Malware Analysis Report

2025-08-05 12:17

Sample ID 240419-ylx3gsef7s
Target 98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a
SHA256 98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a

Threat Level: Known bad

The file 98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Adds Run key to start application

Checks installed software on the system

Manipulates WinMonFS driver.

Drops file in System32 directory

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Program crash

Creates scheduled task(s)

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 19:53

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 19:53

Reported

2024-04-19 19:55

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4496 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4496 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4496 wrote to memory of 1668 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4960 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4960 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4960 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4960 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\system32\cmd.exe
PID 4960 wrote to memory of 4336 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\system32\cmd.exe
PID 4336 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4336 wrote to memory of 2664 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4960 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4960 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4960 wrote to memory of 3512 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4960 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4960 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4960 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4960 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\rss\csrss.exe
PID 4960 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\rss\csrss.exe
PID 4960 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\rss\csrss.exe
PID 2816 wrote to memory of 4116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 4116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 4116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 1632 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 1632 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 1632 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 5076 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 5076 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 5076 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 2732 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2816 wrote to memory of 2732 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4172 wrote to memory of 3708 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4172 wrote to memory of 3708 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4172 wrote to memory of 3708 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3708 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3708 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3708 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe

"C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe

"C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4496 -ip 4496

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 976

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
NL 23.62.61.129:443 www.bing.com tcp
US 8.8.8.8:53 129.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 ec529f81-431e-4b40-ae0c-e49e21ffa5ae.uuid.filesdumpplace.org udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 stun2.l.google.com udp
US 8.8.8.8:53 server1.filesdumpplace.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server1.filesdumpplace.org tcp
NL 74.125.128.127:19302 stun2.l.google.com udp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 127.128.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 130.118.77.104.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.96:443 server1.filesdumpplace.org tcp

Files

memory/4496-1-0x0000000003C90000-0x000000000408F000-memory.dmp

memory/4496-2-0x0000000004090000-0x000000000497B000-memory.dmp

memory/4496-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1668-5-0x00000000743A0000-0x0000000074B50000-memory.dmp

memory/1668-4-0x0000000004F30000-0x0000000004F66000-memory.dmp

memory/1668-6-0x0000000005080000-0x0000000005090000-memory.dmp

memory/1668-7-0x0000000005080000-0x0000000005090000-memory.dmp

memory/1668-8-0x00000000056C0000-0x0000000005CE8000-memory.dmp

memory/1668-9-0x0000000005630000-0x0000000005652000-memory.dmp

memory/1668-10-0x0000000005D60000-0x0000000005DC6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4uto5vxq.5le.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1668-16-0x0000000005EC0000-0x0000000005F26000-memory.dmp

memory/1668-21-0x0000000005F30000-0x0000000006284000-memory.dmp

memory/1668-22-0x0000000006510000-0x000000000652E000-memory.dmp

memory/1668-23-0x0000000006530000-0x000000000657C000-memory.dmp

memory/1668-24-0x0000000006A70000-0x0000000006AB4000-memory.dmp

memory/1668-25-0x0000000007630000-0x00000000076A6000-memory.dmp

memory/1668-26-0x0000000007F30000-0x00000000085AA000-memory.dmp

memory/1668-27-0x00000000078D0000-0x00000000078EA000-memory.dmp

memory/1668-29-0x000000007FA30000-0x000000007FA40000-memory.dmp

memory/1668-28-0x0000000007A90000-0x0000000007AC2000-memory.dmp

memory/1668-30-0x0000000070240000-0x000000007028C000-memory.dmp

memory/1668-31-0x0000000070960000-0x0000000070CB4000-memory.dmp

memory/1668-41-0x0000000007AD0000-0x0000000007AEE000-memory.dmp

memory/1668-42-0x0000000007AF0000-0x0000000007B93000-memory.dmp

memory/1668-43-0x0000000007BE0000-0x0000000007BEA000-memory.dmp

memory/1668-44-0x0000000007CF0000-0x0000000007D86000-memory.dmp

memory/1668-45-0x0000000007BF0000-0x0000000007C01000-memory.dmp

memory/1668-46-0x0000000007C30000-0x0000000007C3E000-memory.dmp

memory/1668-47-0x0000000007C50000-0x0000000007C64000-memory.dmp

memory/1668-48-0x0000000007C90000-0x0000000007CAA000-memory.dmp

memory/1668-49-0x0000000007C80000-0x0000000007C88000-memory.dmp

memory/1668-52-0x00000000743A0000-0x0000000074B50000-memory.dmp

memory/4496-54-0x0000000003C90000-0x000000000408F000-memory.dmp

memory/4960-55-0x0000000003A80000-0x0000000003E88000-memory.dmp

memory/4960-56-0x0000000003E90000-0x000000000477B000-memory.dmp

memory/4960-58-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4496-57-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4888-59-0x00000000744C0000-0x0000000074C70000-memory.dmp

memory/4888-60-0x00000000025A0000-0x00000000025B0000-memory.dmp

memory/4888-61-0x00000000025A0000-0x00000000025B0000-memory.dmp

memory/4888-62-0x00000000055F0000-0x0000000005944000-memory.dmp

memory/4888-72-0x00000000060D0000-0x000000000611C000-memory.dmp

memory/4888-73-0x000000007F660000-0x000000007F670000-memory.dmp

memory/4888-74-0x0000000070340000-0x000000007038C000-memory.dmp

memory/4888-75-0x0000000070AE0000-0x0000000070E34000-memory.dmp

memory/4888-85-0x0000000006EA0000-0x0000000006F43000-memory.dmp

memory/4888-86-0x0000000007100000-0x0000000007111000-memory.dmp

memory/4888-87-0x0000000007150000-0x0000000007164000-memory.dmp

memory/4888-90-0x00000000744C0000-0x0000000074C70000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/3512-92-0x00000000744C0000-0x0000000074C70000-memory.dmp

memory/3512-94-0x0000000002650000-0x0000000002660000-memory.dmp

memory/3512-93-0x0000000002650000-0x0000000002660000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5e05a54397c41ddc669a56fca5bef421
SHA1 c9396fcf529f16ac8021a69b641524b7455eca1d
SHA256 e1e673e7adee04a63461cd7a0941303e34bdfb19364c1692d5380140ced5a37f
SHA512 42ed03a8a52fa6ffdbba977f121439f62f8e09ed03343aa3fc54e2e5cfeccebad7a991d9ffcb06eb489871bf6364e74784877a2e84d5bdc684043fd9c8477999

memory/3512-105-0x0000000070340000-0x000000007038C000-memory.dmp

memory/3512-106-0x0000000070AE0000-0x0000000070E34000-memory.dmp

memory/3512-117-0x00000000744C0000-0x0000000074C70000-memory.dmp

memory/3472-118-0x00000000744C0000-0x0000000074C70000-memory.dmp

memory/3472-119-0x0000000004600000-0x0000000004610000-memory.dmp

memory/4960-120-0x0000000003A80000-0x0000000003E88000-memory.dmp

memory/3472-130-0x00000000056D0000-0x0000000005A24000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 551aa2c425c37311efcf80a3b11d046e
SHA1 dd28e21cb14d02cfabe5fcc91e188f43840d8d2c
SHA256 49203b12b407084a915ac158966047535eaaf88317fed5f1594c4ec49eb3ac31
SHA512 b468076a416eb30dd0442e8a06f934396d33359ff07eba0822726c6613c33f5877c82244b73b499ee0952004abf20cf408c3e1d4ffed0e677e963f5822857df3

memory/3472-132-0x000000007F300000-0x000000007F310000-memory.dmp

memory/3472-133-0x0000000070340000-0x000000007038C000-memory.dmp

memory/3472-134-0x00000000704C0000-0x0000000070814000-memory.dmp

memory/4960-144-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3472-145-0x0000000004600000-0x0000000004610000-memory.dmp

memory/3472-147-0x00000000744C0000-0x0000000074C70000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 415fb81fc68d3b8991f1e9cc5bba4455
SHA1 e17f10033b114c0cf0e77750ad79c1382c8b0aa4
SHA256 98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a
SHA512 e3103302bc8c9c8c22de19521963c04ebb8c7e355992532687b1711258d02d646a60f7055b4c54034a0024ccca82e23c88f41a915b2529957ea3316d68ef7d05

memory/4960-151-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5faa66fff91c2174d3ef933e60d1a24b
SHA1 76adf74ba9b73881f89defb2a99b11cbad75be21
SHA256 9409a7f0a4320f56e8cd055720da7d752caaa61bab62300322d4bb7d32579dd7
SHA512 d9ded9150e8d5123ac6dc19214dc06bfc8704cd5e08d946b35d5f2d198f8c9471ff1319eef88381fd61f76d8e57c8eda02c9a6060d25de1c4378ad4379b2dc78

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0eedd3642e28c0e1f9672611e8ad2de4
SHA1 d86598a9fe9d9ef9f568d6a4b066ad5044313045
SHA256 1bc894793b33ee0e89cbbe40d09f3fdfaec633938a18f05a24d796caa5f8ccef
SHA512 b9faa748e20ae464020cddead26c3bab4cacad7c8b7c2583c16c5f43d81b8a2c4184dc863ba4a4ed0c9f641cd3bd66004ba064711c42d14b1830be2b2e8026d7

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 26b1db34c7f1db26aa73e6cb42e092e0
SHA1 89943699ba9d0c5feb42ee900cbddffd3d673fe4
SHA256 123717853b9d79ed59ac77f449f48cc63a477c51594cd515cf25f5efab132359
SHA512 6afca719842c4313ff63ebc9fccb3c88a7026d40c131b16eeeda8727072a1b8ca19fb7055aeded7c6e921d91371670b3690ed86cac13911147ff5e36e1323bd8

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2816-252-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4172-260-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2816-261-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/116-262-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2816-263-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2816-265-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/116-266-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2816-267-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2816-269-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2816-271-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2816-273-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2816-275-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2816-277-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2816-279-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2816-281-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2816-283-0x0000000000400000-0x0000000001E06000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 19:53

Reported

2024-04-19 19:55

Platform

win11-20240412-en

Max time kernel

150s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1896 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1896 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1896 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\system32\cmd.exe
PID 2312 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\system32\cmd.exe
PID 3268 wrote to memory of 4864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3268 wrote to memory of 4864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2312 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\rss\csrss.exe
PID 2312 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\rss\csrss.exe
PID 2312 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe C:\Windows\rss\csrss.exe
PID 3896 wrote to memory of 2216 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3896 wrote to memory of 2216 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3896 wrote to memory of 2216 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3896 wrote to memory of 3368 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3896 wrote to memory of 3368 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3896 wrote to memory of 3368 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3896 wrote to memory of 3124 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3896 wrote to memory of 3124 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3896 wrote to memory of 3124 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3896 wrote to memory of 4420 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3896 wrote to memory of 4420 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 380 wrote to memory of 1108 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 380 wrote to memory of 1108 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 380 wrote to memory of 1108 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1108 wrote to memory of 4700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1108 wrote to memory of 4700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1108 wrote to memory of 4700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe

"C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe

"C:\Users\Admin\AppData\Local\Temp\98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1896 -ip 1896

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 720

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 3.33.249.248:3478 stun.sipgate.net udp
BG 185.82.216.96:443 server7.filesdumpplace.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BG 185.82.216.96:443 server7.filesdumpplace.org tcp

Files

memory/1896-1-0x0000000003D50000-0x000000000414A000-memory.dmp

memory/1896-2-0x0000000004150000-0x0000000004A3B000-memory.dmp

memory/1896-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/988-4-0x0000000002CC0000-0x0000000002CF6000-memory.dmp

memory/988-5-0x00000000741C0000-0x0000000074971000-memory.dmp

memory/988-6-0x0000000004F10000-0x0000000004F20000-memory.dmp

memory/988-8-0x0000000004F10000-0x0000000004F20000-memory.dmp

memory/988-7-0x0000000005550000-0x0000000005B7A000-memory.dmp

memory/988-9-0x0000000005290000-0x00000000052B2000-memory.dmp

memory/988-10-0x0000000005330000-0x0000000005396000-memory.dmp

memory/988-11-0x0000000005410000-0x0000000005476000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xmqvb1c5.4mi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/988-20-0x0000000005C80000-0x0000000005FD7000-memory.dmp

memory/988-21-0x0000000006150000-0x000000000616E000-memory.dmp

memory/988-22-0x00000000061A0000-0x00000000061EC000-memory.dmp

memory/988-23-0x0000000006510000-0x0000000006556000-memory.dmp

memory/988-25-0x0000000007500000-0x0000000007534000-memory.dmp

memory/988-24-0x000000007FA90000-0x000000007FAA0000-memory.dmp

memory/988-26-0x0000000070430000-0x000000007047C000-memory.dmp

memory/988-27-0x00000000705B0000-0x0000000070907000-memory.dmp

memory/988-36-0x0000000007540000-0x000000000755E000-memory.dmp

memory/988-37-0x0000000004F10000-0x0000000004F20000-memory.dmp

memory/988-38-0x0000000007560000-0x0000000007604000-memory.dmp

memory/988-39-0x0000000007D40000-0x00000000083BA000-memory.dmp

memory/988-40-0x0000000007700000-0x000000000771A000-memory.dmp

memory/988-41-0x0000000007740000-0x000000000774A000-memory.dmp

memory/988-42-0x0000000007850000-0x00000000078E6000-memory.dmp

memory/988-43-0x0000000007760000-0x0000000007771000-memory.dmp

memory/988-44-0x00000000077B0000-0x00000000077BE000-memory.dmp

memory/988-45-0x00000000077C0000-0x00000000077D5000-memory.dmp

memory/988-46-0x0000000007810000-0x000000000782A000-memory.dmp

memory/988-47-0x0000000007830000-0x0000000007838000-memory.dmp

memory/988-50-0x00000000741C0000-0x0000000074971000-memory.dmp

memory/2312-52-0x0000000003B50000-0x0000000003F52000-memory.dmp

memory/2312-53-0x0000000003F60000-0x000000000484B000-memory.dmp

memory/1896-54-0x0000000003D50000-0x000000000414A000-memory.dmp

memory/2312-56-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1896-55-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/524-57-0x00000000741C0000-0x0000000074971000-memory.dmp

memory/524-58-0x0000000005180000-0x0000000005190000-memory.dmp

memory/524-67-0x0000000005FE0000-0x0000000006337000-memory.dmp

memory/524-68-0x0000000006A70000-0x0000000006ABC000-memory.dmp

memory/524-69-0x000000007F2E0000-0x000000007F2F0000-memory.dmp

memory/524-71-0x00000000706C0000-0x0000000070A17000-memory.dmp

memory/524-70-0x0000000070540000-0x000000007058C000-memory.dmp

memory/524-81-0x00000000076F0000-0x0000000007794000-memory.dmp

memory/524-82-0x0000000005180000-0x0000000005190000-memory.dmp

memory/524-80-0x0000000005180000-0x0000000005190000-memory.dmp

memory/524-83-0x0000000007A00000-0x0000000007A11000-memory.dmp

memory/524-84-0x0000000007A50000-0x0000000007A65000-memory.dmp

memory/524-87-0x00000000741C0000-0x0000000074971000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/3088-90-0x0000000003060000-0x0000000003070000-memory.dmp

memory/3088-89-0x00000000741C0000-0x0000000074971000-memory.dmp

memory/3088-99-0x0000000006040000-0x0000000006397000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 bd072ce349f6ab9152583cfb4ffe9cb5
SHA1 ea0fa6eea84775e15a7ec9c9d4e81446ebcef696
SHA256 79b1da8544e7c02d50b802e69b052bebb74f757ab2f01d4001cd1c7110de8ccc
SHA512 168ddd42d444d92077841417d320f9be2f313e559e4a4b9883152a831e96f868a9af67a70c7a6ed5c4288fd00fbd2a62d8a5e31ff9b21ba92d928d710e95ba1f

memory/3088-102-0x0000000070540000-0x000000007058C000-memory.dmp

memory/3088-101-0x000000007F330000-0x000000007F340000-memory.dmp

memory/3088-103-0x00000000706E0000-0x0000000070A37000-memory.dmp

memory/3088-113-0x00000000741C0000-0x0000000074971000-memory.dmp

memory/2200-114-0x00000000741C0000-0x0000000074971000-memory.dmp

memory/2200-115-0x0000000002C60000-0x0000000002C70000-memory.dmp

memory/2200-116-0x0000000005C60000-0x0000000005FB7000-memory.dmp

memory/2312-125-0x0000000003B50000-0x0000000003F52000-memory.dmp

memory/2200-126-0x0000000002C60000-0x0000000002C70000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7b80e6a70e8e3e31a121aee033a351e3
SHA1 a981e4b93e94e95831382b2ea4dbc4364f51d3ea
SHA256 800f2e46a3b0a90f5dfac20dd6e00a46564a9fe186cb2f21a34c5578a3ef8ae4
SHA512 961f3f76fa5ee802fdace39cbeecbe0c9e5b150768114c5675bbfee741344528ce6e672e7f0e2f271e9c1b772829aa703ae0774a3a0dc4b3898dda31fcd1ef18

memory/2200-128-0x0000000070540000-0x000000007058C000-memory.dmp

memory/2200-130-0x0000000070780000-0x0000000070AD7000-memory.dmp

memory/2200-129-0x000000007F8C0000-0x000000007F8D0000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 415fb81fc68d3b8991f1e9cc5bba4455
SHA1 e17f10033b114c0cf0e77750ad79c1382c8b0aa4
SHA256 98d34dba0ceaa1c2b49eeab0f748708ec9d4d1decc7cc6ef7e6c46659bbe408a
SHA512 e3103302bc8c9c8c22de19521963c04ebb8c7e355992532687b1711258d02d646a60f7055b4c54034a0024ccca82e23c88f41a915b2529957ea3316d68ef7d05

memory/2312-145-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5e696e7afd6a23e263975c8ec3ad9300
SHA1 3a846dcbd9020e69efbc0834989c2929a20a8d9e
SHA256 48407be7a1ec0139a8d9da4c3f9dddd9f09ddc942f7f6ee7774cc8b68044ebfb
SHA512 1cc7dbe80620337e42c0066fba56e3e479224c831f817e64689684e95d1385b04ddcfa7db278bb27380902dea5177452b7469ef6738b7aa488699b73921b45ea

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 46269523be19ad4d69f838030c574d51
SHA1 60ae5f94e46246107977e07176b9d85b04f3f40b
SHA256 cc21220ecf71baa0ab42808e0e709c56a6274075de9d497aec856713ee7bb06d
SHA512 c533882c654442dd4393f92c86a17cacf83e83d448c9b5942f879475432a04ec8311c9c279b717e62045c1fea17bbdd4fa1ffaf73f0b330e37da08abcc4f63ed

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 fa9f2e0b1b4bfde999a26677d0ecdf17
SHA1 483d96d289f8b2168ebe78c26e01779282258fa3
SHA256 f4fe7130e23be132792d8c7f1b075f29453fdabf3cc9d0697edb8d37ea5f9387
SHA512 1ea8ae8258112199dcebd2265006194b45fb254cad062b56479b1b55414d410397be3e30f0e0ecddc531f972b062137cdf8e7aee77c4c768fa37f571d771119f

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3896-246-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3896-250-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/380-254-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3896-255-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3484-256-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3896-257-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3896-259-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3484-260-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3896-261-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3896-263-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3896-265-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3484-266-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3896-267-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3896-269-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3896-271-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3896-273-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3896-275-0x0000000000400000-0x0000000001E06000-memory.dmp