca24
SHA512 f17ed41f871dc5feb99e3fae79698b1152e9196717c54fd35d74c11b24f82830fb7c51ded288bde06ab9762c33494bc5e0b1d8a6a9a1417d6d48e1b9be0a7b47

memory/2464-145-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 209c4535c732b2d3627ab2bf328b69aa
SHA1 a2d8e1f559247dcb7cbab13211ba6687e42f8867
SHA256 0c7d1038b65875c4bd209b483aca12f70dbfb073da8edd7e02e1fdbe3f1eeed9
SHA512 dd184ada161192f5e07b9bd571d409c34df250f7b3a4f745f7e9b7cfc8799b57cbf4ebfebacfa9839b7c8fe9174f19719992e80c94bb1d84d41a018d51cae042

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 284dddff75f9d04ce9fc911065dc2bf2
SHA1 665a294d00032456103919d8dc6cf6fea5fbf5db
SHA256 b37e50d011eb2ad5ad11e3e2c27cccd81a97ce5b2045de0027ec611de71f0c1d
SHA512 95a73b888ad2ecaa2af0bf6b296771e66932340d51e698faa98e211c291b0d912152da44a3f06002e6f276de69d4eebdd22527fe78632b2dfbdc036570ac0571

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3657fce547c82154cbcf11e59ccf14a4
SHA1 18808fe0220778cb31a291bd6f38d26a3d85e0cd
SHA256 16feaa5845b85fa220257cd71fe24752a057219182ec8b8ea27c87cb94502450
SHA512 b3c8a926e671cb607b8bcabba38ca6c851a095a9fd2ab25502b2ad82d6848bee5afbc90e6156ebe82e7fac0507ec9484010b79733a4cc30f6404f6d66187e337

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2012-241-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2720-249-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2012-251-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4992-253-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2012-254-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2012-257-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4992-258-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2012-260-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2012-263-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2012-266-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2012-269-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2012-272-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2012-275-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2012-278-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2012-281-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2012-284-0x0000000000400000-0x0000000001DFD000-memory.dmp