Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/04/2024, 19:14
Static task
static1
Behavioral task
behavioral1
Sample
15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe
Resource
win10v2004-20240412-en
General
-
Target
15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe
-
Size
4.2MB
-
MD5
122170f6e1d797f4f5d77c58b2fe6c51
-
SHA1
95248f218acbd41cb77e785f7082896a4c731f3d
-
SHA256
15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8
-
SHA512
d6eb342cc3d46400ff3fd1cb408ac901fcb47b7865d7003a44ace2ac5c693c1b80e281897f983ef6580e30dcdad82a4421d32187104e43fa9bd069250fb4f934
-
SSDEEP
98304:ZqrB5wn4OMCZOc7+DuxcvwRwKkZb9A25YIHnzSUGXdTRu1L6z:GBo4d4+DucuGBGNT0Ly
Malware Config
Signatures
-
Glupteba payload 20 IoCs
resource yara_rule behavioral2/memory/4676-2-0x00000000041C0000-0x0000000004AAB000-memory.dmp family_glupteba behavioral2/memory/4676-3-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/4676-51-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3908-54-0x0000000003F70000-0x000000000485B000-memory.dmp family_glupteba behavioral2/memory/4676-55-0x00000000041C0000-0x0000000004AAB000-memory.dmp family_glupteba behavioral2/memory/3908-56-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3908-145-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-244-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-253-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-255-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-257-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-259-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-261-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-263-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-265-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-267-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-269-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-271-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-273-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba behavioral2/memory/3300-275-0x0000000000400000-0x0000000001DFD000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1884 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 3300 csrss.exe 3512 injector.exe 4496 windefender.exe 3460 windefender.exe -
resource yara_rule behavioral2/files/0x000100000002aa14-247.dat upx behavioral2/memory/4496-251-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3460-254-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/3460-258-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe File created C:\Windows\rss\csrss.exe 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2536 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1780 schtasks.exe 888 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2028 powershell.exe 2028 powershell.exe 4676 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 4676 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3512 powershell.exe 3512 powershell.exe 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 3944 powershell.exe 3944 powershell.exe 4912 powershell.exe 4912 powershell.exe 5056 powershell.exe 5056 powershell.exe 4168 powershell.exe 4168 powershell.exe 3376 powershell.exe 3376 powershell.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3300 csrss.exe 3300 csrss.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3300 csrss.exe 3300 csrss.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3300 csrss.exe 3300 csrss.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe 3512 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2028 powershell.exe Token: SeDebugPrivilege 4676 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Token: SeImpersonatePrivilege 4676 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe Token: SeDebugPrivilege 3512 powershell.exe Token: SeDebugPrivilege 3944 powershell.exe Token: SeDebugPrivilege 4912 powershell.exe Token: SeDebugPrivilege 5056 powershell.exe Token: SeDebugPrivilege 4168 powershell.exe Token: SeDebugPrivilege 3376 powershell.exe Token: SeSystemEnvironmentPrivilege 3300 csrss.exe Token: SeSecurityPrivilege 2536 sc.exe Token: SeSecurityPrivilege 2536 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4676 wrote to memory of 2028 4676 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 81 PID 4676 wrote to memory of 2028 4676 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 81 PID 4676 wrote to memory of 2028 4676 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 81 PID 3908 wrote to memory of 3512 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 106 PID 3908 wrote to memory of 3512 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 106 PID 3908 wrote to memory of 3512 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 106 PID 3908 wrote to memory of 4504 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 88 PID 3908 wrote to memory of 4504 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 88 PID 4504 wrote to memory of 1884 4504 cmd.exe 109 PID 4504 wrote to memory of 1884 4504 cmd.exe 109 PID 3908 wrote to memory of 3944 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 91 PID 3908 wrote to memory of 3944 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 91 PID 3908 wrote to memory of 3944 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 91 PID 3908 wrote to memory of 4912 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 93 PID 3908 wrote to memory of 4912 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 93 PID 3908 wrote to memory of 4912 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 93 PID 3908 wrote to memory of 3300 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 95 PID 3908 wrote to memory of 3300 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 95 PID 3908 wrote to memory of 3300 3908 15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe 95 PID 3300 wrote to memory of 5056 3300 csrss.exe 96 PID 3300 wrote to memory of 5056 3300 csrss.exe 96 PID 3300 wrote to memory of 5056 3300 csrss.exe 96 PID 3300 wrote to memory of 4168 3300 csrss.exe 101 PID 3300 wrote to memory of 4168 3300 csrss.exe 101 PID 3300 wrote to memory of 4168 3300 csrss.exe 101 PID 3300 wrote to memory of 3376 3300 csrss.exe 104 PID 3300 wrote to memory of 3376 3300 csrss.exe 104 PID 3300 wrote to memory of 3376 3300 csrss.exe 104 PID 3300 wrote to memory of 3512 3300 csrss.exe 106 PID 3300 wrote to memory of 3512 3300 csrss.exe 106 PID 4496 wrote to memory of 1996 4496 windefender.exe 112 PID 4496 wrote to memory of 1996 4496 windefender.exe 112 PID 4496 wrote to memory of 1996 4496 windefender.exe 112 PID 1996 wrote to memory of 2536 1996 cmd.exe 113 PID 1996 wrote to memory of 2536 1996 cmd.exe 113 PID 1996 wrote to memory of 2536 1996 cmd.exe 113 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe"C:\Users\Admin\AppData\Local\Temp\15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe"C:\Users\Admin\AppData\Local\Temp\15892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1884
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1780
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3688
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3376
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3512
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:888 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1884
-
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3460
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f4a3d5b776bb1e4f3569693f956a5f04
SHA1d25ed5033415c48c374faad72d0673ca880acf6c
SHA2568e6fc2645c4f374d36350def68d77200a0e91b3a436a9afecc464432b99070a7
SHA5121ceadd4a9276dd334230f00b23cf2d4c8df53dcbf51ae50d741be2e6ba3d3191a93920d47e64bb6b1de63b0f2b7f8d87158875c2036851eee8e48b8713d7a6f7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ba8d936982a1c6c7982bcc1ea69b1d90
SHA160d2757b81b811dc4800ff89c21540da6cd90d69
SHA256f7a6f964a888addb7f9cc3a0b0c59d5c1b7b11a51175fdafe96bb4d8364cebb2
SHA51204de106711488ae5c711de3bbec03f1d2e3cce672abc3a679c3ff9d66b0468229118d1029d88a15f8c2e8b6b548ceb965302948bd1b1a0ab89914db85854954e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD598ba49995579ff532391f55b5313ae56
SHA1f0bc467a6c173322df20649649abccd169b6f9f6
SHA25614053fde2c52187a54eaacd43ad7c18d87ff01a6ae3e354fa66673d7f127a938
SHA512a0b86d3edb353f481248088128e72e1fb553324f06876fb3dd976e891b37e22003748d5717f23f6555f958c2cc6e26b3e233c4cfb72f3d1321920994729cf992
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5bb251d0e7d49a3b6e1a835635a063b3c
SHA1e82e83472b23fe92df09ddb67355fc3f6c52892b
SHA2568de3eb1c4b572ce5a589387218600fb9301a26f3bd99b8b25aa14aea4aa13252
SHA5129fa3c7a5e011717f0c3298886baafd39d8355f606712c8f28e9db42eaa77661fd70df56b88729852e28cd5c92b6133f016ac85c35110677a25ac1dd7b5b736b0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD580c527c7fd3a0f3e49b8587c327ef126
SHA161fd58977a15df849ec7639f88f7452c23468d6d
SHA256a9d6afe44009c90731204d483b5f7d450bb4ba253cae46b28773a5529abd7d20
SHA512a6aa163dbb5bf5acc218c82d9af102904696e60a3233dfa5d6fe4d776b630e71c212e5e23223897cf5c7dc2cd1f969272c379e02090353113fed4158eb144934
-
Filesize
4.2MB
MD5122170f6e1d797f4f5d77c58b2fe6c51
SHA195248f218acbd41cb77e785f7082896a4c731f3d
SHA25615892d4d3eb84ee95595ac4604045f85cc3e98c4fce097cabf4b04eaf6c7a8e8
SHA512d6eb342cc3d46400ff3fd1cb408ac901fcb47b7865d7003a44ace2ac5c693c1b80e281897f983ef6580e30dcdad82a4421d32187104e43fa9bd069250fb4f934
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec