Malware Analysis Report

2025-08-05 12:17

Sample ID 240419-x32assdc43
Target ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c
SHA256 ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c
Tags
glupteba dropper evasion loader persistence upx discovery rootkit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c

Threat Level: Known bad

The file ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c was found to be: Known bad.

Malicious Activity Summary

glupteba dropper evasion loader persistence upx discovery rootkit

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Manipulates WinMonFS driver.

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Program crash

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 19:23

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 19:23

Reported

2024-04-19 19:26

Platform

win10v2004-20240412-en

Max time kernel

14s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3272 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3272 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3272 wrote to memory of 3616 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\system32\cmd.exe
PID 5080 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\system32\cmd.exe
PID 2396 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2396 wrote to memory of 2656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5080 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 3004 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5080 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\rss\csrss.exe
PID 5080 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\rss\csrss.exe
PID 5080 wrote to memory of 3752 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\rss\csrss.exe
PID 3752 wrote to memory of 1172 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3752 wrote to memory of 1172 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3752 wrote to memory of 1172 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe

"C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe

"C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3272 -ip 3272

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5080 -ip 5080

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 880

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 33.117.19.2.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 71946dc4-0105-42ad-860a-5c28aae8ebbe.uuid.databaseupgrade.ru udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 stun2.l.google.com udp
US 8.8.8.8:53 server15.databaseupgrade.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
BG 185.82.216.108:443 server15.databaseupgrade.ru tcp
US 162.159.135.233:443 cdn.discordapp.com tcp
NL 74.125.128.127:19302 stun2.l.google.com udp
US 8.8.8.8:53 carsalessystem.com udp
US 8.8.8.8:53 127.128.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
GB 104.77.118.121:80 tcp
US 8.8.8.8:53 121.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
BG 185.82.216.108:443 server15.databaseupgrade.ru tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 31.73.42.20.in-addr.arpa udp

Files

memory/3272-1-0x0000000003C50000-0x0000000004053000-memory.dmp

memory/3272-2-0x0000000004060000-0x000000000494B000-memory.dmp

memory/3272-3-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3616-4-0x00000000033E0000-0x0000000003416000-memory.dmp

memory/3616-5-0x0000000074880000-0x0000000075030000-memory.dmp

memory/3616-6-0x0000000003450000-0x0000000003460000-memory.dmp

memory/3616-8-0x0000000005B20000-0x0000000006148000-memory.dmp

memory/3616-7-0x0000000003450000-0x0000000003460000-memory.dmp

memory/3616-9-0x00000000059E0000-0x0000000005A02000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v3mrbqkc.hmj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3616-10-0x00000000061C0000-0x0000000006226000-memory.dmp

memory/3616-16-0x0000000006360000-0x00000000063C6000-memory.dmp

memory/3616-21-0x00000000064D0000-0x0000000006824000-memory.dmp

memory/3616-22-0x00000000069A0000-0x00000000069BE000-memory.dmp

memory/3616-23-0x00000000069E0000-0x0000000006A2C000-memory.dmp

memory/3616-24-0x0000000007B20000-0x0000000007B64000-memory.dmp

memory/3616-25-0x0000000007CC0000-0x0000000007D36000-memory.dmp

memory/3616-27-0x0000000007D60000-0x0000000007D7A000-memory.dmp

memory/3616-26-0x00000000083C0000-0x0000000008A3A000-memory.dmp

memory/3616-31-0x00000000708A0000-0x0000000070BF4000-memory.dmp

memory/3616-30-0x0000000070720000-0x000000007076C000-memory.dmp

memory/3616-43-0x0000000007F80000-0x0000000008023000-memory.dmp

memory/3616-42-0x0000000003450000-0x0000000003460000-memory.dmp

memory/3616-41-0x0000000007F60000-0x0000000007F7E000-memory.dmp

memory/3616-29-0x0000000007F20000-0x0000000007F52000-memory.dmp

memory/3616-44-0x0000000008070000-0x000000000807A000-memory.dmp

memory/3616-28-0x000000007FC60000-0x000000007FC70000-memory.dmp

memory/3616-45-0x0000000003450000-0x0000000003460000-memory.dmp

memory/3616-46-0x0000000008130000-0x00000000081C6000-memory.dmp

memory/3616-47-0x0000000008090000-0x00000000080A1000-memory.dmp

memory/3616-48-0x00000000080D0000-0x00000000080DE000-memory.dmp

memory/3616-49-0x00000000080E0000-0x00000000080F4000-memory.dmp

memory/3616-50-0x00000000081D0000-0x00000000081EA000-memory.dmp

memory/3616-51-0x0000000008120000-0x0000000008128000-memory.dmp

memory/3616-54-0x0000000074880000-0x0000000075030000-memory.dmp

memory/3272-57-0x0000000003C50000-0x0000000004053000-memory.dmp

memory/5080-56-0x0000000003C20000-0x000000000401E000-memory.dmp

memory/5080-59-0x0000000004020000-0x000000000490B000-memory.dmp

memory/3272-58-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/5080-60-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3504-63-0x0000000004870000-0x0000000004880000-memory.dmp

memory/3504-73-0x00000000054E0000-0x0000000005834000-memory.dmp

memory/3504-62-0x0000000004870000-0x0000000004880000-memory.dmp

memory/3504-61-0x0000000074960000-0x0000000075110000-memory.dmp

memory/3504-74-0x0000000005FD0000-0x000000000601C000-memory.dmp

memory/3504-75-0x000000007F580000-0x000000007F590000-memory.dmp

memory/3504-76-0x0000000070820000-0x000000007086C000-memory.dmp

memory/3504-77-0x0000000070FC0000-0x0000000071314000-memory.dmp

memory/3504-87-0x0000000004870000-0x0000000004880000-memory.dmp

memory/3504-88-0x0000000006CC0000-0x0000000006D63000-memory.dmp

memory/3504-89-0x0000000006FD0000-0x0000000006FE1000-memory.dmp

memory/3504-90-0x0000000007020000-0x0000000007034000-memory.dmp

memory/3504-93-0x0000000074960000-0x0000000075110000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/3004-97-0x0000000005100000-0x0000000005110000-memory.dmp

memory/3004-96-0x0000000005100000-0x0000000005110000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 648b7d54fa482e071c7d349d92c75973
SHA1 8811c209f6675ca03c5f6bcd1564ca8137ae52cc
SHA256 a54dbd64c1fb233db239933fbc1dc26d9b79882d77280cfaf99184a43e2cf485
SHA512 757fca3203c696ffd0d8e1bb6b93d5e85fcb648da60a01d5def2052d98b375ba6739b7348fbd541674fe3842eedfbc38114e9184fb4f4befa3cd72cb0d3a945c

memory/3004-107-0x0000000006040000-0x0000000006394000-memory.dmp

memory/3004-95-0x0000000074960000-0x0000000075110000-memory.dmp

memory/3004-110-0x0000000070820000-0x000000007086C000-memory.dmp

memory/3004-112-0x0000000070C10000-0x0000000070F64000-memory.dmp

memory/3004-122-0x0000000005100000-0x0000000005110000-memory.dmp

memory/3004-111-0x000000007FCA0000-0x000000007FCB0000-memory.dmp

memory/5080-109-0x0000000003C20000-0x000000000401E000-memory.dmp

memory/3004-124-0x0000000074960000-0x0000000075110000-memory.dmp

memory/116-125-0x0000000074960000-0x0000000075110000-memory.dmp

memory/116-127-0x0000000005100000-0x0000000005110000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b17067c956600bb3763aead0113870d0
SHA1 a2f6d894e8fbb52f6bec5f7326b454a551f56e5b
SHA256 953fe423cd5810126c33320e9bd98d0bb32b9223e4026f990b9224c5ca139536
SHA512 366562fd6fa63893d643ffba6923e97c5ea7c1e380eb51d990715f39d08ad8f85500602219a7a42a2ef7fcf8ba0c754e02fba4079ee7eba92f8bd1c88d4e8c74

memory/116-126-0x0000000005100000-0x0000000005110000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 d96d533aa193717e06c54716193d8b63
SHA1 1c2d63166e0495a201352d2e0f552500d623da88
SHA256 ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c
SHA512 0bd94bd99a7f657b34f32dd8b72ad38005c0e1c86106889d20144177f5adfd84ce56eee9c2917c5357458d8fcb05a55148e3f909bb3953cb699c7f96d48713ca

memory/5080-158-0x0000000000400000-0x0000000001E08000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4adb5c3ec317e9708ea8fd3212e21bd6
SHA1 7c14aa82ba66268aadc8fd2bf654654f47528d6a
SHA256 52a7b248090a1a0bfcb31fa74d390a57877aed97bfb4b1a792b5299fd97dbe97
SHA512 828faa305eb0795f4ffe81644579a42b36b4bffac70ac6533d82529a292b12fd8fa83c845f54ea2541d79412463398b370cc0cc8d828c751bbe0cbd422d32339

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7e8e71b14da2b252bec5205a9aec63b7
SHA1 ac3ea4e334c23b35aa5c89abc60ffa2ae716665b
SHA256 1ba4b7a251d5ac0c3640acd2dd5e444bf0d91f0803ee9625dd22ef31ce9db22c
SHA512 daa190a233f6f0fdc250e030aa6920db670b9168f6805b4821da25179eb97cbb94b6c2335158b409f73eeabfc470de92ef1592abc1607a485e26d4532d8466c5

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 99379ea331c52ee6a392b3f430a3e854
SHA1 e22552d0bdc4a00036ba55fb2a67e0263026c192
SHA256 1ffe9ea55e2589e64a3580f441306d616d36965af5fd6c4e3906c4fb905cfecc
SHA512 2d0cb82c2769ce8826b2e44a24b36d3e8d7f0477795895e0692ccdc0669a63af20ddcc701c02036dcfff8e5378bea4bca122060cbe8a180972f4e2b1c743563c

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3752-258-0x0000000000400000-0x0000000001E08000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2300-265-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3752-267-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4196-269-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3752-268-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3752-270-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3752-272-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4196-273-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3752-274-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3752-277-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3752-278-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3752-280-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3752-282-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3752-284-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3752-287-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3752-288-0x0000000000400000-0x0000000001E08000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 19:23

Reported

2024-04-19 19:26

Platform

win11-20240412-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4888 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4888 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4888 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 800 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\System32\Conhost.exe
PID 1584 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\System32\Conhost.exe
PID 2504 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2504 wrote to memory of 2176 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1584 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1584 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\rss\csrss.exe
PID 1584 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\rss\csrss.exe
PID 1584 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe C:\Windows\rss\csrss.exe
PID 2576 wrote to memory of 4312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 4312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 4312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 540 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 540 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 540 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 4888 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 4888 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 4888 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2576 wrote to memory of 2064 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2576 wrote to memory of 2064 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4464 wrote to memory of 1576 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4464 wrote to memory of 1576 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4464 wrote to memory of 1576 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1576 wrote to memory of 4756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1576 wrote to memory of 4756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1576 wrote to memory of 4756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe

"C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe

"C:\Users\Admin\AppData\Local\Temp\ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4888 -ip 4888

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 684

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1584 -ip 1584

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 d4029c95-fd00-4592-9a74-3359caa1d585.uuid.databaseupgrade.ru udp
US 8.8.8.8:53 stun4.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
CH 172.217.210.127:19302 stun4.l.google.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server10.databaseupgrade.ru tcp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
IE 52.111.236.23:443 tcp
BG 185.82.216.108:443 server10.databaseupgrade.ru tcp
BG 185.82.216.108:443 server10.databaseupgrade.ru tcp
N/A 127.0.0.1:31465 tcp

Files

memory/4888-1-0x0000000003E60000-0x000000000425D000-memory.dmp

memory/4888-2-0x0000000004260000-0x0000000004B4B000-memory.dmp

memory/4888-3-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4204-5-0x0000000074D30000-0x00000000754E1000-memory.dmp

memory/4204-4-0x0000000004E70000-0x0000000004EA6000-memory.dmp

memory/4204-6-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

memory/4204-7-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

memory/4204-8-0x0000000005610000-0x0000000005C3A000-memory.dmp

memory/4204-9-0x0000000005470000-0x0000000005492000-memory.dmp

memory/4204-10-0x0000000005C40000-0x0000000005CA6000-memory.dmp

memory/4204-11-0x0000000005D20000-0x0000000005D86000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_icltj0bn.inz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4204-20-0x0000000005E10000-0x0000000006167000-memory.dmp

memory/4204-21-0x0000000006330000-0x000000000634E000-memory.dmp

memory/4204-22-0x0000000006370000-0x00000000063BC000-memory.dmp

memory/4204-23-0x00000000068F0000-0x0000000006936000-memory.dmp

memory/4204-24-0x000000007EF70000-0x000000007EF80000-memory.dmp

memory/4204-25-0x0000000007760000-0x0000000007794000-memory.dmp

memory/4204-26-0x0000000070FA0000-0x0000000070FEC000-memory.dmp

memory/4204-27-0x00000000711D0000-0x0000000071527000-memory.dmp

memory/4204-36-0x00000000077A0000-0x00000000077BE000-memory.dmp

memory/4204-38-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

memory/4204-37-0x00000000077C0000-0x0000000007864000-memory.dmp

memory/4204-39-0x0000000007F30000-0x00000000085AA000-memory.dmp

memory/4204-40-0x00000000078F0000-0x000000000790A000-memory.dmp

memory/4204-41-0x0000000007930000-0x000000000793A000-memory.dmp

memory/4204-42-0x0000000007A40000-0x0000000007AD6000-memory.dmp

memory/4204-43-0x0000000007950000-0x0000000007961000-memory.dmp

memory/4204-44-0x00000000079A0000-0x00000000079AE000-memory.dmp

memory/4204-45-0x00000000079B0000-0x00000000079C5000-memory.dmp

memory/4204-46-0x0000000007A00000-0x0000000007A1A000-memory.dmp

memory/4204-47-0x0000000007A20000-0x0000000007A28000-memory.dmp

memory/4204-50-0x0000000074D30000-0x00000000754E1000-memory.dmp

memory/4888-52-0x0000000003E60000-0x000000000425D000-memory.dmp

memory/1584-53-0x0000000003D50000-0x000000000414C000-memory.dmp

memory/1584-54-0x0000000004150000-0x0000000004A3B000-memory.dmp

memory/4888-55-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1584-56-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/800-57-0x0000000074D30000-0x00000000754E1000-memory.dmp

memory/800-58-0x0000000004F80000-0x0000000004F90000-memory.dmp

memory/800-59-0x0000000004F80000-0x0000000004F90000-memory.dmp

memory/800-68-0x0000000005CD0000-0x0000000006027000-memory.dmp

memory/800-69-0x0000000006210000-0x000000000625C000-memory.dmp

memory/800-71-0x00000000710B0000-0x00000000710FC000-memory.dmp

memory/800-70-0x000000007F590000-0x000000007F5A0000-memory.dmp

memory/800-83-0x0000000004F80000-0x0000000004F90000-memory.dmp

memory/800-82-0x00000000073E0000-0x0000000007484000-memory.dmp

memory/800-81-0x0000000004F80000-0x0000000004F90000-memory.dmp

memory/800-72-0x00000000712F0000-0x0000000071647000-memory.dmp

memory/800-84-0x0000000007700000-0x0000000007711000-memory.dmp

memory/800-85-0x0000000007750000-0x0000000007765000-memory.dmp

memory/800-88-0x0000000074D30000-0x00000000754E1000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/4324-92-0x0000000004780000-0x0000000004790000-memory.dmp

memory/4324-91-0x0000000004780000-0x0000000004790000-memory.dmp

memory/4324-90-0x0000000074D30000-0x00000000754E1000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e91671d9448922792731fbd69fd96e43
SHA1 0a47c56473c522d183fc0ab1a46e7dc5eef41ca6
SHA256 73725f984003274f9dde8815527d3c76c51773bc961d50c40800a0b1e24a9025
SHA512 e8ef4d6a355e48eef3980e0681b554397db4c8fe4d2de9da110415197f16f037e46691cb94a355cde669f34902bf2c561a2359afdd6e030e1e7568e07d388c2f

memory/4324-102-0x000000007F4C0000-0x000000007F4D0000-memory.dmp

memory/4324-104-0x00000000712F0000-0x0000000071647000-memory.dmp

memory/4324-103-0x00000000710B0000-0x00000000710FC000-memory.dmp

memory/4324-114-0x0000000074D30000-0x00000000754E1000-memory.dmp

memory/1584-117-0x0000000003D50000-0x000000000414C000-memory.dmp

memory/3572-126-0x0000000003130000-0x0000000003140000-memory.dmp

memory/3572-127-0x0000000006090000-0x00000000063E7000-memory.dmp

memory/3572-116-0x0000000003130000-0x0000000003140000-memory.dmp

memory/3572-115-0x0000000074D30000-0x00000000754E1000-memory.dmp

memory/1584-129-0x0000000000400000-0x0000000001E08000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8cf0afc69e2a2cf5ebb89d226b4eaa5d
SHA1 5330f5347e1bc3dcdca816e450514e2dd5e4d1e6
SHA256 cf616fe496be5b6682f166616ea255c4b7cb9155662c84d706f666b5f306697a
SHA512 d158f9f001974c0669c9e7ba8b0578604d8105cfc2423437326ea1d672e0c89f6e5dad3d4d9c0c8e6414d28f7ddaae98ca8a9aff488101058213b7d472c224f7

memory/3572-130-0x00000000710B0000-0x00000000710FC000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 d96d533aa193717e06c54716193d8b63
SHA1 1c2d63166e0495a201352d2e0f552500d623da88
SHA256 ae2183776bbcea505dc8d919ddd8c2516a6392c55f4851064a4b1b3713a89c4c
SHA512 0bd94bd99a7f657b34f32dd8b72ad38005c0e1c86106889d20144177f5adfd84ce56eee9c2917c5357458d8fcb05a55148e3f909bb3953cb699c7f96d48713ca

memory/1584-149-0x0000000000400000-0x0000000001E08000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 963a9b6ae091048e985163f514f4e793
SHA1 4f3b59f591996295d6537cda554fc011ba7135e5
SHA256 eb62dbdb419804cb51442f3cfc8aa2696ddbe5c256f195c243113f9225e7239c
SHA512 3978203ed11759bbc5c7ffd3bfe0a15e85c74e617e2e3b3654f14c09af6cd4296b70d9eec2659ada0cab107f8a6ead7fbca2db93a6c7e3a62485b47541025f42

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9e20b328a1652dc51551a79c3bbe6ea1
SHA1 ee642ee44ac59db122ecc8e4f1d1bc4141ee780d
SHA256 9ab066b0c9c39f7dae4fa2fc2891a7f8d76e7002ee576b411d46b9373b4b0483
SHA512 2a744629d3bbce170f1ff2dfc74e2b1af71f38630d0f516c8967466fd79741783ce47fc29739f242c4f67cf3c9e7400c5c03a8af16ec0d93af87336247f7764e

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d52201796a49da77a0f96f870d5fc2e1
SHA1 963b97bb3ea8c596ee36e6fea3164866f48d0179
SHA256 ff79766bd56d0c2eb07becd64203efc0cc9afd62b6652595ed4bb9b6484ba93a
SHA512 5e968ff2f35b72f61150c73af69f23c7a661f87edd3e6db21cd71f98923436d80d7f6d61a92a61883b2ae9fe2cbc5deae2df77388e99d83be06d011361970967

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2576-246-0x0000000000400000-0x0000000001E08000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4464-254-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2576-255-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/5068-256-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2576-257-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2576-259-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/5068-260-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2576-261-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2576-263-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2576-265-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2576-267-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2576-269-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2576-271-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2576-273-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2576-275-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2576-277-0x0000000000400000-0x0000000001E08000-memory.dmp