Malware Analysis Report

2025-08-05 12:17

Sample ID 240419-yp968aea49
Target accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8
SHA256 accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8

Threat Level: Known bad

The file accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Checks installed software on the system

Manipulates WinMonFS driver.

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 19:58

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 19:58

Reported

2024-04-19 20:01

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4872 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4872 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4872 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\system32\cmd.exe
PID 2428 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\system32\cmd.exe
PID 2320 wrote to memory of 3204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2320 wrote to memory of 3204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2428 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 3592 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2428 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\rss\csrss.exe
PID 2428 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\rss\csrss.exe
PID 2428 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\rss\csrss.exe
PID 4568 wrote to memory of 2308 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4568 wrote to memory of 2308 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4568 wrote to memory of 2308 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4568 wrote to memory of 1232 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4568 wrote to memory of 1232 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4568 wrote to memory of 1232 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4568 wrote to memory of 3004 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4568 wrote to memory of 3004 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4568 wrote to memory of 3004 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4568 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4568 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1192 wrote to memory of 4308 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1192 wrote to memory of 4308 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1192 wrote to memory of 4308 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4308 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4308 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4308 wrote to memory of 2404 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

"C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

"C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4872 -ip 4872

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 796

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 198.32.209.4.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 22.186.200.23.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 b5bcbc22-0096-4937-92dd-ff53e56e5cc5.uuid.statstraffic.org udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 server7.statstraffic.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 3.33.249.248:3478 stun.sipgate.net udp
BG 185.82.216.104:443 server7.statstraffic.org tcp
US 8.8.8.8:53 248.249.33.3.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 217.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
BG 185.82.216.104:443 server7.statstraffic.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
N/A 127.0.0.1:31465 tcp

Files

memory/4872-1-0x0000000003DB0000-0x00000000041B2000-memory.dmp

memory/4872-2-0x00000000041C0000-0x0000000004AAB000-memory.dmp

memory/4872-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3504-5-0x0000000073F70000-0x0000000074720000-memory.dmp

memory/3504-4-0x0000000002170000-0x00000000021A6000-memory.dmp

memory/3504-6-0x0000000004630000-0x0000000004640000-memory.dmp

memory/3504-7-0x0000000004C70000-0x0000000005298000-memory.dmp

memory/3504-8-0x0000000004AF0000-0x0000000004B12000-memory.dmp

memory/3504-9-0x0000000004B90000-0x0000000004BF6000-memory.dmp

memory/3504-10-0x0000000004C00000-0x0000000004C66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mec2lady.iay.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3504-20-0x0000000005460000-0x00000000057B4000-memory.dmp

memory/3504-21-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

memory/3504-22-0x0000000005B00000-0x0000000005B4C000-memory.dmp

memory/3504-23-0x0000000006020000-0x0000000006064000-memory.dmp

memory/3504-24-0x0000000006DD0000-0x0000000006E46000-memory.dmp

memory/3504-25-0x00000000074D0000-0x0000000007B4A000-memory.dmp

memory/3504-26-0x0000000006E70000-0x0000000006E8A000-memory.dmp

memory/3504-27-0x000000007FB00000-0x000000007FB10000-memory.dmp

memory/3504-28-0x0000000007030000-0x0000000007062000-memory.dmp

memory/3504-29-0x000000006FE10000-0x000000006FE5C000-memory.dmp

memory/3504-30-0x00000000701E0000-0x0000000070534000-memory.dmp

memory/3504-40-0x0000000007070000-0x000000000708E000-memory.dmp

memory/3504-41-0x0000000007090000-0x0000000007133000-memory.dmp

memory/3504-42-0x0000000007180000-0x000000000718A000-memory.dmp

memory/3504-43-0x0000000007240000-0x00000000072D6000-memory.dmp

memory/3504-44-0x00000000071A0000-0x00000000071B1000-memory.dmp

memory/3504-45-0x00000000071E0000-0x00000000071EE000-memory.dmp

memory/3504-46-0x00000000071F0000-0x0000000007204000-memory.dmp

memory/3504-47-0x00000000072E0000-0x00000000072FA000-memory.dmp

memory/3504-48-0x0000000007230000-0x0000000007238000-memory.dmp

memory/3504-51-0x0000000073F70000-0x0000000074720000-memory.dmp

memory/2428-53-0x0000000003BD0000-0x0000000003FD6000-memory.dmp

memory/4872-54-0x0000000003DB0000-0x00000000041B2000-memory.dmp

memory/2428-55-0x0000000003FE0000-0x00000000048CB000-memory.dmp

memory/4872-57-0x00000000041C0000-0x0000000004AAB000-memory.dmp

memory/4872-56-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2428-58-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2324-59-0x0000000074010000-0x00000000747C0000-memory.dmp

memory/2324-60-0x0000000005490000-0x00000000054A0000-memory.dmp

memory/2324-61-0x0000000005490000-0x00000000054A0000-memory.dmp

memory/2324-71-0x0000000006330000-0x0000000006684000-memory.dmp

memory/2324-72-0x0000000006DB0000-0x0000000006DFC000-memory.dmp

memory/2324-74-0x000000006FF10000-0x000000006FF5C000-memory.dmp

memory/2324-73-0x000000007F3F0000-0x000000007F400000-memory.dmp

memory/2324-75-0x0000000070670000-0x00000000709C4000-memory.dmp

memory/2324-85-0x0000000007B00000-0x0000000007BA3000-memory.dmp

memory/2324-86-0x0000000005490000-0x00000000054A0000-memory.dmp

memory/2324-87-0x0000000005490000-0x00000000054A0000-memory.dmp

memory/2324-88-0x0000000007E10000-0x0000000007E21000-memory.dmp

memory/2324-89-0x0000000007E60000-0x0000000007E74000-memory.dmp

memory/2324-92-0x0000000074010000-0x00000000747C0000-memory.dmp

memory/3592-94-0x0000000074010000-0x00000000747C0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/3592-95-0x0000000005010000-0x0000000005020000-memory.dmp

memory/3592-97-0x0000000005CF0000-0x0000000006044000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c21441975c0f8431d68d01676ca608fc
SHA1 8560580994ba46c9060646c906078e87d310cb75
SHA256 fe768fe0221ce331edc7b8f38a922e95a9224811f50a87daf6f6a96c6df1e8ee
SHA512 5af5d55f27647f456b035d4a314e8f24363b5357e59e113ed5bf29229447f0255328361db157e4ef8ea4efe93ebb99d572fcbe874bc3e3769fab5824104ce170

memory/3592-107-0x000000006FF10000-0x000000006FF5C000-memory.dmp

memory/2428-108-0x0000000003BD0000-0x0000000003FD6000-memory.dmp

memory/3592-109-0x00000000706B0000-0x0000000070A04000-memory.dmp

memory/3592-110-0x000000007F1B0000-0x000000007F1C0000-memory.dmp

memory/3592-121-0x0000000074010000-0x00000000747C0000-memory.dmp

memory/1420-123-0x0000000005230000-0x0000000005240000-memory.dmp

memory/1420-122-0x0000000074010000-0x00000000747C0000-memory.dmp

memory/2428-133-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1420-135-0x0000000006150000-0x00000000064A4000-memory.dmp

memory/1420-134-0x0000000005230000-0x0000000005240000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 25241b0932a1e24c95747b16b4c582fb
SHA1 4fea2039afc05b0e74d55ecf87434009711c55fb
SHA256 196060d080cc0e338986d9894d4c617aa4d19dd030eb1e5b261a06477a2f8c2c
SHA512 d074e1def775aa3868eeb75d82bc99a3fd1744d81fcc366c789b9c844d5fd5f243995727b889495eb701a40f0f4bef2c95a4d0607c4f6be5d81378abee964288

memory/1420-137-0x000000007F8D0000-0x000000007F8E0000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 fa4f154cb06c1b9fb3123fe0c2587f78
SHA1 b814221815fff6a43f290b048b2b9d217b398c25
SHA256 accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8
SHA512 e7bccaf9ca606654bb1879a0358eb6e9181eb5811184a72c134dcb250ea1753f2054668a1f57e253429672ef84cc9f9bf67bb27bd9997cd753af86847963f716

memory/2428-154-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9505189c16cbd79f4e7d5e211c26cde4
SHA1 2ec48767a0d8234632908e1cb931de10a8f0cebf
SHA256 31dbda1da0ebe63917583882ce1bfa984c55b8ccd985caedb66efec75e255777
SHA512 6d466b2de71c2f194fa0167422c776209a61dd5be13e6f7464cc084b0f633d57ae9bc654c4875eba25ffa8da943baf44dc2cffa1a07a71581551e058ecb76f8c

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 981787f8a97dea652e3cbd731ac02bc9
SHA1 85c0a3edb84f055cda48f530d65dc02ba7f4e183
SHA256 4a27de00e2c956d70d212b3f535b2f447c802743c7af4175848dbf04cf268a62
SHA512 09a4d6da1b285006286aa75d2d3578816bfbcdf05682c1c8cdefaea26dd0a2ce33a7369fbe6d72a78f65a1ce847d34bd260a2b3c48c1cd1f6b3e3a6dd58a029c

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b4bf72f8574aba1776c6e2f960f340f8
SHA1 f348fcaa038ae87c163ac0cdfdef00a1ee6e16d4
SHA256 aab13234360a5de398e55f2bc644eab2e07a590849725c825d217cfd738e52cc
SHA512 37ff53761423562ddde02a24c061244e86b27c50bc6ec06251d579e5efc61630f0b72da75afcc49a1eebe0c86af48a24f04578736d6f54e99107fd75cd11d9e5

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4568-260-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1192-268-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4568-269-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4568-270-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1948-271-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4568-273-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1948-274-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4568-275-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4568-277-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4568-279-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4568-280-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4568-282-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4568-285-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4568-287-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4568-289-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4568-290-0x0000000000400000-0x0000000001E06000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 19:58

Reported

2024-04-19 20:01

Platform

win11-20240412-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-801878912-692986033-442676226-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-331 = "E. Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5316 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5316 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5316 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1792 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1792 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1792 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1792 wrote to memory of 5680 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\system32\cmd.exe
PID 1792 wrote to memory of 5680 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\system32\cmd.exe
PID 5680 wrote to memory of 1448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5680 wrote to memory of 1448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1792 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1792 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1792 wrote to memory of 232 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1792 wrote to memory of 5764 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1792 wrote to memory of 5764 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1792 wrote to memory of 5764 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1792 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\rss\csrss.exe
PID 1792 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\rss\csrss.exe
PID 1792 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe C:\Windows\rss\csrss.exe
PID 1116 wrote to memory of 1312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 1312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 1312 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 5980 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 5980 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 5980 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 5444 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 5444 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 5444 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1116 wrote to memory of 1952 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1116 wrote to memory of 1952 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3744 wrote to memory of 5736 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3744 wrote to memory of 5736 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3744 wrote to memory of 5736 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5736 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5736 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5736 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

"C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe

"C:\Users\Admin\AppData\Local\Temp\accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5316 -ip 5316

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 716

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1792 -ip 1792

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 892

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 f58c48fe-bfe2-4d6d-8dd8-2b21478b1a1e.uuid.statstraffic.org udp
US 8.8.8.8:53 server4.statstraffic.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BE 172.253.120.127:19302 stun1.l.google.com udp
BG 185.82.216.104:443 server4.statstraffic.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BG 185.82.216.104:443 server4.statstraffic.org tcp
BG 185.82.216.104:443 server4.statstraffic.org tcp
BG 185.82.216.104:443 server4.statstraffic.org tcp

Files

memory/5316-1-0x0000000003BD0000-0x0000000003FD5000-memory.dmp

memory/5316-2-0x0000000003FE0000-0x00000000048CB000-memory.dmp

memory/5316-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3008-4-0x0000000002AA0000-0x0000000002AD6000-memory.dmp

memory/3008-7-0x00000000051E0000-0x000000000580A000-memory.dmp

memory/3008-8-0x0000000002A90000-0x0000000002AA0000-memory.dmp

memory/3008-6-0x0000000002A90000-0x0000000002AA0000-memory.dmp

memory/3008-5-0x0000000074580000-0x0000000074D31000-memory.dmp

memory/3008-9-0x0000000005080000-0x00000000050A2000-memory.dmp

memory/3008-10-0x0000000005880000-0x00000000058E6000-memory.dmp

memory/3008-11-0x00000000058F0000-0x0000000005956000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lqolk1bw.adb.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3008-20-0x0000000005A20000-0x0000000005D77000-memory.dmp

memory/3008-21-0x0000000005F40000-0x0000000005F5E000-memory.dmp

memory/3008-22-0x0000000005F90000-0x0000000005FDC000-memory.dmp

memory/3008-23-0x00000000064C0000-0x0000000006506000-memory.dmp

memory/3008-24-0x000000007F4B0000-0x000000007F4C0000-memory.dmp

memory/3008-25-0x0000000007170000-0x00000000071A4000-memory.dmp

memory/3008-26-0x00000000707F0000-0x000000007083C000-memory.dmp

memory/3008-27-0x0000000070970000-0x0000000070CC7000-memory.dmp

memory/3008-36-0x00000000073B0000-0x00000000073CE000-memory.dmp

memory/3008-37-0x00000000073D0000-0x0000000007474000-memory.dmp

memory/3008-38-0x0000000002A90000-0x0000000002AA0000-memory.dmp

memory/3008-39-0x0000000007B40000-0x00000000081BA000-memory.dmp

memory/3008-40-0x0000000007500000-0x000000000751A000-memory.dmp

memory/3008-41-0x0000000007540000-0x000000000754A000-memory.dmp

memory/3008-42-0x0000000007650000-0x00000000076E6000-memory.dmp

memory/3008-43-0x0000000007560000-0x0000000007571000-memory.dmp

memory/3008-44-0x00000000075B0000-0x00000000075BE000-memory.dmp

memory/3008-45-0x00000000075C0000-0x00000000075D5000-memory.dmp

memory/3008-46-0x0000000007610000-0x000000000762A000-memory.dmp

memory/3008-47-0x0000000007630000-0x0000000007638000-memory.dmp

memory/3008-50-0x0000000074580000-0x0000000074D31000-memory.dmp

memory/1792-52-0x0000000003B40000-0x0000000003F48000-memory.dmp

memory/5316-53-0x0000000003BD0000-0x0000000003FD5000-memory.dmp

memory/1792-55-0x0000000003F50000-0x000000000483B000-memory.dmp

memory/5316-54-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1792-56-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/780-57-0x0000000074620000-0x0000000074DD1000-memory.dmp

memory/780-58-0x00000000045B0000-0x00000000045C0000-memory.dmp

memory/780-59-0x00000000045B0000-0x00000000045C0000-memory.dmp

memory/780-68-0x00000000054C0000-0x0000000005817000-memory.dmp

memory/780-69-0x0000000005F70000-0x0000000005FBC000-memory.dmp

memory/780-71-0x0000000070900000-0x000000007094C000-memory.dmp

memory/780-72-0x0000000070B10000-0x0000000070E67000-memory.dmp

memory/780-70-0x000000007F550000-0x000000007F560000-memory.dmp

memory/780-81-0x0000000006C20000-0x0000000006CC4000-memory.dmp

memory/780-82-0x0000000006F40000-0x0000000006F51000-memory.dmp

memory/780-83-0x0000000006F90000-0x0000000006FA5000-memory.dmp

memory/780-86-0x0000000074620000-0x0000000074DD1000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/232-88-0x0000000074620000-0x0000000074DD1000-memory.dmp

memory/232-89-0x00000000032B0000-0x00000000032C0000-memory.dmp

memory/232-98-0x0000000006370000-0x00000000066C7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e2e11a1637407f2d1983fcf486eeaf0a
SHA1 d49136788e3db639dcb28d1d29727548ff2cdaf8
SHA256 a6fe7af34c37a6707cc201a213bdc15afbadfcb24dae07f2804d6addeadb692c
SHA512 9def9adceebbe4e409d84a0089509f20ea6d221345a8a4e96a589786803521b63074426e4f27a64062fae93f577b31d3a32f48f0753f82f60312d75e2ba7aa3e

memory/232-102-0x0000000070A80000-0x0000000070DD7000-memory.dmp

memory/232-101-0x0000000070900000-0x000000007094C000-memory.dmp

memory/232-100-0x000000007F470000-0x000000007F480000-memory.dmp

memory/1792-111-0x0000000003B40000-0x0000000003F48000-memory.dmp

memory/232-113-0x0000000074620000-0x0000000074DD1000-memory.dmp

memory/5764-114-0x0000000074620000-0x0000000074DD1000-memory.dmp

memory/5764-115-0x00000000055F0000-0x0000000005600000-memory.dmp

memory/5764-124-0x00000000063B0000-0x0000000006707000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8f0f715a98d83a6340f3037eb2a42115
SHA1 0a940a65c15d356e72378e7ff5c9af4d0fc10522
SHA256 3ff0177a8976cdb9c066627580f7466e61c3b87ac995289d20c3b04bcf873dd4
SHA512 f14f28e6a3d2dcfcc5e67d13c0c9eeabaf9f7c50b6ba4a67cc913f706e49c61a338ff3b0074a99fe3bb9a447c1e65a3a4bc1d0fa22f704dbbb77f37d6e858413

memory/5764-126-0x0000000070900000-0x000000007094C000-memory.dmp

memory/5764-127-0x0000000070B50000-0x0000000070EA7000-memory.dmp

memory/1792-128-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/5764-137-0x000000007F0E0000-0x000000007F0F0000-memory.dmp

memory/5764-138-0x00000000055F0000-0x0000000005600000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 fa4f154cb06c1b9fb3123fe0c2587f78
SHA1 b814221815fff6a43f290b048b2b9d217b398c25
SHA256 accda9c6c63ba67bc22e351bdfd3fac9479d2f654a5de3bf9886b0f74cc3b2d8
SHA512 e7bccaf9ca606654bb1879a0358eb6e9181eb5811184a72c134dcb250ea1753f2054668a1f57e253429672ef84cc9f9bf67bb27bd9997cd753af86847963f716

memory/1792-147-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c53829c11394b94aa072d440a3328a6d
SHA1 0ce08c3317aceef73428db0d1831e995a5d5694a
SHA256 1f616107955e79edbb72765245096f9ed1716c3e2adf268f28d5b07387cbc56b
SHA512 3da1d1e788cf15509bc38486e5316fee961ce60c7b70d414a462bae1180e3d62cb2e0148af325a55f8f56ed2b8a2e0a121f0a198483731bedfb4363436d3e61c

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 912002784d96d2f4de88c163fdb24ab3
SHA1 670f0966fec13c5a3c01c4e2f3327dd56c340504
SHA256 e1234b63335d59ec2108abe8f1c3043124bf3c2585674308161a8cdfc6170dff
SHA512 6155f88e34aedd9377827391971748daba8d4b2ce57e00132ab179068e16c84173857289ee15228ede0598d4cf8ce22c7308f5770fdc58bf227493b38b1246e5

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f1bbfd895a4d2a5c01713566fb33454d
SHA1 e6132338dd7127e60fe6c43f93c78332af1e7f62
SHA256 2383482fd156c656c4d6867d3df8cc0a9d577e8c4a629084710aab7b80f7d4bd
SHA512 6bec164e53074aae59b871b8806246fd64bddc6b633794bf025d4b56caef592a6462f25ca446028e4cb2a4e64ecb10711a3a381aec66d3d437e362baf9b050c8

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1116-241-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3744-249-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1116-250-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1116-251-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/5308-252-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1116-254-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/5308-255-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1116-256-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1116-258-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1116-260-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1116-262-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1116-263-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1116-266-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1116-268-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1116-270-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1116-272-0x0000000000400000-0x0000000001E06000-memory.dmp