Malware Analysis Report

2025-08-06 03:32

Sample ID 240419-tja3qage98
Target 2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f
SHA256 2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f

Threat Level: Known bad

The file 2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Manipulates WinMonFS driver.

Checks installed software on the system

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Program crash

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 16:04

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 16:04

Reported

2024-04-19 16:07

Platform

win10v2004-20240412-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-385 = "Namibia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 548 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 548 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 548 wrote to memory of 4724 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 4756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4476 wrote to memory of 4756 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1612 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 1136 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 3228 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\rss\csrss.exe
PID 1612 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\rss\csrss.exe
PID 1612 wrote to memory of 4996 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\rss\csrss.exe
PID 4996 wrote to memory of 5116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4996 wrote to memory of 5116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4996 wrote to memory of 5116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4996 wrote to memory of 4488 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4996 wrote to memory of 4488 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4996 wrote to memory of 4488 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4996 wrote to memory of 4476 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4996 wrote to memory of 4476 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4996 wrote to memory of 4476 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4996 wrote to memory of 5100 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4996 wrote to memory of 5100 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3700 wrote to memory of 4276 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3700 wrote to memory of 4276 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3700 wrote to memory of 4276 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4276 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4276 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4276 wrote to memory of 1956 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe

"C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4724 -ip 4724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 2564

C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe

"C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 206.221.208.4.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 b39f6128-edb5-441e-a5be-bcfc548cc6f5.uuid.statstraffic.org udp
US 8.8.8.8:53 server8.statstraffic.org udp
US 8.8.8.8:53 stun.stunprotocol.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
BG 185.82.216.104:443 server8.statstraffic.org tcp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
N/A 127.0.0.1:3478 udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 81.139.73.23.in-addr.arpa udp
BG 185.82.216.104:443 server8.statstraffic.org tcp
US 8.8.8.8:53 stun2.l.google.com udp
NL 74.125.128.127:19302 stun2.l.google.com udp
US 8.8.8.8:53 127.128.125.74.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BG 185.82.216.104:443 server8.statstraffic.org tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.104:443 server8.statstraffic.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/548-1-0x0000000003A10000-0x0000000003E0F000-memory.dmp

memory/548-2-0x0000000003E10000-0x00000000046FB000-memory.dmp

memory/548-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4724-5-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/4724-4-0x0000000002A20000-0x0000000002A56000-memory.dmp

memory/4724-6-0x0000000002A60000-0x0000000002A70000-memory.dmp

memory/4724-7-0x0000000005680000-0x0000000005CA8000-memory.dmp

memory/4724-8-0x0000000005380000-0x00000000053A2000-memory.dmp

memory/4724-9-0x0000000005520000-0x0000000005586000-memory.dmp

memory/4724-15-0x0000000005600000-0x0000000005666000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lv1udmrk.yko.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4724-20-0x0000000005EE0000-0x0000000006234000-memory.dmp

memory/4724-21-0x00000000063F0000-0x000000000640E000-memory.dmp

memory/4724-22-0x0000000006430000-0x000000000647C000-memory.dmp

memory/4724-23-0x0000000006940000-0x0000000006984000-memory.dmp

memory/4724-24-0x0000000007720000-0x0000000007796000-memory.dmp

memory/4724-25-0x0000000007E20000-0x000000000849A000-memory.dmp

memory/4724-26-0x00000000077C0000-0x00000000077DA000-memory.dmp

memory/4724-27-0x000000007EFB0000-0x000000007EFC0000-memory.dmp

memory/4724-28-0x0000000007970000-0x00000000079A2000-memory.dmp

memory/4724-29-0x0000000070430000-0x000000007047C000-memory.dmp

memory/4724-30-0x00000000705B0000-0x0000000070904000-memory.dmp

memory/4724-40-0x00000000079B0000-0x00000000079CE000-memory.dmp

memory/4724-41-0x00000000079D0000-0x0000000007A73000-memory.dmp

memory/4724-42-0x0000000007AC0000-0x0000000007ACA000-memory.dmp

memory/4724-43-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/1612-45-0x0000000003AC0000-0x0000000003EB9000-memory.dmp

memory/1612-46-0x0000000003EC0000-0x00000000047AB000-memory.dmp

memory/548-47-0x0000000003A10000-0x0000000003E0F000-memory.dmp

memory/1612-48-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/856-49-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

memory/548-50-0x0000000003E10000-0x00000000046FB000-memory.dmp

memory/856-51-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/856-52-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

memory/856-62-0x0000000005A60000-0x0000000005DB4000-memory.dmp

memory/856-63-0x000000007FB80000-0x000000007FB90000-memory.dmp

memory/856-64-0x0000000070430000-0x000000007047C000-memory.dmp

memory/856-75-0x0000000007290000-0x0000000007333000-memory.dmp

memory/856-65-0x0000000070BB0000-0x0000000070F04000-memory.dmp

memory/548-76-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/856-77-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

memory/856-78-0x0000000007660000-0x00000000076F6000-memory.dmp

memory/856-79-0x0000000007590000-0x00000000075A1000-memory.dmp

memory/856-81-0x00000000075E0000-0x00000000075F4000-memory.dmp

memory/856-80-0x00000000075D0000-0x00000000075DE000-memory.dmp

memory/856-82-0x0000000007620000-0x000000000763A000-memory.dmp

memory/856-83-0x0000000007610000-0x0000000007618000-memory.dmp

memory/856-86-0x0000000074590000-0x0000000074D40000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/1136-88-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/1136-89-0x0000000005550000-0x0000000005560000-memory.dmp

memory/1136-90-0x0000000005550000-0x0000000005560000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5944f28de200eb4f8864db4afe195c81
SHA1 c211d54e22c63ec40bc4e79ffb65546a96e959a0
SHA256 e86f6b492ff3bd86e1cd117cc656fab956f9dbf1a203d26c4cd9810f523508d7
SHA512 db69ec5a33936c9360ce1de135bb5c89e4e37eacc8d3e37c4d9ad7068f15386f7e292f36086a59a1c6ce759e7cf40b713ec12807a34319e3f03c3059b58e0c95

memory/1136-101-0x000000007F9B0000-0x000000007F9C0000-memory.dmp

memory/1136-102-0x0000000070430000-0x000000007047C000-memory.dmp

memory/1136-103-0x0000000070BB0000-0x0000000070F04000-memory.dmp

memory/1136-113-0x0000000005550000-0x0000000005560000-memory.dmp

memory/1136-115-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/3228-117-0x0000000074590000-0x0000000074D40000-memory.dmp

memory/3228-124-0x0000000003280000-0x0000000003290000-memory.dmp

memory/1612-123-0x0000000003AC0000-0x0000000003EB9000-memory.dmp

memory/3228-129-0x0000000003280000-0x0000000003290000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f40eb642ddd793eba3583d142fcf2fe5
SHA1 84b93aebd8230e78d97fd73df94bba4f96c66a42
SHA256 ca9d2fe2d1109559c0ac6506c70b4b436fda011c72b8f33c5dd0df30280cd9ee
SHA512 bab5166de0a77a4a56d89828454bd6bbc67756861ee5b895fb5a77d3d70e9f0165c8b60aa5b4652dff0d7bbc519cbbd3c45844501af15bde34f6835dc2a6175d

memory/3228-131-0x0000000070430000-0x000000007047C000-memory.dmp

memory/3228-132-0x0000000070BB0000-0x0000000070F04000-memory.dmp

memory/1612-142-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3228-143-0x0000000003280000-0x0000000003290000-memory.dmp

memory/3228-145-0x0000000074590000-0x0000000074D40000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 43866a3d3e55a5c1b21135648fdb02f1
SHA1 39396652f940dec4e8d7f4c116ce2665a5bf7b31
SHA256 2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f
SHA512 c55c829bce33deee5d56cbd2a80e5d36c3346e75970e12578cfaf988a53fb231349879f947c98bbc2ef68364c971d1acb3094434a09af53fc06d24892b1b64f6

memory/1612-149-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 aefa147833617ef7877cee192d6d677c
SHA1 7a3bca21b21ff7caa2572b64459e5937721bc673
SHA256 ba510c310d1219b0ffd44b9a18469a70e8bc8b0ad8bf2b823ba6a6546f12ada3
SHA512 5e4e86f3b226a85a1c2b96f928198882e7f90edbb77c848d34b433883e6c7eb14a8907a2e67722c7159d36aa18637ed29c31b70023c845b781f738b76e7f89d4

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 583b610e3413ca08d9b87871bd92da70
SHA1 399519c2344f2e3acd3a9294a54ba9c5daf560cc
SHA256 8652e458b3f4e42f00105fa1cd6f0155d083c701e62f5fa86e8e98901b65476f
SHA512 38a417621408e579402f15febc56c5365d2a9699fad8303a2b7e22c545423af11d9a98aa119e761541bcdc15fbcf416d80302a4ba8b8188f03707b97e6020d6e

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 cbdcf55d97b61dcc8ef39784b102feb5
SHA1 c17dcff6477b9cd218e1454d7771abff45cb275f
SHA256 75b40cacfa15958933f91ec81f4db12f2ada2969ee0b7ff1b5c8f84bd7059e71
SHA512 5629b74e5b83ae100aa1167df77f9313d640c65ed7930e9a449e4497ec2ddb5222ebc9727a6707a8c624957d2d8865a7c5f8a83bf509ffc6d3f1dbf90d8e443e

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4996-248-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3700-255-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4996-258-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2504-259-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4996-261-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4996-264-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2504-265-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4996-267-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4996-270-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4996-273-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4996-276-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4996-279-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4996-282-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4996-285-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4996-288-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4996-291-0x0000000000400000-0x0000000001DFD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 16:04

Reported

2024-04-19 16:07

Platform

win11-20240412-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3668 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3668 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3668 wrote to memory of 1204 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\system32\cmd.exe
PID 3160 wrote to memory of 3744 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\system32\cmd.exe
PID 3744 wrote to memory of 3436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3744 wrote to memory of 3436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3160 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3160 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\rss\csrss.exe
PID 3160 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\rss\csrss.exe
PID 3160 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe C:\Windows\rss\csrss.exe
PID 3100 wrote to memory of 3664 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3100 wrote to memory of 3664 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3100 wrote to memory of 3664 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3100 wrote to memory of 1388 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3100 wrote to memory of 1388 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3100 wrote to memory of 1388 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3100 wrote to memory of 2864 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3100 wrote to memory of 2864 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3100 wrote to memory of 2864 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3100 wrote to memory of 2900 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3100 wrote to memory of 2900 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3048 wrote to memory of 2664 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2664 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3048 wrote to memory of 2664 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2664 wrote to memory of 4236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2664 wrote to memory of 4236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2664 wrote to memory of 4236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe

"C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe

"C:\Users\Admin\AppData\Local\Temp\2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 1fd4c3e2-095d-4288-9447-5a3f437684a5.uuid.statstraffic.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server16.statstraffic.org udp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 3.33.249.248:3478 stun.sipgate.net udp
BG 185.82.216.104:443 server16.statstraffic.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.104:443 server16.statstraffic.org tcp
BG 185.82.216.104:443 server16.statstraffic.org tcp
BG 185.82.216.104:443 server16.statstraffic.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/3668-1-0x0000000003C40000-0x000000000403F000-memory.dmp

memory/3668-2-0x0000000004040000-0x000000000492B000-memory.dmp

memory/3668-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1204-4-0x0000000002ED0000-0x0000000002F06000-memory.dmp

memory/1204-6-0x00000000056B0000-0x0000000005CDA000-memory.dmp

memory/1204-5-0x0000000073E10000-0x00000000745C1000-memory.dmp

memory/1204-7-0x0000000002F70000-0x0000000002F80000-memory.dmp

memory/1204-8-0x0000000002F70000-0x0000000002F80000-memory.dmp

memory/1204-9-0x00000000053B0000-0x00000000053D2000-memory.dmp

memory/1204-11-0x0000000005630000-0x0000000005696000-memory.dmp

memory/1204-10-0x0000000005550000-0x00000000055B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ky4cjmzx.dk2.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1204-20-0x0000000005ED0000-0x0000000006227000-memory.dmp

memory/1204-21-0x0000000006380000-0x000000000639E000-memory.dmp

memory/1204-22-0x00000000063D0000-0x000000000641C000-memory.dmp

memory/1204-23-0x00000000067C0000-0x0000000006806000-memory.dmp

memory/1204-24-0x000000007F220000-0x000000007F230000-memory.dmp

memory/1204-25-0x00000000077B0000-0x00000000077E4000-memory.dmp

memory/1204-26-0x0000000070080000-0x00000000700CC000-memory.dmp

memory/1204-27-0x0000000070200000-0x0000000070557000-memory.dmp

memory/1204-36-0x00000000077F0000-0x000000000780E000-memory.dmp

memory/1204-38-0x0000000007810000-0x00000000078B4000-memory.dmp

memory/1204-37-0x0000000002F70000-0x0000000002F80000-memory.dmp

memory/1204-40-0x0000000007940000-0x000000000795A000-memory.dmp

memory/1204-39-0x0000000007F80000-0x00000000085FA000-memory.dmp

memory/1204-41-0x0000000007980000-0x000000000798A000-memory.dmp

memory/1204-42-0x0000000007A90000-0x0000000007B26000-memory.dmp

memory/1204-43-0x00000000079A0000-0x00000000079B1000-memory.dmp

memory/1204-44-0x00000000079F0000-0x00000000079FE000-memory.dmp

memory/1204-45-0x0000000007A00000-0x0000000007A15000-memory.dmp

memory/1204-46-0x0000000007A50000-0x0000000007A6A000-memory.dmp

memory/1204-47-0x0000000007A70000-0x0000000007A78000-memory.dmp

memory/1204-50-0x0000000073E10000-0x00000000745C1000-memory.dmp

memory/3160-52-0x0000000003B00000-0x0000000003EFE000-memory.dmp

memory/3160-53-0x0000000003F00000-0x00000000047EB000-memory.dmp

memory/3668-54-0x0000000003C40000-0x000000000403F000-memory.dmp

memory/3160-55-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2660-56-0x0000000004F50000-0x0000000004F60000-memory.dmp

memory/3668-57-0x0000000004040000-0x000000000492B000-memory.dmp

memory/2660-58-0x0000000073E10000-0x00000000745C1000-memory.dmp

memory/2660-67-0x0000000005F00000-0x0000000006257000-memory.dmp

memory/2660-70-0x0000000070290000-0x00000000705E7000-memory.dmp

memory/2660-69-0x0000000070080000-0x00000000700CC000-memory.dmp

memory/2660-79-0x0000000007600000-0x00000000076A4000-memory.dmp

memory/2660-68-0x000000007EF00000-0x000000007EF10000-memory.dmp

memory/3668-80-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2660-81-0x0000000007920000-0x0000000007931000-memory.dmp

memory/2660-82-0x0000000007970000-0x0000000007985000-memory.dmp

memory/2660-85-0x0000000073E10000-0x00000000745C1000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/4112-88-0x0000000004910000-0x0000000004920000-memory.dmp

memory/4112-97-0x0000000005720000-0x0000000005A77000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4a0b4b756f2c3fad39449e60f884a4f6
SHA1 3ec4e7da88d6496c3b9b8f149cf2bb7c8c385872
SHA256 aa80011597e74fc1e4dc48164c31a0f477f31d12d6f9da13f951abd1f42a6e86
SHA512 56147f1842cb31dd03103461e0ceeef83213d4a1774e221868554082c43a93d2b0fc0a168bee789d236442c199097f1cec8ea65ea38346e6d1f25d3626a56ff7

memory/4112-87-0x0000000073E10000-0x00000000745C1000-memory.dmp

memory/4112-101-0x00000000702D0000-0x0000000070627000-memory.dmp

memory/3160-110-0x0000000003B00000-0x0000000003EFE000-memory.dmp

memory/4112-100-0x0000000070080000-0x00000000700CC000-memory.dmp

memory/4112-112-0x0000000004910000-0x0000000004920000-memory.dmp

memory/4112-111-0x0000000004910000-0x0000000004920000-memory.dmp

memory/4112-99-0x000000007FAC0000-0x000000007FAD0000-memory.dmp

memory/4112-114-0x0000000073E10000-0x00000000745C1000-memory.dmp

memory/1584-115-0x0000000073E10000-0x00000000745C1000-memory.dmp

memory/1584-117-0x0000000003280000-0x0000000003290000-memory.dmp

memory/1584-116-0x0000000003280000-0x0000000003290000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f2b3aa8d85d39e0bb443d48e2fbea84f
SHA1 e57bb539a70d08a0a88bcc298406c060d0321968
SHA256 ed2a1e2ec08c5831d1b8a6908b0b225a13eb213e21a90b15514c402091fc22cb
SHA512 4242e7c44abe00ea49c62de3d67627027ee4614002f76590bf7d04ed096c80a0b401b52f1f74015957214d9169787055dbfe81aca1594614b5137e1aa2c9c010

memory/1584-128-0x0000000070080000-0x00000000700CC000-memory.dmp

memory/1584-129-0x00000000702D0000-0x0000000070627000-memory.dmp

memory/3160-138-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 43866a3d3e55a5c1b21135648fdb02f1
SHA1 39396652f940dec4e8d7f4c116ce2665a5bf7b31
SHA256 2a7269ac8390a79c9ecf758ddfccbe6f829978081db23df43be99705e50fc08f
SHA512 c55c829bce33deee5d56cbd2a80e5d36c3346e75970e12578cfaf988a53fb231349879f947c98bbc2ef68364c971d1acb3094434a09af53fc06d24892b1b64f6

memory/3160-145-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e6e643905d5637952ae67ad99a8dd750
SHA1 bdc4bf4b4ffd3fc5a887123cdaabc815d27a2f70
SHA256 37156d8b62907a79be5a3d499c2131d4203c2d26bf3c65b781fe6756790cddc7
SHA512 d3bebbb28a93f685ec232b8ed63b6b7984c133335e4c2b39b8dfee89d462fc3fabc3c2e1b1c6ac91231b09fb9a851462c93232f08090dc0f3c7971da8784a331

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a7f7f4d286f852d419f9d83bb84fceba
SHA1 a43f4b115d2e8276fdefac99d4e5e91b5b75b9ba
SHA256 e9984ed7eb4b1a1b54978a5f7454151515b3c15a22af197628e94970435e7236
SHA512 710db22e5117732fc1b6b66c295a279364d12112629be8d2f7e624a34dd3fab6d5cd036ce839e99ee4fb08e06f4d17ae6b3a1afa95e66c8c12dd513c63bd0006

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3818ce116239eb1071342af3701cab55
SHA1 de3dbdbb3a540c790e21191cbb1b8f66454ffa1d
SHA256 09fdd02ebe59aa38dd23b00d459d6e9e59d415d6cb919901e29c6f35ba4312dd
SHA512 e10e0d0a276b3670f52fcd28472f1637aba03036b9a1d9bd7d7f3c532683ba02718e7210d08f8f9e14414256a922b35083d3a8c8e3fb7afe36d252efacb12957

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3100-238-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3048-245-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3100-248-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2040-249-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3100-251-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3100-254-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2040-255-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3100-257-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3100-260-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3100-263-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3100-266-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3100-269-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3100-272-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3100-275-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3100-278-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3100-281-0x0000000000400000-0x0000000001DFD000-memory.dmp