Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
21-04-2024 13:03
Static task
static1
Behavioral task
behavioral1
Sample
fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe
Resource
win10v2004-20240226-en
General
-
Target
fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe
-
Size
4.1MB
-
MD5
8b0837ac590e41607fb88e67d2554529
-
SHA1
2ef0f5321d5060f4356dbbaf4ad795d82ad0cb3f
-
SHA256
fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1
-
SHA512
fdfe06f8ad3dce2880eefd30f2176d0142e2431f697db8e062e0862f5966536b89f26064198c99d36a2bde4be791342bbc620be292962102f40852783cdf13db
-
SSDEEP
98304:oupp3WUkLaIVxVQ5Lfi8+DAGSBgUwbhlmIRT0sLJ5E:l24wrgi8oddlbq
Malware Config
Signatures
-
Glupteba payload 36 IoCs
Processes:
resource yara_rule behavioral2/memory/2128-2-0x00000000041D0000-0x0000000004ABC000-memory.dmp family_glupteba behavioral2/memory/1184-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1184-5-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1184-6-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1184-7-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1184-8-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1184-9-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/1184-57-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3808-69-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3808-68-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3808-70-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3808-71-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3808-72-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3808-137-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3808-160-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-173-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-174-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-175-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-176-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-202-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-233-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-265-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-266-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-267-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-276-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-278-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-280-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-282-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-284-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-286-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-288-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-290-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-292-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-294-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-296-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2712-298-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 796 netsh.exe -
Executes dropped EXE 5 IoCs
Processes:
csrss.execsrss.exeinjector.exewindefender.exewindefender.exepid process 3376 csrss.exe 2712 csrss.exe 1260 injector.exe 424 windefender.exe 2128 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/424-275-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2128-277-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2128-281-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\S-1-5-21-834482027-582050234-2368284635-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exefd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.execsrss.exedescription pid process target process PID 2128 set thread context of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 set thread context of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3376 set thread context of 2712 3376 csrss.exe csrss.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exefd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exedescription ioc process File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe File created C:\Windows\rss\csrss.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3156 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1764 schtasks.exe 1232 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-491 = "India Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-385 = "Namibia Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exefd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exepowershell.exefd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4268 powershell.exe 4268 powershell.exe 1184 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 1184 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 3912 powershell.exe 3912 powershell.exe 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe 4784 powershell.exe 4784 powershell.exe 1220 powershell.exe 1220 powershell.exe 2824 powershell.exe 2824 powershell.exe 2392 powershell.exe 2392 powershell.exe 3760 powershell.exe 3760 powershell.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 2712 csrss.exe 2712 csrss.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 2712 csrss.exe 2712 csrss.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 2712 csrss.exe 2712 csrss.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe 1260 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exefd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4268 powershell.exe Token: SeDebugPrivilege 1184 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Token: SeImpersonatePrivilege 1184 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe Token: SeDebugPrivilege 3912 powershell.exe Token: SeDebugPrivilege 4784 powershell.exe Token: SeDebugPrivilege 1220 powershell.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 2392 powershell.exe Token: SeDebugPrivilege 3760 powershell.exe Token: SeSystemEnvironmentPrivilege 2712 csrss.exe Token: SeSecurityPrivilege 3156 sc.exe Token: SeSecurityPrivilege 3156 sc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exefd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exefd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exefd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.execmd.execsrss.execsrss.exewindefender.exedescription pid process target process PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 2128 wrote to memory of 1184 2128 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 1184 wrote to memory of 4268 1184 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 1184 wrote to memory of 4268 1184 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 1184 wrote to memory of 4268 1184 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3692 wrote to memory of 3808 3692 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe PID 3808 wrote to memory of 3912 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 3808 wrote to memory of 3912 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 3808 wrote to memory of 3912 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 3808 wrote to memory of 2084 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe cmd.exe PID 3808 wrote to memory of 2084 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe cmd.exe PID 2084 wrote to memory of 796 2084 cmd.exe netsh.exe PID 2084 wrote to memory of 796 2084 cmd.exe netsh.exe PID 3808 wrote to memory of 4784 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 3808 wrote to memory of 4784 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 3808 wrote to memory of 4784 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 3808 wrote to memory of 1220 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 3808 wrote to memory of 1220 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 3808 wrote to memory of 1220 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe powershell.exe PID 3808 wrote to memory of 3376 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe csrss.exe PID 3808 wrote to memory of 3376 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe csrss.exe PID 3808 wrote to memory of 3376 3808 fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 3376 wrote to memory of 2712 3376 csrss.exe csrss.exe PID 2712 wrote to memory of 2824 2712 csrss.exe powershell.exe PID 2712 wrote to memory of 2824 2712 csrss.exe powershell.exe PID 2712 wrote to memory of 2824 2712 csrss.exe powershell.exe PID 2712 wrote to memory of 2392 2712 csrss.exe powershell.exe PID 2712 wrote to memory of 2392 2712 csrss.exe powershell.exe PID 2712 wrote to memory of 2392 2712 csrss.exe powershell.exe PID 2712 wrote to memory of 3760 2712 csrss.exe powershell.exe PID 2712 wrote to memory of 3760 2712 csrss.exe powershell.exe PID 2712 wrote to memory of 3760 2712 csrss.exe powershell.exe PID 2712 wrote to memory of 1260 2712 csrss.exe injector.exe PID 2712 wrote to memory of 1260 2712 csrss.exe injector.exe PID 424 wrote to memory of 2688 424 windefender.exe cmd.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe"C:\Users\Admin\AppData\Local\Temp\fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe"C:\Users\Admin\AppData\Local\Temp\fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe"C:\Users\Admin\AppData\Local\Temp\fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe"C:\Users\Admin\AppData\Local\Temp\fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1.exe"4⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3912 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
PID:796 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
PID:1764 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f7⤵PID:1432
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile7⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1260 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F7⤵
- Creates scheduled task(s)
PID:1232 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵PID:2688
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2128
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0u0qx0uv.hea.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD51c0fe4e6ae14552f83d068b8aafce5b6
SHA114dea94ae51b32bfdb6ca22919838763b3c360ec
SHA2568f81cdb6bf0ae1f307228ee132f372bfa42ea7cd07fb0309658e61cdd4ffbd29
SHA512f459482492c3b84dcc8c19ea91fc5b0269de615c3efbea0fec10eb36e87cfc3b5f96e6cd485077b3c5888c04cd591091dd7c2ad5a3ee7baab7b11d6b5d0c975f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD57c51e8fbf528d871d23a692234366bb5
SHA1f0ef23cbeb4ed0cddddb85a2a82de16443fcdb5a
SHA2569c5e7690a1edd71b4f4dcd1ffda730001ed3cc7a367e40d472d5077d2f333603
SHA512446a22b459bf7046f183d43ca71d08fd817b0d46e3d117440e4ae6adb4387e0c7fb90ad907d08393f5cb10be2abf26bda09b460df02a775ca23326330c11dfc7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a2cd1a41a28bf0827487ce04554ce5d6
SHA1d0878873bbd52318596ddef6bae421a3796f12a7
SHA256267461968d7bcd8749c04e54718f490579cba9e8daf8b785e5a36d6269a97f7e
SHA51239b006a8cb6e63079f169dc6e2a0d3f1298852cfb6794f7a78150f4c8feb88bc58319168c8f63250662845ae866a1e64e5225c0fb9081641469badda04e64e56
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e58c520f9d3fd03744f112f842f7adbe
SHA1a6a7c77f1d473d1dce448eee968332a974d3afa4
SHA256b81c0c8597e66504db0dd8309c89d0eb29b2ccde9f7439a5130605d598109526
SHA5121d575e4bce1d2852cc3e65a02088865da4c1c009de9c01d3e622352289f26c4cada3a0963a171c2c1db71f9c4426bbfe2dd9f6a57811a16c3fa85352265e6f27
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5d9f4c363cdd0cbd83a418e4fac3b4dc5
SHA1fb7f9bbc2ce95cf5ceb04ba47845e8ecaab2dbe7
SHA25636adc678e6bcab86a08e854442b8670d8a3754ff037e37cca973508e3c6cb2f1
SHA512aae1f2a9211620b5b75f6ba5800ea9ea20f20f03717e2475259230c294962884686f38e354e7736a0bdaa3c4fa857c87c1dff686a3453ec4227a5df2fe5d5b1a
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD58b0837ac590e41607fb88e67d2554529
SHA12ef0f5321d5060f4356dbbaf4ad795d82ad0cb3f
SHA256fd8898f4b00574becd211f73e6031d6ede884f6074bf2c33ee27cfc78ed9fed1
SHA512fdfe06f8ad3dce2880eefd30f2176d0142e2431f697db8e062e0862f5966536b89f26064198c99d36a2bde4be791342bbc620be292962102f40852783cdf13db
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/424-275-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/1184-9-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1184-8-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1184-3-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1184-5-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1184-57-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1184-6-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1184-7-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1220-131-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/1220-146-0x0000000071BC0000-0x0000000071F17000-memory.dmpFilesize
3.3MB
-
memory/1220-144-0x000000007FCC0000-0x000000007FCD0000-memory.dmpFilesize
64KB
-
memory/1220-156-0x0000000074F30000-0x00000000756E1000-memory.dmpFilesize
7.7MB
-
memory/1220-145-0x0000000071210000-0x000000007125C000-memory.dmpFilesize
304KB
-
memory/1220-138-0x0000000005480000-0x00000000057D7000-memory.dmpFilesize
3.3MB
-
memory/1220-130-0x0000000074F30000-0x00000000756E1000-memory.dmpFilesize
7.7MB
-
memory/1220-142-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/2128-277-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2128-281-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/2128-1-0x0000000003DD0000-0x00000000041CD000-memory.dmpFilesize
4.0MB
-
memory/2128-2-0x00000000041D0000-0x0000000004ABC000-memory.dmpFilesize
8.9MB
-
memory/2712-286-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-173-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-202-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-265-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-298-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-176-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-175-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-174-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-266-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-296-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-294-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-292-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-290-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-288-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-284-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-233-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-282-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-280-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-267-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-276-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2712-278-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/2824-177-0x0000000074F30000-0x00000000756E1000-memory.dmpFilesize
7.7MB
-
memory/3376-168-0x0000000004000000-0x0000000004400000-memory.dmpFilesize
4.0MB
-
memory/3692-64-0x00000000039F0000-0x0000000003DF7000-memory.dmpFilesize
4.0MB
-
memory/3808-160-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3808-72-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3808-71-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3808-70-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3808-68-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3808-69-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3808-137-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3912-98-0x00000000074C0000-0x00000000074D1000-memory.dmpFilesize
68KB
-
memory/3912-97-0x0000000007170000-0x0000000007214000-memory.dmpFilesize
656KB
-
memory/3912-74-0x0000000002780000-0x0000000002790000-memory.dmpFilesize
64KB
-
memory/3912-73-0x0000000074F30000-0x00000000756E1000-memory.dmpFilesize
7.7MB
-
memory/3912-83-0x0000000005B70000-0x0000000005EC7000-memory.dmpFilesize
3.3MB
-
memory/3912-84-0x0000000005FD0000-0x000000000601C000-memory.dmpFilesize
304KB
-
memory/3912-87-0x0000000071390000-0x00000000716E7000-memory.dmpFilesize
3.3MB
-
memory/3912-86-0x0000000071210000-0x000000007125C000-memory.dmpFilesize
304KB
-
memory/3912-96-0x0000000002780000-0x0000000002790000-memory.dmpFilesize
64KB
-
memory/3912-102-0x0000000074F30000-0x00000000756E1000-memory.dmpFilesize
7.7MB
-
memory/3912-99-0x0000000007510000-0x0000000007525000-memory.dmpFilesize
84KB
-
memory/3912-85-0x000000007EE90000-0x000000007EEA0000-memory.dmpFilesize
64KB
-
memory/4268-49-0x0000000007EE0000-0x0000000007EF1000-memory.dmpFilesize
68KB
-
memory/4268-43-0x0000000003400000-0x0000000003410000-memory.dmpFilesize
64KB
-
memory/4268-11-0x0000000003430000-0x0000000003466000-memory.dmpFilesize
216KB
-
memory/4268-10-0x0000000074F20000-0x00000000756D1000-memory.dmpFilesize
7.7MB
-
memory/4268-12-0x0000000003400000-0x0000000003410000-memory.dmpFilesize
64KB
-
memory/4268-14-0x0000000005C10000-0x000000000623A000-memory.dmpFilesize
6.2MB
-
memory/4268-13-0x0000000003400000-0x0000000003410000-memory.dmpFilesize
64KB
-
memory/4268-15-0x0000000005A00000-0x0000000005A22000-memory.dmpFilesize
136KB
-
memory/4268-56-0x0000000074F20000-0x00000000756D1000-memory.dmpFilesize
7.7MB
-
memory/4268-53-0x0000000007F70000-0x0000000007F78000-memory.dmpFilesize
32KB
-
memory/4268-52-0x0000000007F90000-0x0000000007FAA000-memory.dmpFilesize
104KB
-
memory/4268-51-0x0000000007F40000-0x0000000007F55000-memory.dmpFilesize
84KB
-
memory/4268-50-0x0000000007F30000-0x0000000007F3E000-memory.dmpFilesize
56KB
-
memory/4268-16-0x0000000005AA0000-0x0000000005B06000-memory.dmpFilesize
408KB
-
memory/4268-48-0x0000000007FD0000-0x0000000008066000-memory.dmpFilesize
600KB
-
memory/4268-47-0x0000000007EC0000-0x0000000007ECA000-memory.dmpFilesize
40KB
-
memory/4268-46-0x0000000007E80000-0x0000000007E9A000-memory.dmpFilesize
104KB
-
memory/4268-45-0x00000000084C0000-0x0000000008B3A000-memory.dmpFilesize
6.5MB
-
memory/4268-44-0x0000000007D60000-0x0000000007E04000-memory.dmpFilesize
656KB
-
memory/4268-17-0x00000000062B0000-0x0000000006316000-memory.dmpFilesize
408KB
-
memory/4268-42-0x0000000007D40000-0x0000000007D5E000-memory.dmpFilesize
120KB
-
memory/4268-33-0x0000000071320000-0x0000000071677000-memory.dmpFilesize
3.3MB
-
memory/4268-30-0x000000007FA00000-0x000000007FA10000-memory.dmpFilesize
64KB
-
memory/4268-32-0x00000000711A0000-0x00000000711EC000-memory.dmpFilesize
304KB
-
memory/4268-31-0x0000000007D00000-0x0000000007D34000-memory.dmpFilesize
208KB
-
memory/4268-29-0x0000000006E70000-0x0000000006EB6000-memory.dmpFilesize
280KB
-
memory/4268-28-0x0000000006920000-0x000000000696C000-memory.dmpFilesize
304KB
-
memory/4268-27-0x00000000068D0000-0x00000000068EE000-memory.dmpFilesize
120KB
-
memory/4268-26-0x00000000063A0000-0x00000000066F7000-memory.dmpFilesize
3.3MB
-
memory/4784-104-0x0000000074F30000-0x00000000756E1000-memory.dmpFilesize
7.7MB
-
memory/4784-116-0x000000007FD90000-0x000000007FDA0000-memory.dmpFilesize
64KB
-
memory/4784-117-0x0000000071210000-0x000000007125C000-memory.dmpFilesize
304KB
-
memory/4784-127-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB
-
memory/4784-118-0x0000000071390000-0x00000000716E7000-memory.dmpFilesize
3.3MB
-
memory/4784-129-0x0000000074F30000-0x00000000756E1000-memory.dmpFilesize
7.7MB
-
memory/4784-106-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB
-
memory/4784-105-0x0000000004E80000-0x0000000004E90000-memory.dmpFilesize
64KB