Malware Analysis Report

2025-08-06 03:33

Sample ID 240419-wf55ssbb89
Target c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab
SHA256 c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab

Threat Level: Known bad

The file c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Manipulates WinMonFS driver.

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Drops file in Windows directory

Program crash

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 17:52

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 17:52

Reported

2024-04-19 17:56

Platform

win10v2004-20240412-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3196 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3196 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3196 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 4048 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\system32\cmd.exe
PID 4580 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\system32\cmd.exe
PID 2000 wrote to memory of 3844 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2000 wrote to memory of 3844 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4580 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 3564 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 1440 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\rss\csrss.exe
PID 4580 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\rss\csrss.exe
PID 4580 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\rss\csrss.exe
PID 4008 wrote to memory of 2896 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4008 wrote to memory of 2896 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4008 wrote to memory of 2896 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4008 wrote to memory of 4888 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4008 wrote to memory of 4888 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4008 wrote to memory of 4888 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4008 wrote to memory of 4292 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4008 wrote to memory of 4292 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4008 wrote to memory of 4292 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4008 wrote to memory of 648 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4008 wrote to memory of 648 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2168 wrote to memory of 628 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 628 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 628 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 628 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 628 wrote to memory of 2092 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe

"C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe

"C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 132.46.30.184.in-addr.arpa udp
US 8.8.8.8:53 6ee69f29-330e-4eaa-ab89-589f4820343b.uuid.thestatsfiles.ru udp
US 8.8.8.8:53 stun.ipfire.org udp
US 8.8.8.8:53 server12.thestatsfiles.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
DE 81.3.27.44:3478 stun.ipfire.org udp
BG 185.82.216.96:443 server12.thestatsfiles.ru tcp
US 8.8.8.8:53 44.27.3.81.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
BG 185.82.216.96:443 server12.thestatsfiles.ru tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
BG 185.82.216.96:443 server12.thestatsfiles.ru tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.96:443 server12.thestatsfiles.ru tcp
N/A 127.0.0.1:31465 tcp

Files

memory/3196-1-0x0000000003C00000-0x0000000003FF9000-memory.dmp

memory/3196-2-0x0000000004000000-0x00000000048EB000-memory.dmp

memory/3196-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2236-5-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/2236-4-0x0000000004DE0000-0x0000000004E16000-memory.dmp

memory/2236-6-0x0000000004D90000-0x0000000004DA0000-memory.dmp

memory/2236-8-0x0000000005450000-0x0000000005A78000-memory.dmp

memory/2236-7-0x0000000004D90000-0x0000000004DA0000-memory.dmp

memory/2236-9-0x00000000053E0000-0x0000000005402000-memory.dmp

memory/2236-10-0x0000000005BF0000-0x0000000005C56000-memory.dmp

memory/2236-11-0x0000000005D50000-0x0000000005DB6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zunawd1r.0p0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2236-21-0x0000000005F10000-0x0000000006264000-memory.dmp

memory/2236-22-0x0000000006380000-0x000000000639E000-memory.dmp

memory/2236-23-0x00000000064F0000-0x000000000653C000-memory.dmp

memory/2236-24-0x0000000007310000-0x0000000007354000-memory.dmp

memory/2236-25-0x00000000076B0000-0x0000000007726000-memory.dmp

memory/2236-27-0x0000000007750000-0x000000000776A000-memory.dmp

memory/2236-26-0x0000000007DB0000-0x000000000842A000-memory.dmp

memory/2236-31-0x0000000070010000-0x0000000070364000-memory.dmp

memory/2236-30-0x000000006FE90000-0x000000006FEDC000-memory.dmp

memory/2236-42-0x0000000004D90000-0x0000000004DA0000-memory.dmp

memory/2236-43-0x0000000007970000-0x0000000007A13000-memory.dmp

memory/2236-41-0x0000000007950000-0x000000000796E000-memory.dmp

memory/2236-29-0x0000000007910000-0x0000000007942000-memory.dmp

memory/2236-28-0x000000007EFC0000-0x000000007EFD0000-memory.dmp

memory/2236-44-0x0000000007A60000-0x0000000007A6A000-memory.dmp

memory/2236-45-0x0000000007B20000-0x0000000007BB6000-memory.dmp

memory/2236-46-0x0000000007A80000-0x0000000007A91000-memory.dmp

memory/2236-47-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

memory/2236-48-0x0000000007AD0000-0x0000000007AE4000-memory.dmp

memory/2236-50-0x0000000007B10000-0x0000000007B18000-memory.dmp

memory/2236-49-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

memory/2236-53-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/4580-55-0x0000000003B00000-0x0000000003F01000-memory.dmp

memory/4580-56-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4580-57-0x0000000003F10000-0x00000000047FB000-memory.dmp

memory/4048-67-0x0000000005190000-0x00000000051A0000-memory.dmp

memory/3196-69-0x0000000003C00000-0x0000000003FF9000-memory.dmp

memory/4048-70-0x0000000005190000-0x00000000051A0000-memory.dmp

memory/4048-68-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/4048-72-0x0000000070010000-0x0000000070364000-memory.dmp

memory/4048-82-0x0000000007750000-0x00000000077F3000-memory.dmp

memory/3196-83-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4048-84-0x0000000005190000-0x00000000051A0000-memory.dmp

memory/4048-85-0x0000000005190000-0x00000000051A0000-memory.dmp

memory/4048-71-0x000000006FE90000-0x000000006FEDC000-memory.dmp

memory/4048-86-0x0000000007A70000-0x0000000007A81000-memory.dmp

memory/4048-87-0x0000000007AC0000-0x0000000007AD4000-memory.dmp

memory/4048-90-0x0000000073FF0000-0x00000000747A0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/3564-92-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/3564-94-0x0000000001290000-0x00000000012A0000-memory.dmp

memory/3564-93-0x0000000001290000-0x00000000012A0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9d126dd32cb6efd2134eea312b9eddee
SHA1 816033d56c5131b6d77544c7790cffefc083e15c
SHA256 ff32b53e3ad1559d22fb07ee032191ea4aca0ab6a60329450082eeabd2b765f2
SHA512 852fd15312a341cf8c7d63967513dcc4456357b3853a775d59cab8b7119450ca715ffe84356087d0ed037290a0ddfa4f845d34828d9ac8a5b46fa05b50c58bba

memory/3564-106-0x000000006FE90000-0x000000006FEDC000-memory.dmp

memory/3564-117-0x0000000001290000-0x00000000012A0000-memory.dmp

memory/3564-118-0x0000000001290000-0x00000000012A0000-memory.dmp

memory/3564-107-0x0000000070010000-0x0000000070364000-memory.dmp

memory/3564-105-0x000000007EF80000-0x000000007EF90000-memory.dmp

memory/3564-120-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/1440-121-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/1440-122-0x0000000000C20000-0x0000000000C30000-memory.dmp

memory/1440-123-0x0000000000C20000-0x0000000000C30000-memory.dmp

memory/4580-124-0x0000000003B00000-0x0000000003F01000-memory.dmp

memory/1440-131-0x00000000055E0000-0x0000000005934000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 218c2330045feb8b3f02b3d557727f3e
SHA1 f98f3ef5a7f603516431c86d8a7b7ba71e600cd9
SHA256 04ec6c76794fe46fdc9786a3c6f4c9135344ce7364cb7c1af553802e63dba23c
SHA512 cd38e8d1b2fb9a7df353018bbeeee53ac94a3814b980061364dced494be8bc851b58c0fbd440c1d5c5d1a3b8b6144b6efc468430264e6d4dbec4fc17ef558c74

memory/1440-136-0x000000006FE90000-0x000000006FEDC000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 d8816ed8b56dae3d982af42125a864cb
SHA1 14f694bde2c90ab8ba9f3e5ad715ce17ded0fe3e
SHA256 c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab
SHA512 fe265eff381f7cba0827497e7ccb8a224c1229f2a73fd6324eca8bcc9a5e1fdec898406afe74ded666fa7dbbc38c74348c245a86db762a699fc9c060a1e85654

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3d69b3c070212236fd387fe9a0f5eaf0
SHA1 0b74d621400a5bc6416a8de336d9f407ffd827f4
SHA256 d2b0fc77a58c020430aa745856422c21d59292e51bf43636d8aa442090b17208
SHA512 fba3f1189f8a18c495daafec000a7057994eef7792048e1f6c45b405f110a484f6a491390e9e2864f5bd537ed1b14eac1c98b07395f8dcf13167f3d6a8bb0c80

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 26dc375fcada8491cc2c12b79220ef5f
SHA1 e895bb14e0a3ed46af30652f72a967073089f557
SHA256 dc4a6448e86ff5d32b959f361cd1a5d3fddaeab90619a5c86605d05ec175fd4d
SHA512 88a8fef14aecbb9f12075e69a8b491646bad7ab94359e65279ef05afe36e7ac736b50fca106bae9f177052eea3e3a472f740bbc5def494e07dd5c4ba6f8e19aa

memory/4580-222-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a870dbe54882bcc8fcbe35e96d81c47b
SHA1 be0d2862326fbad1deac4dd5b79b4d3467cf2a0f
SHA256 ce7d8dfe37ae8fbc1b686ee60c57916f8b242c420938fb28e2754643461b01af
SHA512 d9bb542e0072a0f5d0c2d0f42e89268de958920fa4c5d505d26f1cb3396fee0618df0b36605ef4a9e0e993347f7b1db24f764f818378ca17e536e6cea5adfcf1

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4008-258-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2168-266-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4008-269-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4576-271-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4008-273-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4008-277-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4576-279-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4008-281-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4008-285-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4008-289-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4008-293-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4008-297-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4008-301-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4008-305-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4008-309-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4008-313-0x0000000000400000-0x0000000001DFD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 17:52

Reported

2024-04-19 17:55

Platform

win11-20240412-en

Max time kernel

150s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3856 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3856 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3856 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\system32\cmd.exe
PID 3280 wrote to memory of 1368 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\system32\cmd.exe
PID 1368 wrote to memory of 4868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1368 wrote to memory of 4868 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3280 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 4636 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 3320 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3280 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\rss\csrss.exe
PID 3280 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\rss\csrss.exe
PID 3280 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe C:\Windows\rss\csrss.exe
PID 2432 wrote to memory of 3252 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 3252 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 3252 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 2012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 2012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 2012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 1668 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 1668 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 1668 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 1484 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2432 wrote to memory of 1484 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1328 wrote to memory of 1496 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1328 wrote to memory of 1496 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1328 wrote to memory of 1496 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1496 wrote to memory of 4448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1496 wrote to memory of 4448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1496 wrote to memory of 4448 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe

"C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2724 -ip 2724

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2724 -s 2428

C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe

"C:\Users\Admin\AppData\Local\Temp\c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 b9f66ff6-5daa-434f-8526-0ad2cdb98f00.uuid.thestatsfiles.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server16.thestatsfiles.ru udp
US 162.159.134.233:443 cdn.discordapp.com tcp
IT 142.251.27.127:19302 stun3.l.google.com udp
BG 185.82.216.96:443 server16.thestatsfiles.ru tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.96:443 server16.thestatsfiles.ru tcp
BG 185.82.216.96:443 server16.thestatsfiles.ru tcp

Files

memory/3856-1-0x0000000003CC0000-0x00000000040BB000-memory.dmp

memory/3856-2-0x00000000040C0000-0x00000000049AB000-memory.dmp

memory/3856-3-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2724-4-0x0000000002900000-0x0000000002936000-memory.dmp

memory/2724-5-0x0000000074250000-0x0000000074A01000-memory.dmp

memory/2724-7-0x00000000052A0000-0x00000000058CA000-memory.dmp

memory/2724-8-0x0000000004C60000-0x0000000004C70000-memory.dmp

memory/2724-6-0x0000000004C60000-0x0000000004C70000-memory.dmp

memory/2724-9-0x0000000004F40000-0x0000000004F62000-memory.dmp

memory/2724-10-0x0000000004FE0000-0x0000000005046000-memory.dmp

memory/2724-11-0x00000000058D0000-0x0000000005936000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g3z0jiac.fmf.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2724-20-0x0000000005940000-0x0000000005C97000-memory.dmp

memory/2724-21-0x0000000005DD0000-0x0000000005DEE000-memory.dmp

memory/2724-22-0x0000000005E90000-0x0000000005EDC000-memory.dmp

memory/2724-23-0x0000000006360000-0x00000000063A6000-memory.dmp

memory/2724-24-0x000000007F7A0000-0x000000007F7B0000-memory.dmp

memory/2724-25-0x0000000007270000-0x00000000072A4000-memory.dmp

memory/2724-26-0x00000000704C0000-0x000000007050C000-memory.dmp

memory/2724-27-0x0000000070640000-0x0000000070997000-memory.dmp

memory/2724-36-0x00000000072D0000-0x00000000072EE000-memory.dmp

memory/2724-37-0x00000000072F0000-0x0000000007394000-memory.dmp

memory/2724-38-0x0000000007A60000-0x00000000080DA000-memory.dmp

memory/2724-39-0x0000000007420000-0x000000000743A000-memory.dmp

memory/2724-40-0x0000000007460000-0x000000000746A000-memory.dmp

memory/2724-41-0x0000000074250000-0x0000000074A01000-memory.dmp

memory/3280-43-0x0000000003CD0000-0x00000000040CB000-memory.dmp

memory/3280-44-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3856-45-0x0000000003CC0000-0x00000000040BB000-memory.dmp

memory/3768-46-0x0000000074250000-0x0000000074A01000-memory.dmp

memory/3768-47-0x00000000049E0000-0x00000000049F0000-memory.dmp

memory/3768-48-0x00000000049E0000-0x00000000049F0000-memory.dmp

memory/3768-50-0x00000000057A0000-0x0000000005AF7000-memory.dmp

memory/3856-49-0x00000000040C0000-0x00000000049AB000-memory.dmp

memory/3768-60-0x00000000704C0000-0x000000007050C000-memory.dmp

memory/3768-59-0x000000007EF20000-0x000000007EF30000-memory.dmp

memory/3768-61-0x0000000070710000-0x0000000070A67000-memory.dmp

memory/3768-70-0x0000000006EB0000-0x0000000006F54000-memory.dmp

memory/3856-71-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/3768-72-0x00000000049E0000-0x00000000049F0000-memory.dmp

memory/3768-73-0x00000000072E0000-0x0000000007376000-memory.dmp

memory/3768-74-0x0000000007200000-0x0000000007211000-memory.dmp

memory/3768-75-0x0000000007240000-0x000000000724E000-memory.dmp

memory/3768-76-0x0000000007250000-0x0000000007265000-memory.dmp

memory/3768-77-0x0000000007290000-0x00000000072AA000-memory.dmp

memory/3768-78-0x00000000072B0000-0x00000000072B8000-memory.dmp

memory/3768-81-0x0000000074250000-0x0000000074A01000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/4636-84-0x0000000074250000-0x0000000074A01000-memory.dmp

memory/4636-94-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

memory/4636-93-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5545169ca290bb868a485578cffccc26
SHA1 1b80aac44597269669ff828a9baa07f23416cedd
SHA256 1bf5b16e66f1c16be6f561d0566cd8bef53d7b66f27916363b42c4594e1c7814
SHA512 003c038382eb767aec0834f9806406fc5cd6508e82d93e2c758849cf5ac332846a81417bfffd0995cf92ae60945767d15cecea83633d4741972fbbbd7bb6d346

memory/4636-96-0x000000007F690000-0x000000007F6A0000-memory.dmp

memory/4636-97-0x00000000704C0000-0x000000007050C000-memory.dmp

memory/4636-98-0x0000000070640000-0x0000000070997000-memory.dmp

memory/3280-107-0x0000000003CD0000-0x00000000040CB000-memory.dmp

memory/4636-108-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

memory/4636-110-0x0000000074250000-0x0000000074A01000-memory.dmp

memory/3320-112-0x0000000001460000-0x0000000001470000-memory.dmp

memory/3320-113-0x0000000001460000-0x0000000001470000-memory.dmp

memory/3320-111-0x0000000074250000-0x0000000074A01000-memory.dmp

memory/3320-122-0x0000000006150000-0x00000000064A7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a6481bb47149875041bd9abe0f697036
SHA1 d01de3c26b31bf5d75b1e1b1bbd24970cda1ed06
SHA256 e98b4f2ec097a06ac345aeccafd905f1eb93036f9eb50cdd86b35418199495fc
SHA512 4d6224e60e897566e6a6ff575aae758ae420fb806331f62ef3923d3afa878cac7790ae2d54ede99fd6e1c8359bb66d58005e085a5c4811b2585ae1b014c6a045

memory/3320-125-0x00000000704C0000-0x000000007050C000-memory.dmp

memory/3320-124-0x000000007F1C0000-0x000000007F1D0000-memory.dmp

memory/3320-126-0x0000000070660000-0x00000000709B7000-memory.dmp

memory/3320-136-0x0000000001460000-0x0000000001470000-memory.dmp

memory/3280-135-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 d8816ed8b56dae3d982af42125a864cb
SHA1 14f694bde2c90ab8ba9f3e5ad715ce17ded0fe3e
SHA256 c16f62239a06fbbbf00415264823de4c8d11543f765e1b53ea08976e49a340ab
SHA512 fe265eff381f7cba0827497e7ccb8a224c1229f2a73fd6324eca8bcc9a5e1fdec898406afe74ded666fa7dbbc38c74348c245a86db762a699fc9c060a1e85654

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7cb45dbe48c642ae9cb447aeae1128d9
SHA1 80c1277377508a16c23567eb9fc6702a36d29866
SHA256 f988facf1fa506b629aa6c932d9978cc3a309591c3ea11b6e528922b30dc6ff8
SHA512 3b0d59e812b3b0b13f0823268bf0af4020e96c67a78f4e5874a68e4f10272577f03847c6885bd76cb23183d0360356bf2db5a9af685f0788178e3d92c85190d6

memory/3280-159-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 46b3885947e3182d565bb4c3e2f99d4a
SHA1 e4ee563f1663c7384a5f2ce6818631b7dc98a247
SHA256 f5ada2ea0308f3971a1b1007f82e29251a2f75d8817f2dcac483b0d2c87304ef
SHA512 ef3ca48d79b823148dd966df248ff8946a09b5761ef8c2ac3ced78f26019ea82dd7c7ceed673b77991e103f4f02bdf61db4ea9744f994f7d0076ad6d1ed619e8

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2cf8b0c0c4dcc464140231859d61320f
SHA1 924bc578db05f581d497ddeca2ebc53cf470a5f8
SHA256 e2e8e655b07cabaa4c5acd57555ee9c6513b844bc660ae92d84062b8c05ccde9
SHA512 6fcb1282168919ecafa00dd8dd405fdfd83e95c2c2ac7d80ed397d4d313a6e386f031fd2d60215392273621bcc2cda111ce2d91094a562f847c11905223a334b

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2432-240-0x0000000000400000-0x0000000001DFD000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1328-248-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2432-250-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4940-253-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2432-254-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2432-258-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2432-261-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/4940-262-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2432-265-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2432-271-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2432-275-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2432-279-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2432-283-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2432-286-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2432-289-0x0000000000400000-0x0000000001DFD000-memory.dmp

memory/2432-293-0x0000000000400000-0x0000000001DFD000-memory.dmp