Malware Analysis Report

2025-08-05 12:17

Sample ID 240419-yvemhaeb58
Target 2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8
SHA256 2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8
Tags
glupteba discovery dropper evasion loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8

Threat Level: Known bad

The file 2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Adds Run key to start application

Checks installed software on the system

Manipulates WinMonFS driver.

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Drops file in Windows directory

Program crash

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 20:06

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 20:06

Reported

2024-04-19 20:08

Platform

win10v2004-20240412-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1424 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1424 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1424 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 1836 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\system32\cmd.exe
PID 628 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\system32\cmd.exe
PID 2664 wrote to memory of 1028 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2664 wrote to memory of 1028 N/A C:\Windows\system32\cmd.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 4224 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 628 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\rss\csrss.exe
PID 628 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\rss\csrss.exe
PID 628 wrote to memory of 940 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\rss\csrss.exe
PID 940 wrote to memory of 4000 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 940 wrote to memory of 4000 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 940 wrote to memory of 4000 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 940 wrote to memory of 1028 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 940 wrote to memory of 1028 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 940 wrote to memory of 1028 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 940 wrote to memory of 2684 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 940 wrote to memory of 2684 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 940 wrote to memory of 2684 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 940 wrote to memory of 4960 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 940 wrote to memory of 4960 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2312 wrote to memory of 3676 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2312 wrote to memory of 3676 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2312 wrote to memory of 3676 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3676 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3676 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3676 wrote to memory of 540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe

"C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe

"C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1424 -ip 1424

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1424 -s 856

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 38.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 156.33.209.4.in-addr.arpa udp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 8fc72613-eb8b-40e5-beee-f464566141ad.uuid.statscreate.org udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server4.statscreate.org udp
US 15.197.250.192:3478 stun.sipgate.net udp
US 162.159.134.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server4.statscreate.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 192.250.197.15.in-addr.arpa udp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.251.17.2.in-addr.arpa udp
BG 185.82.216.96:443 server4.statscreate.org tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
N/A 127.0.0.1:31465 tcp

Files

memory/1424-1-0x0000000003BB0000-0x0000000003FB8000-memory.dmp

memory/1424-2-0x0000000003FC0000-0x00000000048AB000-memory.dmp

memory/1424-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2680-4-0x00000000031C0000-0x00000000031F6000-memory.dmp

memory/2680-5-0x0000000074760000-0x0000000074F10000-memory.dmp

memory/2680-7-0x0000000005990000-0x0000000005FB8000-memory.dmp

memory/2680-6-0x0000000005350000-0x0000000005360000-memory.dmp

memory/2680-8-0x0000000005350000-0x0000000005360000-memory.dmp

memory/2680-9-0x00000000057D0000-0x00000000057F2000-memory.dmp

memory/2680-10-0x0000000005870000-0x00000000058D6000-memory.dmp

memory/2680-11-0x0000000005FC0000-0x0000000006026000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kt4yijnt.q01.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2680-21-0x00000000061B0000-0x0000000006504000-memory.dmp

memory/2680-22-0x00000000067A0000-0x00000000067BE000-memory.dmp

memory/2680-23-0x0000000006860000-0x00000000068AC000-memory.dmp

memory/2680-24-0x0000000006D00000-0x0000000006D44000-memory.dmp

memory/2680-25-0x0000000007B30000-0x0000000007BA6000-memory.dmp

memory/2680-27-0x0000000007AF0000-0x0000000007B0A000-memory.dmp

memory/2680-26-0x0000000008230000-0x00000000088AA000-memory.dmp

memory/2680-28-0x000000007F9C0000-0x000000007F9D0000-memory.dmp

memory/2680-29-0x0000000007D30000-0x0000000007D62000-memory.dmp

memory/2680-30-0x0000000070600000-0x000000007064C000-memory.dmp

memory/2680-31-0x00000000707A0000-0x0000000070AF4000-memory.dmp

memory/2680-41-0x0000000007D70000-0x0000000007D8E000-memory.dmp

memory/2680-43-0x0000000007D90000-0x0000000007E33000-memory.dmp

memory/2680-42-0x0000000005350000-0x0000000005360000-memory.dmp

memory/2680-44-0x0000000007E80000-0x0000000007E8A000-memory.dmp

memory/2680-45-0x0000000007F40000-0x0000000007FD6000-memory.dmp

memory/2680-46-0x0000000007EA0000-0x0000000007EB1000-memory.dmp

memory/2680-47-0x0000000007EE0000-0x0000000007EEE000-memory.dmp

memory/2680-48-0x0000000007EF0000-0x0000000007F04000-memory.dmp

memory/2680-49-0x0000000007FE0000-0x0000000007FFA000-memory.dmp

memory/2680-50-0x0000000007F30000-0x0000000007F38000-memory.dmp

memory/2680-53-0x0000000074760000-0x0000000074F10000-memory.dmp

memory/628-55-0x0000000003C10000-0x0000000004016000-memory.dmp

memory/628-57-0x0000000004020000-0x000000000490B000-memory.dmp

memory/1424-58-0x0000000003BB0000-0x0000000003FB8000-memory.dmp

memory/1424-56-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/628-59-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1424-60-0x0000000003FC0000-0x00000000048AB000-memory.dmp

memory/1836-62-0x0000000005170000-0x0000000005180000-memory.dmp

memory/1836-63-0x0000000005170000-0x0000000005180000-memory.dmp

memory/1836-61-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/1836-73-0x0000000006130000-0x0000000006484000-memory.dmp

memory/1836-74-0x00000000065D0000-0x000000000661C000-memory.dmp

memory/1836-76-0x0000000070700000-0x000000007074C000-memory.dmp

memory/1836-77-0x0000000070880000-0x0000000070BD4000-memory.dmp

memory/1836-89-0x0000000005170000-0x0000000005180000-memory.dmp

memory/1836-88-0x0000000005170000-0x0000000005180000-memory.dmp

memory/1836-87-0x0000000007780000-0x0000000007823000-memory.dmp

memory/1836-75-0x000000007F9C0000-0x000000007F9D0000-memory.dmp

memory/1836-90-0x0000000007A90000-0x0000000007AA1000-memory.dmp

memory/1836-91-0x0000000007AE0000-0x0000000007AF4000-memory.dmp

memory/1836-94-0x0000000074840000-0x0000000074FF0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/4224-96-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/4224-98-0x00000000048A0000-0x00000000048B0000-memory.dmp

memory/4224-97-0x00000000048A0000-0x00000000048B0000-memory.dmp

memory/4224-100-0x0000000005760000-0x0000000005AB4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d158858df18e2f09d7b13d291b4c08b9
SHA1 c526e467ea9590a373ee0ab2f68d8bf644433e54
SHA256 98f25597ef962db409faf863095d86f3def6062a03c01f94d36cb84aac1f31c0
SHA512 2423666421a32727be097a9532fdbae5529b305e129efea1b827f93692429d182b4f43735600d3687440c1af0e0cf04823ad3fc71e1b2e97dfd8c994ebd19fc2

memory/4224-110-0x0000000070700000-0x000000007074C000-memory.dmp

memory/628-121-0x0000000003C10000-0x0000000004016000-memory.dmp

memory/4224-111-0x0000000070EA0000-0x00000000711F4000-memory.dmp

memory/4224-122-0x00000000048A0000-0x00000000048B0000-memory.dmp

memory/4224-124-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/3972-125-0x0000000074840000-0x0000000074FF0000-memory.dmp

memory/3972-127-0x0000000005390000-0x00000000053A0000-memory.dmp

memory/3972-126-0x0000000005390000-0x00000000053A0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 36064e91b642f1e1d492657163d6c949
SHA1 50d144dcae5b8ceea613c18787912a21af72134c
SHA256 316e052288df57c08a59eeaf8b6358676d5bb5c89251c3a24c2bd02a675913fe
SHA512 095b90af05c63c18c446c7c7aaa4475e722b2cf5a94084a882d5f900bdc7f34f40a41b12fad489d3c5307d3237b94ccf8c7151b7ec54020c1cfb9902c608cca7

C:\Windows\rss\csrss.exe

MD5 c3ef1155fd5f029ec180444ad56ee9cd
SHA1 dd63227bd963fe3879048e3212ff7044d98f7ba4
SHA256 2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8
SHA512 b5634ebd569d86e28ccb0c3d4d6aec2d230fb840de360deeac9bc083b9ec871750e125222b189f19c93135ea59aec0e0e375d19daa844ed1b1844b8ead9478f9

memory/628-157-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 dd79e10a1ced51510fbb14daec8ffc3f
SHA1 991e3486812d51809bee572db86e2e9b87f8ec78
SHA256 4680d52c4238598135074b1ccde512dd71226e72a0647ecaa2abdc3df628c8ba
SHA512 210b4d84559d43a965511669260065f35321c65a0b3d32fc5b86f754c7d92439e89c435666867d617b4bdde304d5d44a6a277403c2759fc3d364e836de7fd000

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3e10e483667c1f2258de42cb4aca1763
SHA1 59c69ecc95f75719e84b37907f26b26ad686abaf
SHA256 f652da3fb8bf4820590540cc48ea63bac8d08d73f3610e81f448ca362a0acf7c
SHA512 8267eb775c36e95537a5f32c6ac73b0ff476a0567442fcabf40b7074c6c96982b66aee9f40c7682b914505c4d2fd9761f64b1842029f5a79f155e0f0d741ae49

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d3a874c2f342ae054d4cb034a787d5c7
SHA1 977c8a58777f1855fb2d60580f2dd3794180760f
SHA256 f3ff4abf608d119af61f6d0088e5cf5db0ee0aef3cb59b1864e2cd5ca10af0ca
SHA512 5b4c5e64a2d4e9df23b6ea91fdc8e8ee4fda56f8fb14dba8b23bd34b3a56ad8fba8f9dbeca481aad583b5b2ef37a884cbbe347a6afcfae84b678f7534f336df9

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/940-262-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2312-269-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/940-270-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2544-271-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/940-272-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/940-274-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2544-275-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/940-276-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/940-278-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/940-280-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2544-281-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/940-282-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/940-284-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/940-286-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/940-288-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/940-290-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/940-292-0x0000000000400000-0x0000000001E06000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 20:06

Reported

2024-04-19 20:08

Platform

win11-20240412-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3928 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3928 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3928 wrote to memory of 4344 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3388 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3388 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3388 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3388 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\system32\cmd.exe
PID 3388 wrote to memory of 580 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\system32\cmd.exe
PID 580 wrote to memory of 1740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 580 wrote to memory of 1740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3388 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3388 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3388 wrote to memory of 2116 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3388 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3388 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3388 wrote to memory of 3452 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3388 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\rss\csrss.exe
PID 3388 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\rss\csrss.exe
PID 3388 wrote to memory of 1788 N/A C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe C:\Windows\rss\csrss.exe
PID 1788 wrote to memory of 4216 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 4216 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 4216 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 3916 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 3916 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 3916 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 4916 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 4916 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 4916 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 2480 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1788 wrote to memory of 2480 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3112 wrote to memory of 2104 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3112 wrote to memory of 2104 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3112 wrote to memory of 2104 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2104 wrote to memory of 236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2104 wrote to memory of 236 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe

"C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe

"C:\Users\Admin\AppData\Local\Temp\2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 0df6d81a-1883-4af8-a2f9-fdc6b465471a.uuid.statscreate.org udp
US 8.8.8.8:53 server5.statscreate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server5.statscreate.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
N/A 127.0.0.1:3478 udp
BE 172.253.120.127:19302 stun1.l.google.com udp
BG 185.82.216.96:443 server5.statscreate.org tcp
BG 185.82.216.96:443 server5.statscreate.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/3928-1-0x0000000003D20000-0x0000000004128000-memory.dmp

memory/3928-2-0x0000000004130000-0x0000000004A1B000-memory.dmp

memory/3928-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4344-4-0x0000000002D90000-0x0000000002DC6000-memory.dmp

memory/4344-5-0x0000000074050000-0x0000000074801000-memory.dmp

memory/4344-6-0x0000000004F90000-0x0000000004FA0000-memory.dmp

memory/4344-8-0x00000000055D0000-0x0000000005BFA000-memory.dmp

memory/4344-7-0x0000000004F90000-0x0000000004FA0000-memory.dmp

memory/4344-9-0x0000000005490000-0x00000000054B2000-memory.dmp

memory/4344-10-0x0000000005540000-0x00000000055A6000-memory.dmp

memory/4344-11-0x0000000005C70000-0x0000000005CD6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cvpblcb2.u1y.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4344-20-0x0000000005D60000-0x00000000060B7000-memory.dmp

memory/4344-21-0x0000000006240000-0x000000000625E000-memory.dmp

memory/4344-22-0x0000000006290000-0x00000000062DC000-memory.dmp

memory/4344-23-0x0000000006800000-0x0000000006846000-memory.dmp

memory/4344-24-0x000000007F120000-0x000000007F130000-memory.dmp

memory/4344-25-0x0000000007680000-0x00000000076B4000-memory.dmp

memory/4344-26-0x00000000702C0000-0x000000007030C000-memory.dmp

memory/4344-27-0x0000000070440000-0x0000000070797000-memory.dmp

memory/4344-36-0x00000000076C0000-0x00000000076DE000-memory.dmp

memory/4344-37-0x00000000076E0000-0x0000000007784000-memory.dmp

memory/4344-38-0x0000000004F90000-0x0000000004FA0000-memory.dmp

memory/4344-39-0x0000000007E40000-0x00000000084BA000-memory.dmp

memory/4344-40-0x0000000007800000-0x000000000781A000-memory.dmp

memory/4344-41-0x0000000007840000-0x000000000784A000-memory.dmp

memory/4344-42-0x0000000007950000-0x00000000079E6000-memory.dmp

memory/4344-43-0x0000000007860000-0x0000000007871000-memory.dmp

memory/4344-44-0x00000000078B0000-0x00000000078BE000-memory.dmp

memory/4344-45-0x00000000078C0000-0x00000000078D5000-memory.dmp

memory/4344-46-0x0000000007910000-0x000000000792A000-memory.dmp

memory/4344-47-0x0000000007930000-0x0000000007938000-memory.dmp

memory/4344-50-0x0000000074050000-0x0000000074801000-memory.dmp

memory/3928-51-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3928-54-0x0000000004130000-0x0000000004A1B000-memory.dmp

memory/3388-53-0x0000000003AD0000-0x0000000003ECF000-memory.dmp

memory/3388-55-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/2060-56-0x00000000740F0000-0x00000000748A1000-memory.dmp

memory/2060-57-0x00000000045E0000-0x00000000045F0000-memory.dmp

memory/2060-58-0x00000000045E0000-0x00000000045F0000-memory.dmp

memory/2060-59-0x00000000054D0000-0x0000000005827000-memory.dmp

memory/2060-68-0x0000000005A40000-0x0000000005A8C000-memory.dmp

memory/2060-70-0x00000000703D0000-0x000000007041C000-memory.dmp

memory/2060-69-0x000000007F860000-0x000000007F870000-memory.dmp

memory/2060-71-0x0000000070620000-0x0000000070977000-memory.dmp

memory/2060-80-0x0000000006BF0000-0x0000000006C94000-memory.dmp

memory/2060-81-0x00000000045E0000-0x00000000045F0000-memory.dmp

memory/2060-82-0x0000000006F40000-0x0000000006F51000-memory.dmp

memory/2060-83-0x0000000006F90000-0x0000000006FA5000-memory.dmp

memory/2060-86-0x00000000740F0000-0x00000000748A1000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/2116-88-0x00000000740F0000-0x00000000748A1000-memory.dmp

memory/2116-89-0x00000000048A0000-0x00000000048B0000-memory.dmp

memory/2116-90-0x00000000048A0000-0x00000000048B0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e45b3d361ff248033fc5221a208902fc
SHA1 ffe700a6a791ec54471b8c267863f6f0f526fa7f
SHA256 71f21674861c58b06a5d3939c22e54fc1f942f3aaa3939d97b6c13e8659f4a8a
SHA512 6b03235386edc7bc545b690cd25278f2ae2699d020d6cb31bd8fdb7db2c80bde3e5c08cec93db6d4539a511e117d4f8b765dfc891f0456edb573a203c9cff4cb

memory/2116-100-0x000000007F370000-0x000000007F380000-memory.dmp

memory/2116-101-0x00000000703D0000-0x000000007041C000-memory.dmp

memory/2116-102-0x0000000070620000-0x0000000070977000-memory.dmp

memory/3388-111-0x0000000003AD0000-0x0000000003ECF000-memory.dmp

memory/2116-113-0x00000000740F0000-0x00000000748A1000-memory.dmp

memory/3452-114-0x00000000740F0000-0x00000000748A1000-memory.dmp

memory/3452-115-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

memory/3452-116-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5dee71cef707ff34d89b6b3b5efddabf
SHA1 90ac6c53e4c9e4f0c6921afbd6342aa669d6a501
SHA256 9d5c6f3dcc017faeb146f1be372bd398c2c7cfb9e9012666960fbe8d8ba770fb
SHA512 ff0f22fa3b505967df11d8f55b9ef0ab26cc94b23672b4a4b0205118dae23bb63ccac2159892a63818db88ecf265bcb3284f222a194bc09ce8c6521635c59d04

memory/3452-126-0x00000000703D0000-0x000000007041C000-memory.dmp

memory/3452-127-0x0000000070620000-0x0000000070977000-memory.dmp

memory/3388-136-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3452-137-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

memory/3452-139-0x00000000740F0000-0x00000000748A1000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 c3ef1155fd5f029ec180444ad56ee9cd
SHA1 dd63227bd963fe3879048e3212ff7044d98f7ba4
SHA256 2b594acf3a66dda0d7c2004ab3e42c85129479f36bc1f9b498afe247c4cebfb8
SHA512 b5634ebd569d86e28ccb0c3d4d6aec2d230fb840de360deeac9bc083b9ec871750e125222b189f19c93135ea59aec0e0e375d19daa844ed1b1844b8ead9478f9

memory/3388-143-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 52331a8d45ee09a7fd1e36d957487e1c
SHA1 f6f6f84d4a0d351d6ab055b292d00f9649a2faa9
SHA256 61fc3866975cde0712a8e8339cd8a4a6622d9ba7f1643feea2bd8a5cc7c26c1d
SHA512 25b2b470c3be990ad5282cebc471befe995325b20e4bab2e6e1e96fd5809f2cadb6f352c91a6294d5a744db71090dfb1ab0d401b34ce27ebe6661291a0838d27

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6956c7281031e71e36772dda807d5280
SHA1 61bf1fe00a8c7ab0b738a556b8dab6d191c3f7bd
SHA256 e84e4a44f83f2102e65a76472decc310cdb16fe269927531c4c830cea4ae8090
SHA512 a054f9bc6dad91e9036e78742d64ddab0fb3bb4faa85b9c479950dd55c6f1c043f8056098e85a0f125d9b2a6b8240e23062706c8c0ed16b4189cba8f33c75a8f

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 13ae38d6f7b58a633062f3f72eb92609
SHA1 0dd9a7dbc82f941b837a8b67896b1648c8785bc6
SHA256 e3992ec492af88ef801c61c79c824645866ab3e4fc638db1886da4f444c253fe
SHA512 5af29979a5144b2641a7614952d45ef376165c2bb0a383ea844d0b112c817743e3d124655cfa193edc1824ead229ea8481cc1266d5ea27984a14a62c1daea222

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1788-245-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3112-253-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1788-254-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1788-255-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1216-256-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1788-257-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1216-259-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1788-260-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1788-262-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1788-264-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1788-265-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1788-267-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1788-270-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1788-272-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1788-274-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1788-275-0x0000000000400000-0x0000000001E06000-memory.dmp