Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 20:03
Static task
static1
Behavioral task
behavioral1
Sample
0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe
Resource
win10v2004-20240412-en
General
-
Target
0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe
-
Size
4.2MB
-
MD5
abfd14d9b574050750e09685fea6f766
-
SHA1
fb30f8f31f0618aaec9ef31a98358403b509062b
-
SHA256
0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704
-
SHA512
7baf81d3ee37a459e286e6d7c95488be46dc97ecf932b01ab9cc0bb133c03c18bc0f701ad12f56965db9c82401a73016d3653fe0a4e525c4d844880935d70c4e
-
SSDEEP
98304:x00QK3N3Jc8wpX9Ml+P+WnP01raAvqFLRTemOJzdkXGC:DpJcNpX++PyaASVpB6kj
Malware Config
Signatures
-
Glupteba payload 20 IoCs
resource yara_rule behavioral1/memory/3048-2-0x0000000003F80000-0x000000000486B000-memory.dmp family_glupteba behavioral1/memory/3048-3-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/3048-55-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/1460-57-0x0000000003F50000-0x000000000483B000-memory.dmp family_glupteba behavioral1/memory/3048-58-0x0000000003F80000-0x000000000486B000-memory.dmp family_glupteba behavioral1/memory/1460-59-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/1460-156-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-261-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-270-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-272-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-274-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-276-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-278-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-280-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-282-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-284-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-286-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-288-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-290-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral1/memory/2872-291-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2388 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 2872 csrss.exe 4248 injector.exe 4080 windefender.exe 1248 windefender.exe -
resource yara_rule behavioral1/files/0x0012000000023429-264.dat upx behavioral1/memory/4080-269-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1248-271-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1248-275-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3952 sc.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 2872 3048 WerFault.exe 83 2788 1460 WerFault.exe 93 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4796 schtasks.exe 4600 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-162 = "Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2984 powershell.exe 2984 powershell.exe 3048 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 3048 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 3964 powershell.exe 3964 powershell.exe 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 4680 powershell.exe 4680 powershell.exe 4680 powershell.exe 4424 powershell.exe 4424 powershell.exe 4424 powershell.exe 2256 powershell.exe 2256 powershell.exe 2256 powershell.exe 3808 powershell.exe 3808 powershell.exe 3808 powershell.exe 5076 powershell.exe 5076 powershell.exe 5076 powershell.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 2872 csrss.exe 2872 csrss.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 2872 csrss.exe 2872 csrss.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 2872 csrss.exe 2872 csrss.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe 4248 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2984 powershell.exe Token: SeDebugPrivilege 3048 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Token: SeImpersonatePrivilege 3048 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe Token: SeDebugPrivilege 3964 powershell.exe Token: SeDebugPrivilege 4680 powershell.exe Token: SeDebugPrivilege 4424 powershell.exe Token: SeDebugPrivilege 2256 powershell.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeSystemEnvironmentPrivilege 2872 csrss.exe Token: SeSecurityPrivilege 3952 sc.exe Token: SeSecurityPrivilege 3952 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2984 3048 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 88 PID 3048 wrote to memory of 2984 3048 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 88 PID 3048 wrote to memory of 2984 3048 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 88 PID 1460 wrote to memory of 3964 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 97 PID 1460 wrote to memory of 3964 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 97 PID 1460 wrote to memory of 3964 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 97 PID 1460 wrote to memory of 3500 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 102 PID 1460 wrote to memory of 3500 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 102 PID 3500 wrote to memory of 2388 3500 cmd.exe 104 PID 3500 wrote to memory of 2388 3500 cmd.exe 104 PID 1460 wrote to memory of 4680 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 105 PID 1460 wrote to memory of 4680 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 105 PID 1460 wrote to memory of 4680 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 105 PID 1460 wrote to memory of 4424 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 108 PID 1460 wrote to memory of 4424 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 108 PID 1460 wrote to memory of 4424 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 108 PID 1460 wrote to memory of 2872 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 110 PID 1460 wrote to memory of 2872 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 110 PID 1460 wrote to memory of 2872 1460 0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe 110 PID 2872 wrote to memory of 2256 2872 csrss.exe 114 PID 2872 wrote to memory of 2256 2872 csrss.exe 114 PID 2872 wrote to memory of 2256 2872 csrss.exe 114 PID 2872 wrote to memory of 3808 2872 csrss.exe 120 PID 2872 wrote to memory of 3808 2872 csrss.exe 120 PID 2872 wrote to memory of 3808 2872 csrss.exe 120 PID 2872 wrote to memory of 5076 2872 csrss.exe 123 PID 2872 wrote to memory of 5076 2872 csrss.exe 123 PID 2872 wrote to memory of 5076 2872 csrss.exe 123 PID 2872 wrote to memory of 4248 2872 csrss.exe 125 PID 2872 wrote to memory of 4248 2872 csrss.exe 125 PID 4080 wrote to memory of 4436 4080 windefender.exe 131 PID 4080 wrote to memory of 4436 4080 windefender.exe 131 PID 4080 wrote to memory of 4436 4080 windefender.exe 131 PID 4436 wrote to memory of 3952 4436 cmd.exe 132 PID 4436 wrote to memory of 3952 4436 cmd.exe 132 PID 4436 wrote to memory of 3952 4436 cmd.exe 132 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe"C:\Users\Admin\AppData\Local\Temp\0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe"C:\Users\Admin\AppData\Local\Temp\0091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3964
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2388
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4600
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4548
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4248
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4796
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3952
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 7483⤵
- Program crash
PID:2788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 7842⤵
- Program crash
PID:2872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3048 -ip 30481⤵PID:5116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1460 -ip 14601⤵PID:4948
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1248
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f21c8fa0e8a49999f9a22f20f7de0fc7
SHA1aa0554f97716a4aedf05fbe27c472baaa3fc9e0b
SHA2568815d3802e13752237b2d30c01599eb039936effa1042a17fea728538fae8bb4
SHA51218a67782803ebd2a9eb3535199df2685d62ede8fc54a62d188a167a26679ce8650176fc8ac1a9ecd232fade451e60bd979d9e70e6c9a9603d9d01e560af6a6ae
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD537926cc857ab2054656b4373adcf8f38
SHA179798576a3f6bc7a0f28bde94ff3a9c5b7b54221
SHA256e76cdb6006ff4f3ed7986c6d79ac55d529b2ccb0e425e1c73e0dc9bab3476865
SHA512a23a971c3a0a10e87e3249b5a98dac2a6df936cdd785b66d5f5dd38e1a3f68307265a10d1afb36fce3127e277aaefc8c276c8faea69992ead450704e51b02e73
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD56256fc17324c962568a73948b3b8204d
SHA192a67a1a2c2bcb48ac7cec364a9f75d1d607ee98
SHA2564b15d12abc24190eb3b1c9dd1c0c11a4bba42f84e776f8c2f42ae5ea0a5bb454
SHA512857b14d3dba1dd6c567d7d3aa4257dc40d9d144e4ab5cdbb5e02fc862e9399f0556e7dbcde7afb2688a5efdc76f4cd485161d9f3ba33ba68b813594729241d48
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5d332694c5e593340438ca9ee1809a3d1
SHA131e451bc38f3c5b2dd55467d44fb16b8360e39fa
SHA25626ff8b777af2d89149cb619b50f987a1400eb1b01832449b7b04f18cc4e0f4ad
SHA512170705fa7d729f55934d2fb4c200d0e9ff3a1d5d0070f28804ff37602f6495ac55d2e7ff4bc6d1f694d1dd300fa09bfb1437eb95d333e8051d3861daeb1fd788
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5fb851dd78db274e51e7a64054697f121
SHA148b1225e5929d8286723879af9a1f96cb61710c3
SHA256add4f728eb0e08060eb1d647ac0795e7c8185066c57627c95ae176548738bbb2
SHA51275b006d57646353019d2edabdcd006b0835bbf1a0b94de041363df7ee0e20da505768c39d59328408ac378fb67b64fbbb2faa4929942732fd1bd757c26a01c71
-
Filesize
4.2MB
MD5abfd14d9b574050750e09685fea6f766
SHA1fb30f8f31f0618aaec9ef31a98358403b509062b
SHA2560091f18011e7aa34de35d985865b3eb184a6c68acdb6566ceff50895346de704
SHA5127baf81d3ee37a459e286e6d7c95488be46dc97ecf932b01ab9cc0bb133c03c18bc0f701ad12f56965db9c82401a73016d3653fe0a4e525c4d844880935d70c4e
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec