Analysis
-
max time kernel
22s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2024, 21:23
Static task
static1
Behavioral task
behavioral1
Sample
15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe
Resource
win10v2004-20240412-en
General
-
Target
15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe
-
Size
4.2MB
-
MD5
c03d5b59011cda23e1ec9775a6c18ff3
-
SHA1
5aca29ecc8b7e6bbfee886d648b6e07d6bab6869
-
SHA256
15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98
-
SHA512
0439ecba33ccfb05ada25f37e43c8007e9887baf426b2389aa44a8330aaa2e696339d9fd0084f3f694c88dc7726ef1f2c872344309d604a876052e71c9c24d36
-
SSDEEP
98304:qB6TE4JDSTIitXqfSjBwF+v4rSSNjcdSqGUwT7RQU7Op:3TFmTI8qKjKFA4r+dAh7RQUM
Malware Config
Signatures
-
Glupteba payload 21 IoCs
resource yara_rule behavioral1/memory/2900-2-0x0000000003E20000-0x000000000470B000-memory.dmp family_glupteba behavioral1/memory/2900-3-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/2900-53-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/2900-56-0x0000000003E20000-0x000000000470B000-memory.dmp family_glupteba behavioral1/memory/1984-57-0x0000000003ED0000-0x00000000047BB000-memory.dmp family_glupteba behavioral1/memory/1984-58-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/1984-133-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/1984-190-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-258-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-268-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-270-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-273-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-276-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-281-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-283-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-286-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-288-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-291-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-294-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-299-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba behavioral1/memory/428-301-0x0000000000400000-0x0000000001DF9000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4080 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 428 csrss.exe -
resource yara_rule behavioral1/files/0x00080000000233f3-262.dat upx behavioral1/memory/2588-266-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3928-271-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3928-277-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe File created C:\Windows\rss\csrss.exe 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5056 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1160 schtasks.exe 4860 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 2844 powershell.exe 2844 powershell.exe 2900 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 2900 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 4088 powershell.exe 4088 powershell.exe 4088 powershell.exe 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 3724 powershell.exe 3724 powershell.exe 3724 powershell.exe 4860 powershell.exe 4860 powershell.exe 4860 powershell.exe 3292 powershell.exe 3292 powershell.exe 3292 powershell.exe 3220 powershell.exe 3220 powershell.exe 3220 powershell.exe 1612 powershell.exe 1612 powershell.exe 1612 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2844 powershell.exe Token: SeDebugPrivilege 2900 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Token: SeImpersonatePrivilege 2900 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe Token: SeDebugPrivilege 4088 powershell.exe Token: SeDebugPrivilege 3724 powershell.exe Token: SeDebugPrivilege 4860 powershell.exe Token: SeDebugPrivilege 3292 powershell.exe Token: SeDebugPrivilege 3220 powershell.exe Token: SeDebugPrivilege 1612 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2900 wrote to memory of 2844 2900 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 92 PID 2900 wrote to memory of 2844 2900 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 92 PID 2900 wrote to memory of 2844 2900 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 92 PID 1984 wrote to memory of 4088 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 98 PID 1984 wrote to memory of 4088 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 98 PID 1984 wrote to memory of 4088 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 98 PID 1984 wrote to memory of 4928 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 102 PID 1984 wrote to memory of 4928 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 102 PID 4928 wrote to memory of 4080 4928 cmd.exe 104 PID 4928 wrote to memory of 4080 4928 cmd.exe 104 PID 1984 wrote to memory of 3724 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 119 PID 1984 wrote to memory of 3724 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 119 PID 1984 wrote to memory of 3724 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 119 PID 1984 wrote to memory of 4860 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 108 PID 1984 wrote to memory of 4860 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 108 PID 1984 wrote to memory of 4860 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 108 PID 1984 wrote to memory of 428 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 111 PID 1984 wrote to memory of 428 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 111 PID 1984 wrote to memory of 428 1984 15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe 111 PID 428 wrote to memory of 3292 428 csrss.exe 112 PID 428 wrote to memory of 3292 428 csrss.exe 112 PID 428 wrote to memory of 3292 428 csrss.exe 112 PID 428 wrote to memory of 3220 428 csrss.exe 118 PID 428 wrote to memory of 3220 428 csrss.exe 118 PID 428 wrote to memory of 3220 428 csrss.exe 118 PID 428 wrote to memory of 1612 428 csrss.exe 121 PID 428 wrote to memory of 1612 428 csrss.exe 121 PID 428 wrote to memory of 1612 428 csrss.exe 121 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe"C:\Users\Admin\AppData\Local\Temp\15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe"C:\Users\Admin\AppData\Local\Temp\15bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4088
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4080
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3724
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1160
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:5092
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:3724
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:1616
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4860
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:2588
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:2312
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:5056
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:3928
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ed3d5be8d93dc3e76e2d07fb8ac198ab
SHA118055d0eba7e44cae4d812ab7c0057d47a577d17
SHA256202be0be0f7ef869df2b2c51fc97ba3fea391c5e21918e44b888c3aeaa08a941
SHA512343e481b6e379f1644c20cab67b0260643cc6ef07ed3ed3868a44744aacad8a8d1324c4bb7db8fa0bbfede1429b8257960fe7c9b407bff49a26ad27152bad984
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ce291e877d2d4101b563f37bc3e569c2
SHA19d6f1a5daf1c85a87dc3281b67114f93b85260c9
SHA2564a49eb870da8b88d3472cce9b43e88e60a5cdc339b52f910917ff1a8bf134d66
SHA5126c1eb85dc9bec94e7135685b08384877f88846c9739c498156327d8e4ace3aa66dda8b47d560a6edf5cb1af67b9bb5703cf6dbc2b8530f3d6cfd1c2e32f94c0d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD52d44ce39353a448414a8b1b5fd73fe70
SHA192e41bfd2713652c8413ef0ae36f7f3ca2b61984
SHA256fb9ae29321dfde7eda0b91af06416647f0ff948f4240152ae5d4be23a1a74ae5
SHA512cace1930a5ee7b6ef7cafc7647e2c525aaa5857b8da40fe6c4a4f3a67165cdd5312c808211e79029daa8b30a839720b1ea68e2feb55843bf6865f33f0635ea22
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD550c8e78272a2ed4c3291570c63daad23
SHA14ebc8cca255d5c27878c65af0cd3113e6f94aaf9
SHA256ba701a3cae8b3030262bd8d4d56e5332695c7ac95d9ca11105c90a44756e9c29
SHA5128f27911b6b9b0d4865608dd90b56c8534c97375362e7606364af589e60c54546707a436e669766ba9b169602f06b224375d236c6f8c1a5f8e08249790371357c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD586d696b27a4939fa84a79fa201908e34
SHA1a5c4390a36e3b32aec454e1290175e5f7136a639
SHA25643786cd09f21fdf0c91a77c2a7096faa91cc665466056177edc5eb2287c54a9d
SHA5121cb25d2e222e7d0a95f5130fd4ebe48c7410b1774f486650674b3608516d895e31049ba2ec59f15a8766f9f12da243105d5e04488b140bdfce2dce943be05eaf
-
Filesize
4.2MB
MD5c03d5b59011cda23e1ec9775a6c18ff3
SHA15aca29ecc8b7e6bbfee886d648b6e07d6bab6869
SHA25615bbf04148565d2dbf7bb81a902101399ac1f20edda7ae77213a8b97f5615b98
SHA5120439ecba33ccfb05ada25f37e43c8007e9887baf426b2389aa44a8330aaa2e696339d9fd0084f3f694c88dc7726ef1f2c872344309d604a876052e71c9c24d36
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec