Malware Analysis Report

2025-08-06 03:33

Sample ID 240419-tmr6eagf97
Target f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64
SHA256 f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64

Threat Level: Known bad

The file f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Manipulates WinMonFS driver.

Checks installed software on the system

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 16:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 16:10

Reported

2024-04-19 16:14

Platform

win10v2004-20240412-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-572 = "China Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4528 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 3652 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\system32\cmd.exe
PID 3076 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\system32\cmd.exe
PID 3548 wrote to memory of 4860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3548 wrote to memory of 4860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3076 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 4912 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3076 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\rss\csrss.exe
PID 3076 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\rss\csrss.exe
PID 3076 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\rss\csrss.exe
PID 1348 wrote to memory of 3540 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 3540 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 3540 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 2744 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 2744 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 2744 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 3544 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 3544 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 3544 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1348 wrote to memory of 4816 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1348 wrote to memory of 4816 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1280 wrote to memory of 4848 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1280 wrote to memory of 4848 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1280 wrote to memory of 4848 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4848 wrote to memory of 400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4848 wrote to memory of 400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4848 wrote to memory of 400 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe

"C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe

"C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 67.32.209.4.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 132.158.30.184.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 c784bade-51f1-4c46-88e4-5a1fc160a96a.uuid.dumperstats.org udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 stun.stunprotocol.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server9.dumperstats.org udp
US 162.159.134.233:443 cdn.discordapp.com tcp
N/A 127.0.0.1:3478 udp
BG 185.82.216.111:443 server9.dumperstats.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
BG 185.82.216.111:443 server9.dumperstats.org tcp
US 8.8.8.8:53 stun.l.google.com udp
US 74.125.250.129:19302 stun.l.google.com udp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.111:443 server9.dumperstats.org tcp

Files

memory/4528-1-0x0000000003B70000-0x0000000003F6D000-memory.dmp

memory/4528-2-0x0000000003F70000-0x000000000485B000-memory.dmp

memory/4528-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3652-4-0x0000000004F50000-0x0000000004F86000-memory.dmp

memory/3652-5-0x0000000074540000-0x0000000074CF0000-memory.dmp

memory/3652-6-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/3652-7-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/3652-8-0x0000000005730000-0x0000000005D58000-memory.dmp

memory/3652-9-0x0000000005550000-0x0000000005572000-memory.dmp

memory/3652-10-0x0000000005E50000-0x0000000005EB6000-memory.dmp

memory/3652-16-0x0000000005EC0000-0x0000000005F26000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zkuyhw1y.1uo.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3652-21-0x0000000006030000-0x0000000006384000-memory.dmp

memory/3652-22-0x0000000006520000-0x000000000653E000-memory.dmp

memory/3652-23-0x0000000006580000-0x00000000065CC000-memory.dmp

memory/3652-24-0x0000000006A90000-0x0000000006AD4000-memory.dmp

memory/3652-25-0x0000000007850000-0x00000000078C6000-memory.dmp

memory/3652-26-0x0000000007F50000-0x00000000085CA000-memory.dmp

memory/3652-27-0x00000000078F0000-0x000000000790A000-memory.dmp

memory/3652-30-0x00000000703E0000-0x000000007042C000-memory.dmp

memory/3652-29-0x0000000007AB0000-0x0000000007AE2000-memory.dmp

memory/3652-28-0x000000007EF10000-0x000000007EF20000-memory.dmp

memory/3652-31-0x0000000070560000-0x00000000708B4000-memory.dmp

memory/3652-41-0x0000000007AF0000-0x0000000007B0E000-memory.dmp

memory/3652-42-0x0000000007B10000-0x0000000007BB3000-memory.dmp

memory/3652-43-0x0000000007C00000-0x0000000007C0A000-memory.dmp

memory/3652-44-0x00000000050F0000-0x0000000005100000-memory.dmp

memory/3652-45-0x0000000007D10000-0x0000000007DA6000-memory.dmp

memory/3652-46-0x0000000007C10000-0x0000000007C21000-memory.dmp

memory/3652-47-0x0000000007C50000-0x0000000007C5E000-memory.dmp

memory/3652-48-0x0000000007C70000-0x0000000007C84000-memory.dmp

memory/3652-49-0x0000000007CB0000-0x0000000007CCA000-memory.dmp

memory/3652-50-0x0000000007CA0000-0x0000000007CA8000-memory.dmp

memory/3652-53-0x0000000074540000-0x0000000074CF0000-memory.dmp

memory/3076-55-0x0000000003AF0000-0x0000000003EEF000-memory.dmp

memory/4528-56-0x0000000003B70000-0x0000000003F6D000-memory.dmp

memory/3076-57-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4528-58-0x0000000003F70000-0x000000000485B000-memory.dmp

memory/4092-61-0x0000000005AD0000-0x0000000005E24000-memory.dmp

memory/4092-60-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

memory/4092-59-0x0000000074540000-0x0000000074CF0000-memory.dmp

memory/4092-71-0x000000007FA30000-0x000000007FA40000-memory.dmp

memory/4092-72-0x00000000703E0000-0x000000007042C000-memory.dmp

memory/4092-73-0x0000000070B60000-0x0000000070EB4000-memory.dmp

memory/4092-83-0x00000000073A0000-0x0000000007443000-memory.dmp

memory/4528-84-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4092-85-0x0000000002AD0000-0x0000000002AE0000-memory.dmp

memory/4092-86-0x00000000076B0000-0x00000000076C1000-memory.dmp

memory/4092-87-0x0000000007700000-0x0000000007714000-memory.dmp

memory/4092-90-0x0000000074540000-0x0000000074CF0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4636-93-0x0000000074540000-0x0000000074CF0000-memory.dmp

memory/4636-94-0x00000000049E0000-0x00000000049F0000-memory.dmp

memory/4636-95-0x00000000049E0000-0x00000000049F0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ee301b4046a6aa8a0a4628f2c95a52e7
SHA1 f103c779046e8a57b23379404d1fcbabc515e285
SHA256 ac748c384109b86a9fd99b17a7d1eb6b145e6c2395fe71dfcbdc7c1190e79b14
SHA512 d5ff37cad2958b2ac00ad25eb68d0c451037fa82b1382e98999ef1b3e2c67cf49ee9849c768d4347a24f213a19c300edb922a85d2357748ac2fab6ffeaca58b0

memory/4636-109-0x0000000070B60000-0x0000000070EB4000-memory.dmp

memory/4636-108-0x000000007FDE0000-0x000000007FDF0000-memory.dmp

memory/4636-107-0x00000000703E0000-0x000000007042C000-memory.dmp

memory/4636-119-0x00000000049E0000-0x00000000049F0000-memory.dmp

memory/3076-106-0x0000000003AF0000-0x0000000003EEF000-memory.dmp

memory/4636-121-0x0000000074540000-0x0000000074CF0000-memory.dmp

memory/4912-122-0x0000000074540000-0x0000000074CF0000-memory.dmp

memory/4912-123-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

memory/3076-124-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 bb76f984da26d2feefebe091d393e61d
SHA1 f5ffa827f1fe1f6699c000ada5790de142581b5c
SHA256 a46300ba974a3016c513d0fee0c4d54260c25f7d618f60e0f37d3fb6ef787e75
SHA512 cc250a7c5a2079c04c6ae90250999c307f65dc2e1956e1bcf5ebf28989f1ae53af451a8c1be4dff06d6ec85bbde00a502f90b57eb222e157ab654428d72a0d25

memory/4912-135-0x00000000703E0000-0x000000007042C000-memory.dmp

memory/4912-136-0x0000000070560000-0x00000000708B4000-memory.dmp

memory/4912-146-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 3659da1ddafd9a0e9815370308f7e4cf
SHA1 fe40d45dad40839a077aff064721febfc8499eeb
SHA256 f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64
SHA512 de7d225ffb94f18af6a0603e83ed8db5315a2eda524d5b57494ca29e154cac6d483de8b32894881e7fb96d1b54f6443ca681a7f8d25ad3a3e615a06346626283

memory/3076-153-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 93b411dcf80d85d303e2080cf248ea83
SHA1 929332bb8e5b03db59d359859a75e3ea68635e29
SHA256 f2c50a8cfe27d2be73f607eb26d5c4d348f92a88c58b96ff113bc7d8a4ac69a4
SHA512 ed2cd07a7d185e4d1aba7f1a9b4b181bd47c5314e22b073fd96bcb685a878de2e6776dc4e0439b7c518761e8cc1f057ad0f915616008377c2e1c976bf2ed9a08

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 35510aab2396d7678bc231613fdd3d0f
SHA1 b90ec70f1a9da567576ab1acafb33a4424100c81
SHA256 be4374186c8045d5331f895c8456bcec48d935b1046942a366ed56895c71d0a3
SHA512 a001905248f761658bb260fc74a1424c462c17b811cfb7b33c5c2ff88f308aaef8e3f685eb5670811cd6202cde99f2626aac25456cc914a3920c72bd1d54293c

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4f19617895543d71aa3729caec0564bb
SHA1 ce7934d51e2ed97a37da22f66729edf95793e00f
SHA256 1b0ade261953f7f746846ef6c6e78a3b578bcdd5ba45bf26bc03ff9e4c1794f8
SHA512 11101941ab72fd3c16311e669a5e66431d7d9abac68d04bf064cee3346bcd01d2cab704c3c724d622f0975f14f27ecefb62b2e757671584ed4fb7324b97dd3d5

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1348-255-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1280-263-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1348-264-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/5032-266-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1348-267-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1348-270-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/5032-272-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1348-273-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1348-276-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1348-279-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/5032-281-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1348-282-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1348-285-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1348-288-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1348-291-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1348-294-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1348-297-0x0000000000400000-0x0000000001DFD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 16:10

Reported

2024-04-19 16:13

Platform

win11-20240412-en

Max time kernel

149s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-162 = "Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2796 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2796 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\system32\cmd.exe
PID 2452 wrote to memory of 4144 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\system32\cmd.exe
PID 4144 wrote to memory of 2456 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4144 wrote to memory of 2456 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2452 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\rss\csrss.exe
PID 2452 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\rss\csrss.exe
PID 2452 wrote to memory of 4756 N/A C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe C:\Windows\rss\csrss.exe
PID 4756 wrote to memory of 2176 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4756 wrote to memory of 2176 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4756 wrote to memory of 2176 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4756 wrote to memory of 912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4756 wrote to memory of 912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4756 wrote to memory of 912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4756 wrote to memory of 5108 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4756 wrote to memory of 5108 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4756 wrote to memory of 5108 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4756 wrote to memory of 4572 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4756 wrote to memory of 4572 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1056 wrote to memory of 3288 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1056 wrote to memory of 3288 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1056 wrote to memory of 3288 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3288 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3288 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3288 wrote to memory of 5112 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe

"C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe

"C:\Users\Admin\AppData\Local\Temp\f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 6bd71a4a-1c65-4412-bd1c-121278873f9f.uuid.dumperstats.org udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 15.197.250.192:3478 stun.sipgate.net udp
US 162.159.130.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server11.dumperstats.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
BG 185.82.216.111:443 server11.dumperstats.org tcp
NL 52.111.243.29:443 tcp
BG 185.82.216.111:443 server11.dumperstats.org tcp

Files

memory/2796-1-0x0000000003B10000-0x0000000003F0B000-memory.dmp

memory/2796-2-0x0000000003F10000-0x00000000047FB000-memory.dmp

memory/2796-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4948-4-0x0000000004670000-0x00000000046A6000-memory.dmp

memory/4948-5-0x0000000074A20000-0x00000000751D1000-memory.dmp

memory/4948-7-0x0000000004D10000-0x000000000533A000-memory.dmp

memory/4948-6-0x00000000046D0000-0x00000000046E0000-memory.dmp

memory/4948-8-0x00000000046D0000-0x00000000046E0000-memory.dmp

memory/4948-9-0x0000000004C70000-0x0000000004C92000-memory.dmp

memory/4948-10-0x0000000005340000-0x00000000053A6000-memory.dmp

memory/4948-16-0x00000000055E0000-0x0000000005646000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5niz2cee.yvj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4948-20-0x0000000005700000-0x0000000005A57000-memory.dmp

memory/4948-21-0x0000000005B10000-0x0000000005B2E000-memory.dmp

memory/4948-22-0x0000000005B60000-0x0000000005BAC000-memory.dmp

memory/4948-23-0x00000000060E0000-0x0000000006126000-memory.dmp

memory/4948-24-0x000000007FD00000-0x000000007FD10000-memory.dmp

memory/4948-25-0x0000000006FD0000-0x0000000007004000-memory.dmp

memory/4948-26-0x0000000070C90000-0x0000000070CDC000-memory.dmp

memory/4948-27-0x0000000070E10000-0x0000000071167000-memory.dmp

memory/4948-36-0x0000000007010000-0x000000000702E000-memory.dmp

memory/4948-37-0x00000000046D0000-0x00000000046E0000-memory.dmp

memory/4948-38-0x0000000007030000-0x00000000070D4000-memory.dmp

memory/4948-39-0x00000000077A0000-0x0000000007E1A000-memory.dmp

memory/4948-40-0x0000000007160000-0x000000000717A000-memory.dmp

memory/4948-41-0x00000000071A0000-0x00000000071AA000-memory.dmp

memory/4948-42-0x00000000072B0000-0x0000000007346000-memory.dmp

memory/4948-43-0x00000000071C0000-0x00000000071D1000-memory.dmp

memory/4948-44-0x0000000007210000-0x000000000721E000-memory.dmp

memory/4948-45-0x0000000007220000-0x0000000007235000-memory.dmp

memory/4948-46-0x0000000007270000-0x000000000728A000-memory.dmp

memory/4948-47-0x0000000007290000-0x0000000007298000-memory.dmp

memory/4948-50-0x0000000074A20000-0x00000000751D1000-memory.dmp

memory/2452-52-0x0000000003B50000-0x0000000003F54000-memory.dmp

memory/2452-53-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2796-54-0x0000000003B10000-0x0000000003F0B000-memory.dmp

memory/2452-55-0x0000000003F60000-0x000000000484B000-memory.dmp

memory/4664-64-0x0000000074A20000-0x00000000751D1000-memory.dmp

memory/4664-65-0x0000000002B10000-0x0000000002B20000-memory.dmp

memory/4664-66-0x0000000002B10000-0x0000000002B20000-memory.dmp

memory/2796-67-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4664-68-0x000000007FAE0000-0x000000007FAF0000-memory.dmp

memory/4664-70-0x0000000070E10000-0x0000000071167000-memory.dmp

memory/4664-69-0x0000000070C90000-0x0000000070CDC000-memory.dmp

memory/4664-79-0x00000000071C0000-0x0000000007264000-memory.dmp

memory/4664-80-0x0000000002B10000-0x0000000002B20000-memory.dmp

memory/4664-81-0x00000000074F0000-0x0000000007501000-memory.dmp

memory/4664-82-0x0000000007540000-0x0000000007555000-memory.dmp

memory/4664-85-0x0000000074A20000-0x00000000751D1000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/4672-88-0x0000000074A20000-0x00000000751D1000-memory.dmp

memory/4672-90-0x00000000048D0000-0x00000000048E0000-memory.dmp

memory/4672-89-0x00000000048D0000-0x00000000048E0000-memory.dmp

memory/4672-91-0x0000000005620000-0x0000000005977000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2d6f22f761eddbd64cf32bde1a1f7ecd
SHA1 d84271652e2caeaec7bd76ee0e8442e79965b475
SHA256 699b1e70d7bba16e1127aaa7e8d53c263eded5fe12c9882a01c3c26bafb672b9
SHA512 22883dfe4bb199c6a6426a8e35313488002601c3da3959e4a242656a2b3bb3160b069a88110862fa9cc772085d8199912cb277a9047b574a703982c09c8b62bd

memory/4672-101-0x000000007FD60000-0x000000007FD70000-memory.dmp

memory/4672-102-0x0000000070C90000-0x0000000070CDC000-memory.dmp

memory/4672-103-0x0000000070EE0000-0x0000000071237000-memory.dmp

memory/2452-109-0x0000000003B50000-0x0000000003F54000-memory.dmp

memory/4672-113-0x00000000048D0000-0x00000000048E0000-memory.dmp

memory/4672-115-0x0000000074A20000-0x00000000751D1000-memory.dmp

memory/3708-116-0x0000000074A20000-0x00000000751D1000-memory.dmp

memory/2452-125-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3708-126-0x0000000003490000-0x00000000034A0000-memory.dmp

memory/3708-128-0x0000000003490000-0x00000000034A0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 dea17ae71250e017dd072e548eb0e124
SHA1 0674f660c34a1949329c459b060ae3a03015b656
SHA256 00e491751665ec274db91bc68bd5024d9a052a567be8b390ca3b7bdc169eb1af
SHA512 2cd479dc7822c5e35b06df88cd726a191013a0ef916dcc72b81d9d960a71d7a3b3e2e419a54e4672c791db453f05a4c49e15a0313424bb3ed259dd6bc2aa6364

memory/3708-130-0x0000000070C90000-0x0000000070CDC000-memory.dmp

memory/3708-129-0x000000007FDE0000-0x000000007FDF0000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 3659da1ddafd9a0e9815370308f7e4cf
SHA1 fe40d45dad40839a077aff064721febfc8499eeb
SHA256 f0f0929cc5945ccea5b2c2a3be9c30bd0129d46f78a782a70a04969ee4b51a64
SHA512 de7d225ffb94f18af6a0603e83ed8db5315a2eda524d5b57494ca29e154cac6d483de8b32894881e7fb96d1b54f6443ca681a7f8d25ad3a3e615a06346626283

memory/2452-148-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1c9cdcefe7d2c15f20367cb607f1ed45
SHA1 6f0c557c410cf3cafa5b33573fbdd56db09b30b4
SHA256 06d1a4b74e32d097dbc0c5237cdd4c73dabad5d3617316df4dfc4c7bca425b9c
SHA512 110ad84bbc3c5dafdda33c8201e547b04707702a0de8923c7dfb20904bc7ba993ea3f9bb6254b9df4822eb58b50f3834fee5748cbb43ce8f738d175d92a3048e

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 28930a7b9116ed8a8a83a42b1510629e
SHA1 fe106a82470208529f086a4305c1c38391de83c5
SHA256 47acc4df2e88cede08f3147c46dad4b2f121bb38844c47e11aceb6145f43317c
SHA512 68cf33a91a54253df7f5fabdbbdfda9c7767a425d5d0699d1a2a73ac29389cce65abfebd469e1ef90448a86ee36f0e0a654943e0c96fbe6b311952da5bce3292

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 fc6d8262a9fc9bd8ba4401e25d9003f2
SHA1 136067ff993914f0b934e646a6aec8957cdee17e
SHA256 ae27c01d7370f4d1ef2146160a4d48a64967c24380c4c5441dc18fedb4d9401b
SHA512 a86d5083b8675f11a5c0972f50d780b0bd904a0cfbda01796f61d7af78cf719fa29975a9458bd55789579020d2d9e5d2d0f2c1952a7a9d8a37b2de2d046ac66c

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4756-239-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1056-248-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4756-250-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1552-253-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4756-254-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4756-258-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1552-260-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4756-262-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4756-266-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4756-270-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/1552-272-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4756-274-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4756-278-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4756-282-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4756-286-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4756-290-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4756-294-0x0000000000400000-0x0000000001DFD000-memory.dmp