Malware Analysis Report

2025-08-05 12:18

Sample ID 240419-yggvpsdf96
Target 46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25
SHA256 46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25

Threat Level: Known bad

The file 46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Adds Run key to start application

Manipulates WinMonFS driver.

Checks installed software on the system

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Program crash

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 19:45

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 19:45

Reported

2024-04-19 19:47

Platform

win10v2004-20240412-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-12 = "Azores Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4956 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4956 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4956 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1260 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1260 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1260 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1260 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\system32\cmd.exe
PID 1260 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\system32\cmd.exe
PID 1972 wrote to memory of 4976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1972 wrote to memory of 4976 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1260 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1260 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1260 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1260 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1260 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1260 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1260 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\rss\csrss.exe
PID 1260 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\rss\csrss.exe
PID 1260 wrote to memory of 1316 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\rss\csrss.exe
PID 1316 wrote to memory of 1676 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1676 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1676 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 1312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 3732 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 3732 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 3732 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1316 wrote to memory of 4604 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1316 wrote to memory of 4604 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4068 wrote to memory of 4340 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4068 wrote to memory of 4340 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4068 wrote to memory of 4340 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4340 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4340 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4340 wrote to memory of 4588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe

"C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe

"C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4956 -ip 4956

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 760

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1260 -ip 1260

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 600

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 e64ff8fa-5460-4f8b-88cf-a45e3bd12de3.uuid.filesdumpplace.org udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 stun3.l.google.com udp
US 8.8.8.8:53 server6.filesdumpplace.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
IT 142.251.27.127:19302 stun3.l.google.com udp
BG 185.82.216.96:443 server6.filesdumpplace.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 127.27.251.142.in-addr.arpa udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.96:443 server6.filesdumpplace.org tcp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
BG 185.82.216.96:443 server6.filesdumpplace.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BG 185.82.216.96:443 server6.filesdumpplace.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/4956-1-0x0000000003C20000-0x0000000004027000-memory.dmp

memory/4956-2-0x0000000004030000-0x000000000491B000-memory.dmp

memory/4956-3-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2392-4-0x0000000005210000-0x0000000005246000-memory.dmp

memory/2392-5-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/2392-7-0x0000000003190000-0x00000000031A0000-memory.dmp

memory/2392-6-0x0000000005880000-0x0000000005EA8000-memory.dmp

memory/2392-8-0x00000000057B0000-0x00000000057D2000-memory.dmp

memory/2392-9-0x0000000005EB0000-0x0000000005F16000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5d2kocj0.e2l.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2392-10-0x0000000006020000-0x0000000006086000-memory.dmp

memory/2392-20-0x0000000006250000-0x00000000065A4000-memory.dmp

memory/2392-21-0x0000000006780000-0x000000000679E000-memory.dmp

memory/2392-22-0x0000000006840000-0x000000000688C000-memory.dmp

memory/2392-23-0x0000000006D50000-0x0000000006D94000-memory.dmp

memory/2392-24-0x0000000007AA0000-0x0000000007B16000-memory.dmp

memory/2392-26-0x0000000007B50000-0x0000000007B6A000-memory.dmp

memory/2392-25-0x00000000081A0000-0x000000000881A000-memory.dmp

memory/2392-27-0x000000007F070000-0x000000007F080000-memory.dmp

memory/2392-28-0x0000000007D10000-0x0000000007D42000-memory.dmp

memory/2392-29-0x0000000070370000-0x00000000703BC000-memory.dmp

memory/2392-30-0x0000000070510000-0x0000000070864000-memory.dmp

memory/2392-40-0x0000000007D50000-0x0000000007D6E000-memory.dmp

memory/2392-41-0x0000000003190000-0x00000000031A0000-memory.dmp

memory/2392-42-0x0000000007D70000-0x0000000007E13000-memory.dmp

memory/2392-43-0x0000000007E60000-0x0000000007E6A000-memory.dmp

memory/2392-44-0x0000000007F70000-0x0000000008006000-memory.dmp

memory/2392-45-0x0000000007E70000-0x0000000007E81000-memory.dmp

memory/2392-46-0x0000000007EB0000-0x0000000007EBE000-memory.dmp

memory/2392-47-0x0000000007ED0000-0x0000000007EE4000-memory.dmp

memory/2392-48-0x0000000007F20000-0x0000000007F3A000-memory.dmp

memory/2392-49-0x0000000007F10000-0x0000000007F18000-memory.dmp

memory/2392-52-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/1260-54-0x0000000003BF0000-0x0000000003FEE000-memory.dmp

memory/4956-56-0x0000000003C20000-0x0000000004027000-memory.dmp

memory/4956-55-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1260-57-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4956-58-0x0000000004030000-0x000000000491B000-memory.dmp

memory/3848-61-0x0000000004D10000-0x0000000004D20000-memory.dmp

memory/3848-60-0x0000000004D10000-0x0000000004D20000-memory.dmp

memory/3848-59-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/3848-71-0x0000000005BF0000-0x0000000005F44000-memory.dmp

memory/3848-72-0x00000000061C0000-0x000000000620C000-memory.dmp

memory/3848-73-0x000000007F2E0000-0x000000007F2F0000-memory.dmp

memory/3848-75-0x0000000070610000-0x0000000070964000-memory.dmp

memory/3848-74-0x0000000070470000-0x00000000704BC000-memory.dmp

memory/3848-86-0x0000000004D10000-0x0000000004D20000-memory.dmp

memory/3848-85-0x0000000007370000-0x0000000007413000-memory.dmp

memory/3848-87-0x0000000007680000-0x0000000007691000-memory.dmp

memory/3848-88-0x00000000076D0000-0x00000000076E4000-memory.dmp

memory/3848-91-0x00000000744D0000-0x0000000074C80000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/2688-93-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/2688-95-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

memory/2688-94-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

memory/2688-105-0x0000000005CD0000-0x0000000006024000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4b7c8d746efd345c7ff017dfb040ddeb
SHA1 1a4cca17cc28601903cdfcccb4181777748c5a92
SHA256 5c0d71545185830770947372c2d1c5a7a3dda2e888326d67d6e03fba42dbe957
SHA512 de015e94372b818307132c889b46141b6bd18c1adbac15a5e960c3d4b83d777e4a15a85dabd24d1a5d27039bdd562bddf4f130a731cd44fabba71bd426abe283

memory/2688-107-0x0000000070470000-0x00000000704BC000-memory.dmp

memory/2688-108-0x0000000070C20000-0x0000000070F74000-memory.dmp

memory/1260-118-0x0000000003BF0000-0x0000000003FEE000-memory.dmp

memory/2688-119-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

memory/2688-121-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/4816-122-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/4816-123-0x0000000005D60000-0x00000000060B4000-memory.dmp

memory/4816-129-0x0000000002EB0000-0x0000000002EC0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 95bd5a67642cce8387f6ab057e8b8549
SHA1 700171e7bc8e0f54d3559bce130a988b27d4c9f6
SHA256 dd40fd4ee5233577eea4c84a63405144da5f3518c81d57c8d7e3d12b06c4981a
SHA512 1c0e53aef7efb33959af97ef8b787948457449dd1e17e0673583c35d405ceb25d411f5f57ab3fc8d56e844bdc085e8c1b01d3709c33d922dcc2ffed78497881a

memory/4816-137-0x0000000070C10000-0x0000000070F64000-memory.dmp

memory/4816-136-0x0000000070470000-0x00000000704BC000-memory.dmp

memory/4816-135-0x000000007F010000-0x000000007F020000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 cf78bdce714d9d73d36bdac256d2ae72
SHA1 e7cf53cfb2ef876f02426ecc122f8414dcf6bf1a
SHA256 46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25
SHA512 746c90754c04cd0b50e09fa6cd09816f2b57f031e87a5f4c6ea3ef582ae460129ae132aef7cb3a020cd930ac89108f8325447fbc86af96a1a63aa45709181eca

memory/1260-156-0x0000000000400000-0x0000000001E08000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 89d067f2f5de629cb743f0e9fa71ba69
SHA1 11b6bb871ca9d87f7721863b66af27ace85967bf
SHA256 74b74a10c4df8b69052945a0e9bf9d937958e0e460c463af6cbad14a565d2342
SHA512 27997728c4a608d1b9a72998642ea9abfa8003a176a746bce4d6682338e50dc31bf4d7409f97a037d4c0fc8706bf259edc2dff67ea65cdf2faf467b043c23e62

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a4e7f13e9b6a6abf5493873083cc1718
SHA1 ded8046b5e658a225650c94d0c16560711c0427f
SHA256 ef197385f57de5e4b0284b0c3e61e4b5a3582653cf4940c66573296b82cbc605
SHA512 e5d526c16b92d4af212859d13a2b0b32054b60446c3261a0bbe593761555449769e41d88e671c88600aadda6c1ccc5250f20959e7545306e0f690db970cdc3f8

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 930c7eb0fc315117f319c6bf16c39402
SHA1 e523ee709585bb0538b032efd20038b741203106
SHA256 01c8245da395d6c7c607f8db0fb2767d8c9d44a0bf443eccf8d372d52b827220
SHA512 18bcda2bf047c7c76fcbdde3fd034b240943bfd933e14ffe98b4e22da82b40dfc5ecdc1c19dd0c13d977d4c91da2b36a92eb084a04ce0c6079d1231d5a399d8e

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1316-258-0x0000000000400000-0x0000000001E08000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4068-266-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1316-267-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3948-268-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1316-269-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1316-271-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3948-272-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1316-273-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1316-275-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1316-277-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1316-279-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1316-281-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1316-283-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1316-285-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1316-287-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1316-289-0x0000000000400000-0x0000000001E08000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 19:45

Reported

2024-04-19 19:47

Platform

win11-20240412-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2612 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2612 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2612 wrote to memory of 3880 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 1608 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\system32\cmd.exe
PID 704 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\system32\cmd.exe
PID 1772 wrote to memory of 988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1772 wrote to memory of 988 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 704 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 4204 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 704 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\rss\csrss.exe
PID 704 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\rss\csrss.exe
PID 704 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe C:\Windows\rss\csrss.exe
PID 4900 wrote to memory of 4628 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4900 wrote to memory of 4628 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4900 wrote to memory of 4628 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4900 wrote to memory of 4600 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4900 wrote to memory of 4600 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4900 wrote to memory of 4600 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4900 wrote to memory of 1296 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4900 wrote to memory of 1296 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4900 wrote to memory of 1296 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4900 wrote to memory of 1208 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4900 wrote to memory of 1208 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4828 wrote to memory of 2656 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4828 wrote to memory of 2656 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4828 wrote to memory of 2656 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2656 wrote to memory of 3760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2656 wrote to memory of 3760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2656 wrote to memory of 3760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe

"C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe

"C:\Users\Admin\AppData\Local\Temp\46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ab68a8e3-0b57-46c1-a8c0-0c6f3b21eec4.uuid.filesdumpplace.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server5.filesdumpplace.org udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server5.filesdumpplace.org tcp
CH 172.217.210.127:19302 stun4.l.google.com udp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.96:443 server5.filesdumpplace.org tcp
BG 185.82.216.96:443 server5.filesdumpplace.org tcp
N/A 127.0.0.1:31465 tcp
BG 185.82.216.96:443 tcp

Files

memory/2612-1-0x0000000003CE0000-0x00000000040DB000-memory.dmp

memory/2612-2-0x00000000040E0000-0x00000000049CB000-memory.dmp

memory/2612-3-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/3880-4-0x0000000002B20000-0x0000000002B56000-memory.dmp

memory/3880-5-0x0000000074150000-0x0000000074901000-memory.dmp

memory/3880-6-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

memory/3880-8-0x0000000002BB0000-0x0000000002BC0000-memory.dmp

memory/3880-7-0x0000000005350000-0x000000000597A000-memory.dmp

memory/3880-9-0x0000000005120000-0x0000000005142000-memory.dmp

memory/3880-10-0x00000000051E0000-0x0000000005246000-memory.dmp

memory/3880-11-0x0000000005250000-0x00000000052B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_50iehwyu.yve.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3880-20-0x0000000005A80000-0x0000000005DD7000-memory.dmp

memory/3880-21-0x0000000006000000-0x000000000601E000-memory.dmp

memory/3880-22-0x0000000006020000-0x000000000606C000-memory.dmp

memory/3880-23-0x00000000063C0000-0x0000000006406000-memory.dmp

memory/3880-24-0x000000007F6A0000-0x000000007F6B0000-memory.dmp

memory/3880-25-0x0000000007210000-0x0000000007244000-memory.dmp

memory/3880-26-0x00000000703C0000-0x000000007040C000-memory.dmp

memory/3880-27-0x0000000070550000-0x00000000708A7000-memory.dmp

memory/3880-36-0x0000000007450000-0x000000000746E000-memory.dmp

memory/3880-37-0x0000000007470000-0x0000000007514000-memory.dmp

memory/3880-39-0x0000000007590000-0x00000000075AA000-memory.dmp

memory/3880-38-0x0000000007BE0000-0x000000000825A000-memory.dmp

memory/3880-40-0x00000000075D0000-0x00000000075DA000-memory.dmp

memory/3880-41-0x00000000076E0000-0x0000000007776000-memory.dmp

memory/3880-42-0x0000000007600000-0x0000000007611000-memory.dmp

memory/3880-43-0x0000000007640000-0x000000000764E000-memory.dmp

memory/3880-44-0x0000000007650000-0x0000000007665000-memory.dmp

memory/3880-45-0x00000000076A0000-0x00000000076BA000-memory.dmp

memory/3880-46-0x00000000076C0000-0x00000000076C8000-memory.dmp

memory/3880-49-0x0000000074150000-0x0000000074901000-memory.dmp

memory/704-51-0x0000000003D10000-0x0000000004111000-memory.dmp

memory/704-52-0x0000000004120000-0x0000000004A0B000-memory.dmp

memory/704-53-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2612-54-0x0000000003CE0000-0x00000000040DB000-memory.dmp

memory/1608-55-0x0000000074150000-0x0000000074901000-memory.dmp

memory/1608-56-0x0000000002C80000-0x0000000002C90000-memory.dmp

memory/1608-63-0x0000000006000000-0x0000000006357000-memory.dmp

memory/1608-59-0x0000000002C80000-0x0000000002C90000-memory.dmp

memory/2612-67-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/1608-68-0x000000007F590000-0x000000007F5A0000-memory.dmp

memory/1608-69-0x00000000703C0000-0x000000007040C000-memory.dmp

memory/1608-70-0x00000000705D0000-0x0000000070927000-memory.dmp

memory/1608-80-0x00000000076E0000-0x0000000007784000-memory.dmp

memory/1608-79-0x0000000002C80000-0x0000000002C90000-memory.dmp

memory/1608-81-0x0000000007A30000-0x0000000007A41000-memory.dmp

memory/1608-82-0x0000000007A80000-0x0000000007A95000-memory.dmp

memory/1608-85-0x0000000074150000-0x0000000074901000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/4204-87-0x0000000074150000-0x0000000074901000-memory.dmp

memory/4204-88-0x00000000031B0000-0x00000000031C0000-memory.dmp

memory/4204-90-0x0000000006240000-0x0000000006597000-memory.dmp

memory/4204-89-0x00000000031B0000-0x00000000031C0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b60be59b6655222635f13ab6cd9292c1
SHA1 7e5f36a89f2f8dba1929e3e14901f0877a865b99
SHA256 cdc755b9d62b97424c5e53f4e3cd1533538d94bedf89ecdadd715b0d3991876c
SHA512 b540e39f5a3ea50fca3a2e387a38a785effb1adbcb29d86122f258641c330f0b0ea8a6e9df122de3748efca88fcf0cfdbe392664d26bfa3aef3eaf95b292da5e

memory/4204-100-0x000000007F590000-0x000000007F5A0000-memory.dmp

memory/4204-102-0x0000000070610000-0x0000000070967000-memory.dmp

memory/4204-101-0x00000000703C0000-0x000000007040C000-memory.dmp

memory/4204-112-0x00000000031B0000-0x00000000031C0000-memory.dmp

memory/704-111-0x0000000003D10000-0x0000000004111000-memory.dmp

memory/4204-114-0x0000000074150000-0x0000000074901000-memory.dmp

memory/2512-116-0x0000000074150000-0x0000000074901000-memory.dmp

memory/2512-117-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c2ca456aa2977775e21553fc4adddd8c
SHA1 d9668cad060fbe85f2710d283067f800a426676e
SHA256 171e2792a7f7744530c93b2c6ac631c9ba04d9b2a49bb1ea6b0de64172015e23
SHA512 bda5e460d9bf261466a7556e6d3ca952a493dfc5de14eda325eaf22fc816d15793b635d820efd254627cd4710ce0e6a44a0522b6c3f669c2be901b1130d2fe67

memory/2512-126-0x0000000002FC0000-0x0000000002FD0000-memory.dmp

memory/2512-128-0x00000000703C0000-0x000000007040C000-memory.dmp

memory/2512-129-0x00000000705D0000-0x0000000070927000-memory.dmp

memory/704-138-0x0000000000400000-0x0000000001E08000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 cf78bdce714d9d73d36bdac256d2ae72
SHA1 e7cf53cfb2ef876f02426ecc122f8414dcf6bf1a
SHA256 46a07036e7f4a7a9b9e83c62281e29b960186d98a5200f290a9e290ddb966e25
SHA512 746c90754c04cd0b50e09fa6cd09816f2b57f031e87a5f4c6ea3ef582ae460129ae132aef7cb3a020cd930ac89108f8325447fbc86af96a1a63aa45709181eca

memory/704-145-0x0000000000400000-0x0000000001E08000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f84f86e919c88cdc79b3ebb66965c6c7
SHA1 f7dc156b228c2325627e215704e5ecc38ed6821a
SHA256 fae3eae03a716030bf20eb7a6c34e2dbe55a13cfe5d8df19b57915600b497469
SHA512 42284f89ebf9cc039ee8291ee6bcab3c1f58feecfc26e64922390afa46082b52700c8b96b6a010f3c8b7b16e367ea462f55926d01585794cd28687e2a9c45a7c

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9274f7c353ceac5ba21668b0cf7c5951
SHA1 c2b095a4d28ffb4f9543a2faa4bf66ce6ec5e747
SHA256 a206cff0e7121a36fb9f86b214f6c543824b11ac76a05c56464d0d6ab885e525
SHA512 c6ca809510cd7b48560992500d947ed452068621334b6bc5e26758a4fb3b567a7f2ace4af87b8d71763842f7c06dfd535803904a3cd2f0f1511f7251e3d8c73c

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1a9048c45dce7df7a2a20ed128044683
SHA1 00abb213afbd9f1815f60f2e64e6e81dcae6aad3
SHA256 391f75eaf167bf8ee9e2fe415dff169fdf63a5c76cb3c6a881f92b6a0839b12b
SHA512 48da0d282ab16057cd58dae4adb07b4eb241b565dc76c51f55d600eddf3a1cd0e2f99496eeb48097d0b2bb5d2f3e6365ad5dd52ded09abe08cdd8aa4d5e1317f

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4900-239-0x0000000000400000-0x0000000001E08000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4828-247-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4900-249-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2100-251-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4900-252-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4900-255-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/2100-257-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4900-258-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4900-261-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4900-264-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4900-267-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4900-270-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4900-273-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4900-276-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4900-279-0x0000000000400000-0x0000000001E08000-memory.dmp

memory/4900-282-0x0000000000400000-0x0000000001E08000-memory.dmp