Malware Analysis Report

2025-08-05 12:17

Sample ID 240419-yvxs3seh9v
Target b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d
SHA256 b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d
Tags
glupteba discovery dropper evasion loader persistence upx rootkit
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d

Threat Level: Known bad

The file b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion loader persistence upx rootkit

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Manipulates WinMonFS driver.

Checks installed software on the system

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Program crash

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-19 20:07

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-19 20:06

Reported

2024-04-19 20:10

Platform

win10v2004-20240226-en

Max time kernel

128s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3080 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3080 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3080 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\system32\cmd.exe
PID 3060 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\system32\cmd.exe
PID 4784 wrote to memory of 3336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4784 wrote to memory of 3336 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3060 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3060 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\rss\csrss.exe
PID 3060 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\rss\csrss.exe
PID 3060 wrote to memory of 3968 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\rss\csrss.exe
PID 3968 wrote to memory of 2320 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3968 wrote to memory of 2320 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3968 wrote to memory of 2320 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3968 wrote to memory of 2960 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3968 wrote to memory of 2960 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3968 wrote to memory of 2960 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe

"C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:8

C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe

"C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3080 -ip 3080

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 868

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3060 -ip 3060

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 780

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 25.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.74:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 74.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 478ec2bb-fc63-4bb9-ab73-fe2213f553ce.uuid.myfastupdate.org udp
US 8.8.8.8:53 12.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server16.myfastupdate.org udp
US 3.33.249.248:3478 stun.sipgate.net udp
US 8.8.8.8:53 248.249.33.3.in-addr.arpa udp
US 162.159.134.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server16.myfastupdate.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp

Files

memory/3080-1-0x0000000003D60000-0x0000000004161000-memory.dmp

memory/3080-2-0x0000000004170000-0x0000000004A5B000-memory.dmp

memory/3080-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/3080-4-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4548-5-0x00000000745A0000-0x0000000074D50000-memory.dmp

memory/3080-6-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4548-7-0x00000000052A0000-0x00000000052B0000-memory.dmp

memory/4548-8-0x0000000002FA0000-0x0000000002FD6000-memory.dmp

memory/3080-9-0x0000000003D60000-0x0000000004161000-memory.dmp

memory/3080-10-0x0000000004170000-0x0000000004A5B000-memory.dmp

memory/4548-11-0x00000000052A0000-0x00000000052B0000-memory.dmp

memory/4548-12-0x00000000058E0000-0x0000000005F08000-memory.dmp

memory/4548-14-0x0000000005340000-0x0000000005362000-memory.dmp

memory/4548-15-0x0000000005660000-0x00000000056C6000-memory.dmp

memory/4548-16-0x0000000005740000-0x00000000057A6000-memory.dmp

memory/4548-17-0x00000000745A0000-0x0000000074D50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uq4drtkw.2dc.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4548-24-0x0000000005FD0000-0x0000000006324000-memory.dmp

memory/4548-29-0x00000000052A0000-0x00000000052B0000-memory.dmp

memory/4548-31-0x00000000052A0000-0x00000000052B0000-memory.dmp

memory/4548-32-0x00000000065B0000-0x00000000065CE000-memory.dmp

memory/4548-33-0x0000000006680000-0x00000000066CC000-memory.dmp

memory/4548-35-0x0000000006BC0000-0x0000000006C04000-memory.dmp

memory/4548-36-0x00000000052A0000-0x00000000052B0000-memory.dmp

memory/4548-37-0x0000000007930000-0x00000000079A6000-memory.dmp

memory/4548-39-0x0000000008040000-0x00000000086BA000-memory.dmp

memory/4548-40-0x0000000007A00000-0x0000000007A1A000-memory.dmp

memory/3080-38-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4548-41-0x000000007F360000-0x000000007F370000-memory.dmp

memory/4548-42-0x0000000007AB0000-0x0000000007AE2000-memory.dmp

memory/4548-43-0x0000000070440000-0x000000007048C000-memory.dmp

memory/4548-44-0x00000000705E0000-0x0000000070934000-memory.dmp

memory/4548-54-0x0000000007A90000-0x0000000007AAE000-memory.dmp

memory/4548-55-0x0000000007B90000-0x0000000007C33000-memory.dmp

memory/4548-56-0x0000000007C70000-0x0000000007C7A000-memory.dmp

memory/4548-57-0x0000000007D30000-0x0000000007DC6000-memory.dmp

memory/4548-58-0x0000000007C90000-0x0000000007CA1000-memory.dmp

memory/4548-59-0x0000000007CD0000-0x0000000007CDE000-memory.dmp

memory/4548-60-0x0000000007CE0000-0x0000000007CF4000-memory.dmp

memory/4548-61-0x0000000007DD0000-0x0000000007DEA000-memory.dmp

memory/4548-62-0x0000000007D10000-0x0000000007D18000-memory.dmp

memory/3080-63-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4548-66-0x00000000745A0000-0x0000000074D50000-memory.dmp

memory/3060-68-0x0000000003C40000-0x000000000403F000-memory.dmp

memory/3060-69-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4672-70-0x00000000742C0000-0x0000000074A70000-memory.dmp

memory/4672-71-0x0000000005140000-0x0000000005150000-memory.dmp

memory/4672-72-0x0000000005140000-0x0000000005150000-memory.dmp

memory/4672-73-0x0000000006000000-0x0000000006354000-memory.dmp

memory/4672-83-0x00000000067A0000-0x00000000067EC000-memory.dmp

memory/3080-84-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4672-85-0x0000000005140000-0x0000000005150000-memory.dmp

memory/4672-86-0x000000006FE80000-0x000000006FECC000-memory.dmp

memory/4672-87-0x00000000708D0000-0x0000000070C24000-memory.dmp

memory/4672-97-0x0000000007860000-0x0000000007903000-memory.dmp

memory/4672-98-0x0000000007B50000-0x0000000007B61000-memory.dmp

memory/4672-99-0x0000000007BC0000-0x0000000007BD4000-memory.dmp

memory/4672-102-0x00000000742C0000-0x0000000074A70000-memory.dmp

memory/3060-103-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/5100-105-0x00000000745A0000-0x0000000074D50000-memory.dmp

memory/3060-106-0x0000000003C40000-0x000000000403F000-memory.dmp

memory/5100-108-0x0000000002700000-0x0000000002710000-memory.dmp

memory/5100-107-0x0000000002700000-0x0000000002710000-memory.dmp

memory/5100-114-0x0000000005610000-0x0000000005964000-memory.dmp

memory/3060-119-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 95bcd8b2eed118d5665ca422932d6970
SHA1 96fd70fc4c523d7cc3ae50562ae73fdc61e79b47
SHA256 f714b83f1253ad98448158324dcf6d31e1702b69d33c40c999b18274f5284906
SHA512 fda1d3c4abebf677fe448d0b1e9f61c4a0b79dd3df7508ea76b83284ab0e8dcd8155d063d5b024b629dfc1cf82abcc1e4404d466e26f1175a43d35be31a3fbb7

memory/5100-121-0x0000000005D40000-0x0000000005D8C000-memory.dmp

memory/5100-122-0x0000000002700000-0x0000000002710000-memory.dmp

memory/5100-124-0x0000000070540000-0x000000007058C000-memory.dmp

memory/5100-123-0x000000007F660000-0x000000007F670000-memory.dmp

memory/5100-125-0x0000000070CE0000-0x0000000071034000-memory.dmp

memory/5100-135-0x0000000006F30000-0x0000000006FD3000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 21eb6cefc3e5c1138ae2406f893273b8
SHA1 cb1107707886d71f2fa0c49096255a11046a4c64
SHA256 655542fecb3c757249449689060ce766355852eb223bb9aeda2007271c9d0687
SHA512 5d88af5d7100542dc0c4601da64e6dffc76baecaa758578de4b716641c91da14e32ad29e063a829a99e260361c11456b18decd0deadad6fdb2adb916e9c4df52

memory/3060-152-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 7811f765982ff3ca394c88179e364f11
SHA1 25b4250522b4e48cc6c3c8cfd48242e7441f4bf4
SHA256 b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d
SHA512 02c7109a9ec34435feab5108687b01dedb8b14de492e8a3fa47dda55a4d0b9dff982932e16642c96696d30a82a89376bed0951f6a61dcbc4c3a9fe4d1aeae7cd

memory/3060-172-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a080cf66771118656e44c63e1ce49e16
SHA1 7e71f8c9ed8b9e3bd74863d7fdbe3f344e9160fd
SHA256 691042dfa9bdd902b6a97be4e6d2a9e23223c22797070d4ad3832089450fd2ac
SHA512 8281954b8e19a0cd40b8b1b14d067614432f583bc756f6d899b7bb8d02191321a9a7b87bb0cda8c5c1db01a003fb3166acbdcd1980fb9480bd163d87f8e7c592

memory/3968-207-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0475c4bf8a38bcf471bdb260976498d0
SHA1 a70191365f3677259269429b9e39494ad6f30428
SHA256 30c458ea9d3928065b5bbd6bf7e1a144191c63446bf5f50d98590994b9422698
SHA512 4aea4f816b44ba86cabbf6121c27ba10e8a569ca0cfaa0720d44fe08aaa175b17333b0dae91e8a85c38e56bdd13d052af34f95af88dcd0396d3ce0c33a1f6657

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2b0f0928e921fcfa51626f3169f11af9
SHA1 bdae5ad50bb4175e1bde35089f2ce5f9f52e3b2e
SHA256 61e6830e80dbfa54c4d49568d2ae3c2e4de986cd1a6ce89a58e460009ce22dc7
SHA512 e890543d8871b21fb788a44f6cc2d8b01534e4641376f8d6c71ac071def086d5fdf1d001eae14064071195154935ce9f556d6e243fe95bd85c0080509af2ce5e

memory/3968-267-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3968-275-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3836-282-0x0000000000400000-0x00000000008DF000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-19 20:06

Reported

2024-04-19 20:09

Platform

win11-20240412-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3263309122-2820180308-3568046652-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-572 = "China Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1661 = "Bahia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4832 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4832 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 4596 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\system32\cmd.exe
PID 1960 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\system32\cmd.exe
PID 2864 wrote to memory of 2092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2864 wrote to memory of 2092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1960 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 3836 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 1248 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1960 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\rss\csrss.exe
PID 1960 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\rss\csrss.exe
PID 1960 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe C:\Windows\rss\csrss.exe
PID 984 wrote to memory of 1972 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 984 wrote to memory of 1972 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 984 wrote to memory of 1972 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 984 wrote to memory of 3268 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 984 wrote to memory of 3268 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 984 wrote to memory of 3268 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 984 wrote to memory of 244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 984 wrote to memory of 244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 984 wrote to memory of 244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 984 wrote to memory of 4588 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 984 wrote to memory of 4588 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1740 wrote to memory of 5052 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 5052 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1740 wrote to memory of 5052 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5052 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5052 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5052 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe

"C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4056 -ip 4056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4056 -s 2544

C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe

"C:\Users\Admin\AppData\Local\Temp\b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4832 -ip 4832

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 96435362-6602-41e4-8172-6a3d38eb6a1e.uuid.myfastupdate.org udp
US 8.8.8.8:53 server1.myfastupdate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server1.myfastupdate.org tcp
BE 172.253.120.127:19302 stun1.l.google.com udp
US 172.67.221.71:443 carsalessystem.com tcp
BG 185.82.216.111:443 server1.myfastupdate.org tcp
BG 185.82.216.111:443 server1.myfastupdate.org tcp

Files

memory/4832-1-0x0000000003E10000-0x0000000004218000-memory.dmp

memory/4832-2-0x0000000004220000-0x0000000004B0B000-memory.dmp

memory/4832-3-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4056-4-0x0000000002E20000-0x0000000002E56000-memory.dmp

memory/4056-5-0x0000000074670000-0x0000000074E21000-memory.dmp

memory/4056-7-0x0000000005630000-0x0000000005C5A000-memory.dmp

memory/4056-6-0x0000000002EC0000-0x0000000002ED0000-memory.dmp

memory/4056-8-0x0000000005590000-0x00000000055B2000-memory.dmp

memory/4056-12-0x0000000005D80000-0x0000000005DE6000-memory.dmp

memory/4056-9-0x0000000005D10000-0x0000000005D76000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sywrxq2s.fdp.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4056-19-0x0000000005DF0000-0x0000000006147000-memory.dmp

memory/4056-20-0x00000000062B0000-0x00000000062CE000-memory.dmp

memory/4056-21-0x0000000006300000-0x000000000634C000-memory.dmp

memory/4056-22-0x0000000006870000-0x00000000068B6000-memory.dmp

memory/4056-23-0x000000007EFB0000-0x000000007EFC0000-memory.dmp

memory/4056-24-0x00000000076D0000-0x0000000007704000-memory.dmp

memory/4056-25-0x00000000708E0000-0x000000007092C000-memory.dmp

memory/4056-26-0x0000000070A60000-0x0000000070DB7000-memory.dmp

memory/4056-35-0x0000000007730000-0x000000000774E000-memory.dmp

memory/4056-36-0x0000000007750000-0x00000000077F4000-memory.dmp

memory/4056-37-0x0000000007EB0000-0x000000000852A000-memory.dmp

memory/4056-38-0x0000000007870000-0x000000000788A000-memory.dmp

memory/4056-39-0x00000000078B0000-0x00000000078BA000-memory.dmp

memory/4056-40-0x0000000074670000-0x0000000074E21000-memory.dmp

memory/4832-42-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1960-43-0x0000000003BC0000-0x0000000003FC6000-memory.dmp

memory/1960-44-0x0000000003FD0000-0x00000000048BB000-memory.dmp

memory/4832-45-0x0000000004220000-0x0000000004B0B000-memory.dmp

memory/1960-46-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4596-47-0x0000000074710000-0x0000000074EC1000-memory.dmp

memory/4596-48-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

memory/4596-49-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

memory/4596-58-0x0000000005E60000-0x00000000061B7000-memory.dmp

memory/4596-59-0x00000000067E0000-0x000000000682C000-memory.dmp

memory/4596-62-0x0000000070B70000-0x0000000070EC7000-memory.dmp

memory/4596-61-0x00000000709F0000-0x0000000070A3C000-memory.dmp

memory/4596-60-0x000000007F1C0000-0x000000007F1D0000-memory.dmp

memory/4596-72-0x0000000007490000-0x0000000007534000-memory.dmp

memory/4596-71-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

memory/4596-73-0x0000000007890000-0x0000000007926000-memory.dmp

memory/4596-74-0x00000000077C0000-0x00000000077D1000-memory.dmp

memory/4596-75-0x0000000007800000-0x000000000780E000-memory.dmp

memory/4596-76-0x0000000007810000-0x0000000007825000-memory.dmp

memory/4596-77-0x0000000007850000-0x000000000786A000-memory.dmp

memory/4596-78-0x0000000007870000-0x0000000007878000-memory.dmp

memory/4596-81-0x0000000074710000-0x0000000074EC1000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/3836-83-0x0000000074710000-0x0000000074EC1000-memory.dmp

memory/3836-84-0x00000000024F0000-0x0000000002500000-memory.dmp

memory/3836-85-0x00000000024F0000-0x0000000002500000-memory.dmp

memory/3836-94-0x0000000005780000-0x0000000005AD7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6778c8a24e6ba484ba427ea047dd2e5f
SHA1 ada9bcb605aa1e25cd566453dd4b52dbf817c60f
SHA256 e380e4cf4c5bfc43239cf158b6e28844579a70c96f5e22699114174237b3efc9
SHA512 8dbfaf4fd501104631d7955b3e6da56050ad844f064fe52bab1ed3f5554592b8f3f3ad1a52ebe24916fe906086d909c4a4ceab927de4010f0c1bbe3a21408ead

memory/3836-97-0x00000000709F0000-0x0000000070A3C000-memory.dmp

memory/3836-99-0x0000000070C40000-0x0000000070F97000-memory.dmp

memory/3836-98-0x000000007F970000-0x000000007F980000-memory.dmp

memory/1960-96-0x0000000003BC0000-0x0000000003FC6000-memory.dmp

memory/3836-109-0x00000000024F0000-0x0000000002500000-memory.dmp

memory/3836-108-0x00000000024F0000-0x0000000002500000-memory.dmp

memory/3836-111-0x0000000074710000-0x0000000074EC1000-memory.dmp

memory/1248-113-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

memory/1248-112-0x0000000074710000-0x0000000074EC1000-memory.dmp

memory/1248-114-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f8df9cc9dc86322b8ad88c84208c05be
SHA1 fce81432679016ef9e01c5f4093d584075b34e4d
SHA256 a2597c09a477c1d9073295d64f684faca626039fc2be02ee24bb5f9f32f82284
SHA512 b22d6985ba177dd4d23fd7ed6ff7ced1446939093744dbbebc436cbfbd73cb46a872eefc59af9b61688da129bf52dd81f02fb9d238990c68f1c37f3a0dd02256

memory/1248-124-0x00000000709F0000-0x0000000070A3C000-memory.dmp

memory/1248-125-0x0000000070C40000-0x0000000070F97000-memory.dmp

memory/1960-134-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/1248-136-0x0000000074710000-0x0000000074EC1000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 7811f765982ff3ca394c88179e364f11
SHA1 25b4250522b4e48cc6c3c8cfd48242e7441f4bf4
SHA256 b7cee9edcee16f74545953fc104e2d3841852fc000fac7acf439f2fdc224d70d
SHA512 02c7109a9ec34435feab5108687b01dedb8b14de492e8a3fa47dda55a4d0b9dff982932e16642c96696d30a82a89376bed0951f6a61dcbc4c3a9fe4d1aeae7cd

memory/1960-140-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/984-144-0x0000000004000000-0x0000000004400000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 10d3374ae20ff5f5b05f6e8a57f4e5d3
SHA1 5a5cd13b7c916effb497989afe291e99b7d51d22
SHA256 57ebf87ace52816b14afddf3bee64e09037448a790b673ede64c916b623e41d0
SHA512 aa37c5a4f7ebc797a9a99b93791662f5b02bad25b5f254917bcb7db93476079b1ef60f5960ad2a9d5e3cd472e149057c4b1d0ffd714f33190fb4e56e1f5fdede

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 616d73cb5753e0f8835d5e716731a50c
SHA1 f48c139bb7bd1123cc72e8db2be1f3b115046e7a
SHA256 09f52591a3f36b739b11e327716becf13f32bc022c044ba3083c6291afcaf320
SHA512 660f9d3cda17e06b60447da5603550a246cfe0d75fbd4fff3e4805842cad69aa2ac78971f98cef80cd33c61cb7b9ae06dfae59676dbf070bde9b91b7f91af8f9

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 79be8c4cef9b912dd443ecf3519fc755
SHA1 3b1c39bba76d8a4ad13bb1cefd415c3426375c80
SHA256 32173fe770d2a2f5abd43ee871bb1a4ba7dd1475aff7e30ac7ded7d4fe9cbca1
SHA512 38385175ebda1643544e0f10bddf2741ba678a68c85286a84567a1faacdfa84b107d838e9f4135b1d812b5b6e996c9be7b37b688345163c5242bda4e95899953

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/984-237-0x0000000000400000-0x0000000001E06000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1740-245-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/984-246-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/984-247-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4668-248-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/984-249-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/984-251-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/4668-252-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/984-253-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/984-255-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/984-257-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/984-259-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/984-261-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/984-263-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/984-265-0x0000000000400000-0x0000000001E06000-memory.dmp

memory/984-267-0x0000000000400000-0x0000000001E06000-memory.dmp