glupteba | e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e

Analysis

max time kernel
150s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
21-04-2024 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Size

4.1MB
MD5

93b5dda99b61d9580afcd0639eed7c68
SHA1

7030f7f61b35c7a08b7b5d183797b1d603cad6b9
SHA256

e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e
SHA512

ba38e94064cf6fb74a45d30bc0e65d94a39a994735d02e94090b60d48d304388eec89d9aab0c70dbc973437e4ba22709b619d49d9569d5f1ec1605da319d808c
SSDEEP

98304:4upp3WUkLaIVxVQ5Lfi8+DAGSBgUwbhlmIRT0sLJ5s:V24wrgi8oddlbe

Score

10^/10

glupteba discovery dropper evasion loader persistence rootkit upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 35 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2724-3-0x0000000004190000-0x0000000004A7C000-memory.dmp	family_glupteba
behavioral2/memory/2632-2-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2632-5-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2632-7-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2632-9-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2632-8-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2632-10-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2632-57-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1008-68-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1008-69-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1008-70-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1008-71-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1008-130-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1008-155-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1008-161-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-177-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-179-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-180-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-181-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-208-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-209-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-267-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-273-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-274-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-278-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-284-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-286-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-288-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-290-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-292-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-294-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-296-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-298-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-300-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2092-302-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

1696 netsh.exe
Executes dropped EXE 5 IoCs

Processes:

csrss.execsrss.exeinjector.exewindefender.exewindefender.exe

pid process

2812 csrss.exe
2092 csrss.exe
1172 injector.exe
3852 windefender.exe
3980 windefender.exe

pid	process
1696	netsh.exe

pid	process
2812	csrss.exe
2092	csrss.exe
1172	injector.exe
3852	windefender.exe
3980	windefender.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\windefender.exe	upx
behavioral2/memory/3852-283-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3980-285-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/3980-289-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3777591257-2471171023-3629228286-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exee19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.execsrss.exe

description	pid	process	target process
PID 2724 set thread context of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 set thread context of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2812 set thread context of 2092	2812	csrss.exe	csrss.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe

Drops file in Windows directory 4 IoCs

Processes:

csrss.exee19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe

description	ioc	process
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\rss	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
File created	C:\Windows\rss\csrss.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

2736 sc.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2136 schtasks.exe
3112 schtasks.exe

pid	process
2736	sc.exe

pid	process
2136	schtasks.exe
3112	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-161 = "Central Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2432 = "Cuba Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	windefender.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exee19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exepowershell.exee19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exe

pid	process
2020	powershell.exe
2020	powershell.exe
2632	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
2632	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
4012	powershell.exe
4012	powershell.exe
1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
704	powershell.exe
704	powershell.exe
3172	powershell.exe
3172	powershell.exe
2880	powershell.exe
2880	powershell.exe
4564	powershell.exe
4564	powershell.exe
1384	powershell.exe
1384	powershell.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
2092	csrss.exe
2092	csrss.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
2092	csrss.exe
2092	csrss.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
2092	csrss.exe
2092	csrss.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe
1172	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exee19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exe

description	pid	process
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	2632	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Token: SeImpersonatePrivilege	2632	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
Token: SeDebugPrivilege	4012	powershell.exe
Token: SeDebugPrivilege	704	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	4564	powershell.exe
Token: SeDebugPrivilege	1384	powershell.exe
Token: SeSystemEnvironmentPrivilege	2092	csrss.exe
Token: SeSecurityPrivilege	2736	sc.exe
Token: SeSecurityPrivilege	2736	sc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exee19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exee19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exee19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.execmd.execsrss.execsrss.exewindefender.exe

description	pid	process	target process
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2724 wrote to memory of 2632	2724	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 2632 wrote to memory of 2020	2632	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 2632 wrote to memory of 2020	2632	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 2632 wrote to memory of 2020	2632	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 3108 wrote to memory of 1008	3108	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
PID 1008 wrote to memory of 4012	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 1008 wrote to memory of 4012	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 1008 wrote to memory of 4012	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 1008 wrote to memory of 3348	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	cmd.exe
PID 1008 wrote to memory of 3348	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	cmd.exe
PID 3348 wrote to memory of 1696	3348	cmd.exe	netsh.exe
PID 3348 wrote to memory of 1696	3348	cmd.exe	netsh.exe
PID 1008 wrote to memory of 704	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 1008 wrote to memory of 704	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 1008 wrote to memory of 704	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 1008 wrote to memory of 3172	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 1008 wrote to memory of 3172	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 1008 wrote to memory of 3172	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	powershell.exe
PID 1008 wrote to memory of 2812	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	csrss.exe
PID 1008 wrote to memory of 2812	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	csrss.exe
PID 1008 wrote to memory of 2812	1008	e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2812 wrote to memory of 2092	2812	csrss.exe	csrss.exe
PID 2092 wrote to memory of 2880	2092	csrss.exe	powershell.exe
PID 2092 wrote to memory of 2880	2092	csrss.exe	powershell.exe
PID 2092 wrote to memory of 2880	2092	csrss.exe	powershell.exe
PID 2092 wrote to memory of 4564	2092	csrss.exe	powershell.exe
PID 2092 wrote to memory of 4564	2092	csrss.exe	powershell.exe
PID 2092 wrote to memory of 4564	2092	csrss.exe	powershell.exe
PID 2092 wrote to memory of 1384	2092	csrss.exe	powershell.exe
PID 2092 wrote to memory of 1384	2092	csrss.exe	powershell.exe
PID 2092 wrote to memory of 1384	2092	csrss.exe	powershell.exe
PID 2092 wrote to memory of 1172	2092	csrss.exe	injector.exe
PID 2092 wrote to memory of 1172	2092	csrss.exe	injector.exe
PID 3852 wrote to memory of 1292	3852	windefender.exe	cmd.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
"C:\Users\Admin\AppData\Local\Temp\e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2724

C:\Users\Admin\AppData\Local\Temp\e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
"C:\Users\Admin\AppData\Local\Temp\e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2020

C:\Users\Admin\AppData\Local\Temp\e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
"C:\Users\Admin\AppData\Local\Temp\e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3108

C:\Users\Admin\AppData\Local\Temp\e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe
"C:\Users\Admin\AppData\Local\Temp\e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e.exe"
4⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1008

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
5⤵
- Suspicious use of WriteProcessMemory
PID:3348

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
6⤵
- Modifies Windows Firewall
PID:1696

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
7⤵
- Creates scheduled task(s)
PID:2136

C:\Windows\SYSTEM32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
7⤵
PID:2848

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noprofile
7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1172

C:\Windows\SYSTEM32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
7⤵
- Creates scheduled task(s)
PID:3112

C:\Windows\windefender.exe
"C:\Windows\windefender.exe"
7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
8⤵
PID:1292

C:\Windows\SysWOW64\sc.exe
sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
9⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m0skidpc.tqm.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
5844334bb886eb48095628d40b1b464b

SHA1
c1fb97088c49f4b41588bf769217ef54a8463c90

SHA256
70820197ea1a243d2d60ed3ce3c0c293046cbf6cf1e111e9421a1ee147164df6

SHA512
9e7287bb31119079d200fc35a78c01443b46bd5bbfdebd6fde6d998b0f56497c2c73de1829fe47519be60e1647272f246d8bd190a14789a47eaf2b049e7672ab

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
87294a91c5113cfc67174375d56bded1

SHA1
8560f280842e94980ed8166fad0d5c8640872025

SHA256
dc3858640047d338e64a38a0d025cade3cf4eda26aead079bf3e139eb2aa4d23

SHA512
4ec0eda41a67474eb44f851725fdff875f4012e811e0f73977a35b432feeaf9b6c022d80a4cbf1428a6ab58ed762bc07cee0ed623628123a3a5272a4c82a9e43

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
416ac23e00445fac03891fa288b0c8cc

SHA1
029da338dd56128add375bdaaeef6f1abdeb05bd

SHA256
d3a2007887745c26dd92d9115d2768d450295e5c71ac4cc06e9942908c31c5cd

SHA512
4a91cac665b9a706d650bbca1b7077855a876fced8114e70cfb510de6392f318245cae294d21ca65b86b4a4a518e18cf6aea8073ec36d8c75eb0517468844a87

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
1c47b36c935ddd3aa39c495c2f71f922

SHA1
8ce9cc9a3e6c3cf6cb58ba9db0e565c57b26bf93

SHA256
79ad47e5a4ae8ad79265a2e1a41823e646ca7068f3461b45f8ab1b9e1581a35a

SHA512
a18f7f7acb2985395800ed24d596abe876fd94508e5f5ee4f3e3e654af38e71bef04b1223afe3728e2b124332dd261d75a7a16823e4f969cf52166e0179e650d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize
19KB

MD5
ec3127a4820a4b01fce73fe2034c473a

SHA1
1819d4dd1328f7add9fcd3710e5ce342bd0c2796

SHA256
b80a2f9fb424af5654afbfef6c08ee2370c3bdb193ac94a6bca939629c723fb2

SHA512
170aa686a644bf23336930c1bc55c70b7eb45d2ccb61ab6a16ce2e540c498c8d746d92f9464cb6100fd92c31b01f661a7d1b496f29082f616b9d8ef0cbb42578

Download Submit
C:\Windows\rss\csrss.exe
Filesize
4.1MB

MD5
93b5dda99b61d9580afcd0639eed7c68

SHA1
7030f7f61b35c7a08b7b5d183797b1d603cad6b9

SHA256
e19208f37c7d50fdb9b827f83743046d596729a455aa89aa7fdba905bfb3da6e

SHA512
ba38e94064cf6fb74a45d30bc0e65d94a39a994735d02e94090b60d48d304388eec89d9aab0c70dbc973437e4ba22709b619d49d9569d5f1ec1605da319d808c

Download Submit
C:\Windows\windefender.exe
Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/704-116-0x0000000070AF0000-0x0000000070B3C000-memory.dmp

Filesize
304KB

Download
memory/704-127-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/704-129-0x0000000074810000-0x0000000074FC1000-memory.dmp

Filesize
7.7MB

Download
memory/704-105-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/704-117-0x0000000070D40000-0x0000000071097000-memory.dmp

Filesize
3.3MB

Download
memory/704-104-0x0000000074810000-0x0000000074FC1000-memory.dmp

Filesize
7.7MB

Download
memory/704-126-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/704-106-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/1008-155-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1008-130-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1008-71-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1008-70-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1008-69-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1008-68-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1008-161-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2020-16-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/2020-34-0x0000000070AF0000-0x0000000070E47000-memory.dmp

Filesize
3.3MB

Download
memory/2020-45-0x0000000007E90000-0x000000000850A000-memory.dmp

Filesize
6.5MB

Download
memory/2020-46-0x0000000007850000-0x000000000786A000-memory.dmp

Filesize
104KB

Download
memory/2020-47-0x0000000007890000-0x000000000789A000-memory.dmp

Filesize
40KB

Download
memory/2020-48-0x00000000079A0000-0x0000000007A36000-memory.dmp

Filesize
600KB

Download
memory/2020-49-0x00000000078B0000-0x00000000078C1000-memory.dmp

Filesize
68KB

Download
memory/2020-50-0x0000000007900000-0x000000000790E000-memory.dmp

Filesize
56KB

Download
memory/2020-51-0x0000000007910000-0x0000000007925000-memory.dmp

Filesize
84KB

Download
memory/2020-52-0x0000000007960000-0x000000000797A000-memory.dmp

Filesize
104KB

Download
memory/2020-53-0x0000000007980000-0x0000000007988000-memory.dmp

Filesize
32KB

Download
memory/2020-56-0x0000000074810000-0x0000000074FC1000-memory.dmp

Filesize
7.7MB

Download
memory/2020-43-0x0000000007710000-0x000000000772E000-memory.dmp

Filesize
120KB

Download
memory/2020-44-0x0000000007730000-0x00000000077D4000-memory.dmp

Filesize
656KB

Download
memory/2020-33-0x0000000070A80000-0x0000000070ACC000-memory.dmp

Filesize
304KB

Download
memory/2020-32-0x00000000076D0000-0x0000000007704000-memory.dmp

Filesize
208KB

Download
memory/2020-31-0x000000007F740000-0x000000007F750000-memory.dmp

Filesize
64KB

Download
memory/2020-30-0x0000000007480000-0x00000000074C6000-memory.dmp

Filesize
280KB

Download
memory/2020-29-0x00000000066B0000-0x00000000066FC000-memory.dmp

Filesize
304KB

Download
memory/2020-28-0x00000000062A0000-0x00000000062BE000-memory.dmp

Filesize
120KB

Download
memory/2020-27-0x0000000005E50000-0x00000000061A7000-memory.dmp

Filesize
3.3MB

Download
memory/2020-26-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Filesize
408KB

Download
memory/2020-17-0x0000000005460000-0x00000000054C6000-memory.dmp

Filesize
408KB

Download
memory/2020-15-0x00000000053C0000-0x00000000053E2000-memory.dmp

Filesize
136KB

Download
memory/2020-14-0x0000000004F00000-0x0000000004F10000-memory.dmp

Filesize
64KB

Download
memory/2020-13-0x0000000005540000-0x0000000005B6A000-memory.dmp

Filesize
6.2MB

Download
memory/2020-12-0x0000000074810000-0x0000000074FC1000-memory.dmp

Filesize
7.7MB

Download
memory/2020-11-0x0000000002DC0000-0x0000000002DF6000-memory.dmp

Filesize
216KB

Download
memory/2092-179-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-177-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-302-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-300-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-298-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-296-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-294-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-292-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-290-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-288-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-286-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-284-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-278-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-274-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-273-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-267-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-209-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-208-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-181-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2092-180-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2632-8-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2632-57-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2632-2-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2632-10-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2632-5-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2632-7-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2632-9-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2724-3-0x0000000004190000-0x0000000004A7C000-memory.dmp

Filesize
8.9MB

Download
memory/2724-1-0x0000000003D80000-0x0000000004181000-memory.dmp

Filesize
4.0MB

Download
memory/2812-172-0x0000000004000000-0x0000000004400000-memory.dmp

Filesize
4.0MB

Download
memory/3108-64-0x0000000003BA0000-0x0000000003FA1000-memory.dmp

Filesize
4.0MB

Download
memory/3172-131-0x0000000074810000-0x0000000074FC1000-memory.dmp

Filesize
7.7MB

Download
memory/3172-143-0x00000000059F0000-0x0000000005D47000-memory.dmp

Filesize
3.3MB

Download
memory/3172-133-0x0000000004950000-0x0000000004960000-memory.dmp

Filesize
64KB

Download
memory/3172-145-0x0000000070AF0000-0x0000000070B3C000-memory.dmp

Filesize
304KB

Download
memory/3172-146-0x0000000070C70000-0x0000000070FC7000-memory.dmp

Filesize
3.3MB

Download
memory/3172-158-0x0000000074810000-0x0000000074FC1000-memory.dmp

Filesize
7.7MB

Download
memory/3172-132-0x0000000004950000-0x0000000004960000-memory.dmp

Filesize
64KB

Download
memory/3172-156-0x0000000004950000-0x0000000004960000-memory.dmp

Filesize
64KB

Download
memory/3172-144-0x000000007FBA0000-0x000000007FBB0000-memory.dmp

Filesize
64KB

Download
memory/3852-283-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3980-289-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3980-285-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4012-75-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/4012-73-0x0000000074810000-0x0000000074FC1000-memory.dmp

Filesize
7.7MB

Download
memory/4012-72-0x0000000006330000-0x0000000006687000-memory.dmp

Filesize
3.3MB

Download
memory/4012-74-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/4012-84-0x0000000006D70000-0x0000000006DBC000-memory.dmp

Filesize
304KB

Download
memory/4012-99-0x0000000007DF0000-0x0000000007E05000-memory.dmp

Filesize
84KB

Download
memory/4012-85-0x000000007FB10000-0x000000007FB20000-memory.dmp

Filesize
64KB

Download
memory/4012-86-0x0000000070AF0000-0x0000000070B3C000-memory.dmp

Filesize
304KB

Download
memory/4012-87-0x0000000070D40000-0x0000000071097000-memory.dmp

Filesize
3.3MB

Download
memory/4012-96-0x0000000007850000-0x00000000078F4000-memory.dmp

Filesize
656KB

Download
memory/4012-97-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/4012-98-0x0000000007DC0000-0x0000000007DD1000-memory.dmp

Filesize
68KB

Download
memory/4012-102-0x0000000074810000-0x0000000074FC1000-memory.dmp

Filesize
7.7MB

Download