Malware Analysis Report

2025-08-05 12:17

Sample ID 240419-yn56waea23
Target c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01
SHA256 c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01

Threat Level: Known bad

The file c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Checks installed software on the system

Manipulates WinMonFS driver.

Adds Run key to start application

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Program crash

Creates scheduled task(s)

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 19:56

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 19:56

Reported

2024-04-19 19:59

Platform

win10v2004-20240412-en

Max time kernel

150s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-492 = "India Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3008 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3008 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3008 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5024 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5024 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5024 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5024 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\system32\cmd.exe
PID 5024 wrote to memory of 1168 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\system32\cmd.exe
PID 1168 wrote to memory of 212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1168 wrote to memory of 212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5024 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5024 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5024 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5024 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5024 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5024 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5024 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\rss\csrss.exe
PID 5024 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\rss\csrss.exe
PID 5024 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\rss\csrss.exe
PID 1612 wrote to memory of 1452 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 1452 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 1452 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 3152 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 3152 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 3152 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 4900 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 4900 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 4900 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1612 wrote to memory of 1984 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1612 wrote to memory of 1984 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3604 wrote to memory of 3224 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3604 wrote to memory of 3224 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3604 wrote to memory of 3224 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3224 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3224 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3224 wrote to memory of 4976 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe

"C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe

"C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5024 -ip 5024

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 856

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 bc729e03-a9f0-4865-bbb6-415cfce9aa92.uuid.localstats.org udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 11.2.37.23.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 stun.ipfire.org udp
US 8.8.8.8:53 server12.localstats.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server12.localstats.org tcp
DE 81.3.27.44:3478 stun.ipfire.org udp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 44.27.3.81.in-addr.arpa udp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 25.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
BG 185.82.216.111:443 server12.localstats.org tcp
US 8.8.8.8:53 159.185.200.23.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BG 185.82.216.111:443 server12.localstats.org tcp

Files

memory/3008-1-0x0000000003C40000-0x0000000004042000-memory.dmp

memory/3008-2-0x0000000004050000-0x000000000493B000-memory.dmp

memory/3008-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2720-4-0x00000000026F0000-0x0000000002726000-memory.dmp

memory/2720-5-0x0000000074580000-0x0000000074D30000-memory.dmp

memory/2720-6-0x0000000002820000-0x0000000002830000-memory.dmp

memory/2720-7-0x0000000005220000-0x0000000005848000-memory.dmp

memory/2720-8-0x0000000005020000-0x0000000005042000-memory.dmp

memory/2720-14-0x0000000005950000-0x00000000059B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eywapsd3.cn2.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2720-19-0x0000000005AC0000-0x0000000005B26000-memory.dmp

memory/2720-20-0x0000000005B30000-0x0000000005E84000-memory.dmp

memory/2720-21-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

memory/2720-22-0x0000000006000000-0x000000000604C000-memory.dmp

memory/2720-23-0x0000000006530000-0x0000000006574000-memory.dmp

memory/2720-24-0x00000000072F0000-0x0000000007366000-memory.dmp

memory/2720-25-0x00000000079F0000-0x000000000806A000-memory.dmp

memory/2720-26-0x0000000007390000-0x00000000073AA000-memory.dmp

memory/2720-28-0x000000007F2B0000-0x000000007F2C0000-memory.dmp

memory/2720-27-0x0000000007550000-0x0000000007582000-memory.dmp

memory/2720-29-0x0000000070420000-0x000000007046C000-memory.dmp

memory/2720-30-0x00000000705A0000-0x00000000708F4000-memory.dmp

memory/2720-40-0x0000000007590000-0x00000000075AE000-memory.dmp

memory/2720-42-0x0000000002820000-0x0000000002830000-memory.dmp

memory/2720-41-0x00000000075B0000-0x0000000007653000-memory.dmp

memory/2720-43-0x00000000076A0000-0x00000000076AA000-memory.dmp

memory/2720-44-0x00000000077B0000-0x0000000007846000-memory.dmp

memory/2720-45-0x00000000076B0000-0x00000000076C1000-memory.dmp

memory/2720-46-0x00000000076F0000-0x00000000076FE000-memory.dmp

memory/2720-47-0x0000000007710000-0x0000000007724000-memory.dmp

memory/2720-48-0x0000000007750000-0x000000000776A000-memory.dmp

memory/2720-49-0x0000000007740000-0x0000000007748000-memory.dmp

memory/2720-52-0x0000000074580000-0x0000000074D30000-memory.dmp

memory/3008-53-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/5024-55-0x0000000003AA0000-0x0000000003EA8000-memory.dmp

memory/5024-57-0x0000000003EB0000-0x000000000479B000-memory.dmp

memory/3008-56-0x0000000004050000-0x000000000493B000-memory.dmp

memory/5024-58-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1900-59-0x0000000074620000-0x0000000074DD0000-memory.dmp

memory/1900-60-0x0000000004D00000-0x0000000004D10000-memory.dmp

memory/1900-61-0x0000000004D00000-0x0000000004D10000-memory.dmp

memory/1900-62-0x00000000059E0000-0x0000000005D34000-memory.dmp

memory/1900-72-0x00000000065B0000-0x00000000065FC000-memory.dmp

memory/1900-73-0x000000007F280000-0x000000007F290000-memory.dmp

memory/1900-74-0x0000000070520000-0x000000007056C000-memory.dmp

memory/1900-75-0x0000000070CC0000-0x0000000071014000-memory.dmp

memory/1900-85-0x00000000071F0000-0x0000000007293000-memory.dmp

memory/1900-86-0x0000000007510000-0x0000000007521000-memory.dmp

memory/1900-87-0x0000000007560000-0x0000000007574000-memory.dmp

memory/1900-90-0x0000000074620000-0x0000000074DD0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4224-92-0x0000000074620000-0x0000000074DD0000-memory.dmp

memory/4224-93-0x0000000005010000-0x0000000005020000-memory.dmp

memory/4224-94-0x0000000005010000-0x0000000005020000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f7f53d2f85e74522acc00a1ab21d7dff
SHA1 5a71b0b316807c47c736a37e8008f7fa8c2d32f2
SHA256 0e7b97881b64475f120ac45167bc9511cf4ab104039d9b13069f92d6b3404d87
SHA512 f9535517c10315ec46aee89dfb9613207a0af497117c3e9ec151824776a1f63e5f805ce0531fc8a3f646d36b0726252c362934e856e02c3d542b155c7ce472dc

memory/4224-105-0x0000000070520000-0x000000007056C000-memory.dmp

memory/4224-106-0x000000007F670000-0x000000007F680000-memory.dmp

memory/4224-107-0x0000000070CC0000-0x0000000071014000-memory.dmp

memory/5024-117-0x0000000003AA0000-0x0000000003EA8000-memory.dmp

memory/5024-118-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4224-119-0x0000000005010000-0x0000000005020000-memory.dmp

memory/4224-120-0x0000000005010000-0x0000000005020000-memory.dmp

memory/4224-122-0x0000000074620000-0x0000000074DD0000-memory.dmp

memory/392-123-0x0000000074620000-0x0000000074DD0000-memory.dmp

memory/392-124-0x0000000002F20000-0x0000000002F30000-memory.dmp

memory/392-125-0x0000000002F20000-0x0000000002F30000-memory.dmp

memory/392-135-0x00000000064C0000-0x0000000006814000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6b1c7a07e16a02e5868bb0501c899a37
SHA1 860ea7c0b64bed25048cf7d4fcc2c7f802ff8515
SHA256 e3bd4293a5a4a299e3e78e6c139ee91bd4086f5b8b2c2c649edde5c70cdd6dc7
SHA512 c9a68036aff8aee693d74b6e1d64b2626c8acc3d501143d76a75b24343f7d4eac7e6ba459e509d1abaa3e1b386eb3169fb50dde92b3b32e8aa203705f92acf3a

memory/392-137-0x000000007FA10000-0x000000007FA20000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 0e60b72dceb55ccfa12d839bb9cc8399
SHA1 eeae1a5b7f486f8870268bfec9fab1971c06048b
SHA256 c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01
SHA512 f305d1001481898bd7567657e4fb4741c5ee1c5bc5b6594ce0b6975e6e6f21fc576601751f8858617e7a1f5b237ecde96bf946c819ff4ba01ec4b1ce847c1af1

memory/5024-157-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 bb539b69409d3c0c901f5997a478c03f
SHA1 ea46a0bf1e21f542679e89c9376aa037bf8ce7fc
SHA256 dde9cd1734b0682d2bf703a5ac4d922c869dc06c29aa9f738091467c616b6fe8
SHA512 b29f2b8ba49a1f70dde36d3f40802607d4e2040a828cea60590af6b217984c4658df1c97a63683bf6d962da572abf5f21eaa205dcd1e151aa93d2cbd845b18e1

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8bc905716f758be9193dd6017e080daf
SHA1 0f6ef7aaf700d136ea412636b9f3c6f9f311de31
SHA256 79399ae7f0ef207a82f55e3314e13675185f504ee9a575b92f4a2ae27371c6a6
SHA512 cb1f8ebb8fee7db2217395dd7470a42b162ecbf73070432e883ed03acc8dcb26f311078f3cc74aef28290f0ebb6e8b992578dcfa8621993de56d45696d1ad125

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1dfeed137a9adc50137d3926f78769ab
SHA1 265cb14d72f28a5c985efe9e659d67ded44dd859
SHA256 d40a5a18688c3c61d4bf118b19ed8bb188958e35636a8442900618fc21129e96
SHA512 adeee474cc944fdfb8f0cea2d1c5de18501f0d78729aaad88eb922d53cd17693f152235ce9449a9ec1381d343dfdc7c7e73b9841945880d193a535a9951f6ef2

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1612-257-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3604-265-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1612-266-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1172-267-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1612-268-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1612-270-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1172-271-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1612-272-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1612-274-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1612-276-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1612-278-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1612-280-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1612-282-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1612-284-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1612-286-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1612-288-0x0000000000400000-0x0000000001E06000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 19:56

Reported

2024-04-19 19:59

Platform

win11-20240412-en

Max time kernel

149s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-301 = "Romance Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2432 = "Cuba Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4296 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4296 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4296 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 4220 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\system32\cmd.exe
PID 4336 wrote to memory of 1184 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\system32\cmd.exe
PID 1184 wrote to memory of 1424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1184 wrote to memory of 1424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4336 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4336 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\rss\csrss.exe
PID 4336 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\rss\csrss.exe
PID 4336 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe C:\Windows\rss\csrss.exe
PID 4684 wrote to memory of 4900 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 4900 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 4900 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 3048 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 3048 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 3048 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 2408 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 2408 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 2408 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4684 wrote to memory of 2364 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4684 wrote to memory of 2364 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 132 wrote to memory of 1896 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 132 wrote to memory of 1896 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 132 wrote to memory of 1896 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1896 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1896 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1896 wrote to memory of 1892 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe

"C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe

"C:\Users\Admin\AppData\Local\Temp\c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4336 -ip 4336

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 788

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 c542c1d3-7c01-4b16-afae-b653024aac7a.uuid.localstats.org udp
US 8.8.8.8:53 stun3.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server12.localstats.org tcp
IT 142.251.27.127:19302 stun3.l.google.com udp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
IE 52.111.236.23:443 tcp
BG 185.82.216.111:443 server12.localstats.org tcp

Files

memory/4296-1-0x0000000003DD0000-0x00000000041D6000-memory.dmp

memory/4296-2-0x00000000041E0000-0x0000000004ACB000-memory.dmp

memory/4296-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2024-4-0x0000000074490000-0x0000000074C41000-memory.dmp

memory/2024-5-0x0000000004660000-0x0000000004696000-memory.dmp

memory/2024-6-0x0000000000850000-0x0000000000860000-memory.dmp

memory/2024-7-0x0000000004CD0000-0x00000000052FA000-memory.dmp

memory/2024-8-0x0000000004BF0000-0x0000000004C12000-memory.dmp

memory/2024-9-0x0000000005300000-0x0000000005366000-memory.dmp

memory/2024-10-0x0000000005560000-0x00000000055C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s1hqn0cs.hs3.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2024-19-0x00000000055D0000-0x0000000005927000-memory.dmp

memory/2024-20-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

memory/2024-21-0x0000000005B70000-0x0000000005BBC000-memory.dmp

memory/2024-22-0x00000000060F0000-0x0000000006136000-memory.dmp

memory/2024-23-0x000000007F080000-0x000000007F090000-memory.dmp

memory/2024-24-0x0000000006F70000-0x0000000006FA4000-memory.dmp

memory/2024-25-0x0000000070700000-0x000000007074C000-memory.dmp

memory/2024-26-0x0000000070880000-0x0000000070BD7000-memory.dmp

memory/2024-35-0x0000000006FB0000-0x0000000006FCE000-memory.dmp

memory/2024-36-0x0000000006FD0000-0x0000000007074000-memory.dmp

memory/2024-37-0x0000000000850000-0x0000000000860000-memory.dmp

memory/2024-38-0x0000000007740000-0x0000000007DBA000-memory.dmp

memory/2024-39-0x00000000070F0000-0x000000000710A000-memory.dmp

memory/2024-40-0x0000000007130000-0x000000000713A000-memory.dmp

memory/2024-41-0x0000000007240000-0x00000000072D6000-memory.dmp

memory/2024-42-0x0000000007150000-0x0000000007161000-memory.dmp

memory/2024-43-0x00000000071A0000-0x00000000071AE000-memory.dmp

memory/2024-44-0x00000000071B0000-0x00000000071C5000-memory.dmp

memory/2024-45-0x0000000007200000-0x000000000721A000-memory.dmp

memory/2024-46-0x0000000007220000-0x0000000007228000-memory.dmp

memory/2024-49-0x0000000074490000-0x0000000074C41000-memory.dmp

memory/4296-50-0x0000000003DD0000-0x00000000041D6000-memory.dmp

memory/4296-51-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4336-53-0x0000000003AF0000-0x0000000003EEC000-memory.dmp

memory/4296-54-0x00000000041E0000-0x0000000004ACB000-memory.dmp

memory/4336-55-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4220-56-0x0000000074520000-0x0000000074CD1000-memory.dmp

memory/4220-57-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/4220-58-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/4220-67-0x0000000005A50000-0x0000000005DA7000-memory.dmp

memory/4220-68-0x00000000064A0000-0x00000000064EC000-memory.dmp

memory/4220-69-0x000000007F740000-0x000000007F750000-memory.dmp

memory/4220-70-0x0000000070810000-0x000000007085C000-memory.dmp

memory/4220-71-0x0000000070990000-0x0000000070CE7000-memory.dmp

memory/4220-81-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/4220-80-0x00000000071A0000-0x0000000007244000-memory.dmp

memory/4220-82-0x0000000002B60000-0x0000000002B70000-memory.dmp

memory/4220-83-0x00000000074C0000-0x00000000074D1000-memory.dmp

memory/4220-84-0x0000000007510000-0x0000000007525000-memory.dmp

memory/4220-87-0x0000000074520000-0x0000000074CD1000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/428-89-0x0000000074520000-0x0000000074CD1000-memory.dmp

memory/428-90-0x0000000002870000-0x0000000002880000-memory.dmp

memory/428-92-0x0000000005760000-0x0000000005AB7000-memory.dmp

memory/428-91-0x0000000002870000-0x0000000002880000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d52fbff2d659617b42a9cd292453e7e3
SHA1 6ff3ef973f62a8c49db600a02f917beff2146f4e
SHA256 cd57b7729f37b2af645d949ea4e358bffca26808381efc377494ccfe8c48b028
SHA512 a0ee5dd4e3fd38f3038a7e272e68c9635fdf1eb5582ebb9aa8f0490a8986251fdc1f9bdfb51160036ce83f74a78cccf8c3f07eaa36c3e50d81f9237c50500d5f

memory/428-102-0x0000000070810000-0x000000007085C000-memory.dmp

memory/428-103-0x0000000070A50000-0x0000000070DA7000-memory.dmp

memory/4336-112-0x0000000003AF0000-0x0000000003EEC000-memory.dmp

memory/428-113-0x0000000002870000-0x0000000002880000-memory.dmp

memory/428-115-0x0000000074520000-0x0000000074CD1000-memory.dmp

memory/4336-116-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2716-117-0x0000000074520000-0x0000000074CD1000-memory.dmp

memory/4336-118-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2716-120-0x0000000005570000-0x0000000005580000-memory.dmp

memory/2716-119-0x0000000005570000-0x0000000005580000-memory.dmp

memory/2716-129-0x0000000006340000-0x0000000006697000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0765be9f9f78b46d45878a5df171e802
SHA1 b29ed012f615fd366d46204acf0a43fb192e0614
SHA256 83668ab8e6d5dc00db2b01a6efecd4835faabe8d5eddd47d3520cdfa0c9c7934
SHA512 1e57b81546be3330e954f82b9e7f04dce2d37f8b4466ab220eddff722bcca1e3f76ccbc6fbb753148b3f9194a67bd99f3318fbb3e25c3e55225c8c47c9e9f5f8

memory/2716-131-0x0000000070810000-0x000000007085C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 0e60b72dceb55ccfa12d839bb9cc8399
SHA1 eeae1a5b7f486f8870268bfec9fab1971c06048b
SHA256 c75db5c014523140eeb698c796a8c3a487d0d7663ba7f6b57852e7c91279ae01
SHA512 f305d1001481898bd7567657e4fb4741c5ee1c5bc5b6594ce0b6975e6e6f21fc576601751f8858617e7a1f5b237ecde96bf946c819ff4ba01ec4b1ce847c1af1

memory/4336-149-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 46b484509bf4c12b3a4ef9d108ede013
SHA1 b4cb6cf66e334f0d61288729e56c04a36ad6f54c
SHA256 3ba71137b79e5044969cc4ff0b10f9d54cd910a035ad0429d8449a7f17c8288a
SHA512 91e4d9cde863f09181122d271891a932c39487d9c7bab37d9f3837ca856eb26ff4604836f33b37f5556408b5a22847527b9ed9d27f57360c49f42776c22bafb7

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 330b326e9cb76a2ad437066a0e9ae4df
SHA1 e722dd7733daee68339ea9eb86dc0e2db144baf9
SHA256 d49614648bbd301996f4412f10cc0079a3055781787a81089a88fd896a1cdae6
SHA512 173ad3df20db53b66d82e7976788d9d861e193608adf8a6dccbcf841307b00c48cb927cab4e8d95750e7353a349409410d7ca6a583612331298381c139668bae

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 eb70475db04e210e1504e651950411c8
SHA1 5f87c10812c388741e4299cab9d500100eebb066
SHA256 2af6049fdfc75f98f1f4ad9350d220517e4eb3eacf0390cabc216d2a3178e3de
SHA512 02c79b3ab7acba90ff2709bdbe5b1e928db608f034058dfc483900923381bd68c05013169551d89d127f75da0db7677fa7696cfcc646558f94f2b0ddf94584c0

memory/4684-239-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4684-247-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/132-253-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4684-254-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/416-255-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4684-256-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4684-258-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/416-259-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4684-260-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4684-262-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4684-264-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4684-266-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4684-268-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4684-270-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4684-272-0x0000000000400000-0x0000000001E06000-memory.dmp