Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-04-2024 13:04
Static task
static1
Behavioral task
behavioral1
Sample
abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe
Resource
win10v2004-20240412-en
General
-
Target
abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe
-
Size
4.2MB
-
MD5
b4e4c71c2dc12b19e51b76c0222409ea
-
SHA1
4487e504cabe1b5ddbb786189a6116f880c06e93
-
SHA256
abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd
-
SHA512
3f540df94eaf1ffedfb6dba3dcbadf6dfde5f0491cfbb9c147296dfd029794233018644a5369478ea905ffd99687159a39f2d1401b934380145474471b1f9919
-
SSDEEP
98304:tZPo3260MgOrbiCV32rtyb/NI2zMT2AL+pJdusexglISbXBQ7CZIKInIB:tVxtMbiCsrtM/NmqVpJTlxQ2aKDB
Malware Config
Signatures
-
Glupteba payload 18 IoCs
resource yara_rule behavioral2/memory/1804-2-0x00000000053E0000-0x0000000005CCB000-memory.dmp family_glupteba behavioral2/memory/1804-3-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/1804-51-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/1804-53-0x00000000053E0000-0x0000000005CCB000-memory.dmp family_glupteba behavioral2/memory/4756-56-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4756-88-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4756-138-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4756-149-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4320-191-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4320-245-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4320-256-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4320-260-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4320-264-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4320-268-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4320-272-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4320-276-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4320-280-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4320-284-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4868 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 4320 csrss.exe 2168 injector.exe 1536 windefender.exe 224 windefender.exe -
resource yara_rule behavioral2/files/0x000200000002aa06-249.dat upx behavioral2/memory/1536-253-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/224-258-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/224-266-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4956 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4344 schtasks.exe 2816 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-301 = "Romance Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-571 = "China Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3044 powershell.exe 3044 powershell.exe 1804 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 1804 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 3820 powershell.exe 3820 powershell.exe 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 1712 powershell.exe 1712 powershell.exe 488 powershell.exe 488 powershell.exe 3976 powershell.exe 3976 powershell.exe 4960 powershell.exe 4960 powershell.exe 4160 powershell.exe 4160 powershell.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 4320 csrss.exe 4320 csrss.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 4320 csrss.exe 4320 csrss.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 4320 csrss.exe 4320 csrss.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe 2168 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3044 powershell.exe Token: SeDebugPrivilege 1804 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Token: SeImpersonatePrivilege 1804 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe Token: SeDebugPrivilege 3820 powershell.exe Token: SeDebugPrivilege 1712 powershell.exe Token: SeDebugPrivilege 488 powershell.exe Token: SeDebugPrivilege 3976 powershell.exe Token: SeDebugPrivilege 4960 powershell.exe Token: SeDebugPrivilege 4160 powershell.exe Token: SeSystemEnvironmentPrivilege 4320 csrss.exe Token: SeSecurityPrivilege 4956 sc.exe Token: SeSecurityPrivilege 4956 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1804 wrote to memory of 3044 1804 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 82 PID 1804 wrote to memory of 3044 1804 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 82 PID 1804 wrote to memory of 3044 1804 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 82 PID 4756 wrote to memory of 3820 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 87 PID 4756 wrote to memory of 3820 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 87 PID 4756 wrote to memory of 3820 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 87 PID 4756 wrote to memory of 2480 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 89 PID 4756 wrote to memory of 2480 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 89 PID 2480 wrote to memory of 4868 2480 cmd.exe 91 PID 2480 wrote to memory of 4868 2480 cmd.exe 91 PID 4756 wrote to memory of 1712 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 92 PID 4756 wrote to memory of 1712 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 92 PID 4756 wrote to memory of 1712 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 92 PID 4756 wrote to memory of 488 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 94 PID 4756 wrote to memory of 488 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 94 PID 4756 wrote to memory of 488 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 94 PID 4756 wrote to memory of 4320 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 96 PID 4756 wrote to memory of 4320 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 96 PID 4756 wrote to memory of 4320 4756 abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe 96 PID 4320 wrote to memory of 3976 4320 csrss.exe 97 PID 4320 wrote to memory of 3976 4320 csrss.exe 97 PID 4320 wrote to memory of 3976 4320 csrss.exe 97 PID 4320 wrote to memory of 4960 4320 csrss.exe 103 PID 4320 wrote to memory of 4960 4320 csrss.exe 103 PID 4320 wrote to memory of 4960 4320 csrss.exe 103 PID 4320 wrote to memory of 4160 4320 csrss.exe 105 PID 4320 wrote to memory of 4160 4320 csrss.exe 105 PID 4320 wrote to memory of 4160 4320 csrss.exe 105 PID 4320 wrote to memory of 2168 4320 csrss.exe 107 PID 4320 wrote to memory of 2168 4320 csrss.exe 107 PID 1536 wrote to memory of 3084 1536 windefender.exe 113 PID 1536 wrote to memory of 3084 1536 windefender.exe 113 PID 1536 wrote to memory of 3084 1536 windefender.exe 113 PID 3084 wrote to memory of 4956 3084 cmd.exe 114 PID 3084 wrote to memory of 4956 3084 cmd.exe 114 PID 3084 wrote to memory of 4956 3084 cmd.exe 114 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe"C:\Users\Admin\AppData\Local\Temp\abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe"C:\Users\Admin\AppData\Local\Temp\abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4868
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:488
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4344
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2520
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4960
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4160
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2168
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2816
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:224
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD56f2c9b70ca370c5386fc7787948de006
SHA1f3bf5f69c7aae0944d48f2985e0656ab0a727db1
SHA2569e0344475b5657efb59e120e6fa297e96d8ee629a3cd210d553d7b88783a8b47
SHA51261f46f367162a45fbb43bbe4cf0690d72cd499dc83b8e59f65285d9ca68f07d95f06ce5f945e02464507c0cca4f8599d67a24dd63b2a3b458e10074a03f5119c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD538d3704b488878046fd15bf4474d2cbc
SHA1c6653a9467ee6ad3a5ad92a3c1d35d6500580a51
SHA25631bf1b8fda13f33d80bfd91086fb65b2a71b742eb7c35b7cbbc2ccd5af6a3651
SHA512a025d8f642e7a13b3fe24f49e2b7d1d886b735ea9476a4192019c478423c4125372655284b0fe3c551c87710e21acade76746d7d74d6d0fab46db44098d218d1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e68f236a1dcfc53d5e7a8ee4e037958a
SHA1a671a255226f07181371c2945e1d026d53ba64a4
SHA256755ddb7f572a54823e8c746c7ae886034a66b0646cec4a40bdc3c5e92a5d6af8
SHA51249dc4976f45ef591bc8de1cd51d1abc3c2d58824fa6ec0a90d0407a87ce14e63f213fafac87e256ee4ecbb32bb7808e450cea86d46152d201eb5cc7f74f13abe
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5545132ff265e763af4694a77a74c9c0d
SHA1821c81b293912911bcc893462eedc7f1432919d8
SHA256a319ba33646be93d937fdbb7572393472a73705c674893dc5dd5c50219a1bedb
SHA512f5f9f0d3e1d230ed34d90793e0a0c94b2f401ca940032e3e0ec4eaa724b4f7788be869a0a5681c52b7b7566c9810453df605a0e35ccd343ff30fb8f230636422
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD565c36b629b6b057922f057791326f031
SHA120b02428c18c77f978ade714b66943ac929603fe
SHA2562c3634c49c7c1ea35171c35a23ee649f9178d4522b663e854de28509c3647b8c
SHA5128f14aa8299facd752f60c771dfe41f1ee561ca25b686a8a3cb4be754890b7be9b764537453ecea6afdaba15fd41492e27ae97c2551e9afc72e1a91cc162e3212
-
Filesize
4.2MB
MD5b4e4c71c2dc12b19e51b76c0222409ea
SHA14487e504cabe1b5ddbb786189a6116f880c06e93
SHA256abd6a2a830ad60dee388eb6fb1a9ee7d63b01fa8a7e55d2dbf7ec430072394bd
SHA5123f540df94eaf1ffedfb6dba3dcbadf6dfde5f0491cfbb9c147296dfd029794233018644a5369478ea905ffd99687159a39f2d1401b934380145474471b1f9919
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec