glupteba | 66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362

Analysis

max time kernel
27s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
25/04/2024, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Size

4.1MB
MD5

ae6a41a495a6e0aa09c2b9a719557498
SHA1

1860dc6c87fd196d1958e4859ea05a2701097134
SHA256

66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362
SHA512

71eb08cac47d0a0debf6f5398daab4871299d54f1f5d7dedc0b481734c29564df120bbf0b34b25d31a642cd4e647caba2c881ee75b12c02bf386ae72c3540642
SSDEEP

98304:jUQRf1wSMtGEuHsx9VAF/BImpXoFDf7ijanB1+UMJM3:jUE1euH+9U2mWZ7rz+w3

Score

10^/10

glupteba dropper evasion loader upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 18 IoCs

resource	yara_rule
behavioral1/memory/2288-2-0x00000000052C0000-0x0000000005BAB000-memory.dmp	family_glupteba
behavioral1/memory/2288-3-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/2288-55-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/2288-57-0x00000000052C0000-0x0000000005BAB000-memory.dmp	family_glupteba
behavioral1/memory/1184-60-0x00000000051A0000-0x0000000005A8B000-memory.dmp	family_glupteba
behavioral1/memory/1184-61-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/1184-95-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/1184-161-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/4768-228-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/4768-266-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/4768-277-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/4768-281-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/4768-285-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/4768-289-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/4768-293-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/4768-297-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/4768-301-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba
behavioral1/memory/4768-305-0x0000000000400000-0x0000000003005000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2696	netsh.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000023412-269.dat	upx
behavioral1/memory/5020-274-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3988-278-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/3988-286-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4484	sc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5116	schtasks.exe
3916	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
3268	powershell.exe
3268	powershell.exe
2288	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
2288	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
1072	powershell.exe
1072	powershell.exe
1072	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3268	powershell.exe
Token: SeDebugPrivilege	2288	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Token: SeImpersonatePrivilege	2288	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
Token: SeDebugPrivilege	1072	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3268	2288	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe	90
PID 2288 wrote to memory of 3268	2288	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe	90
PID 2288 wrote to memory of 3268	2288	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe	90
PID 1184 wrote to memory of 1072	1184	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe	103
PID 1184 wrote to memory of 1072	1184	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe	103
PID 1184 wrote to memory of 1072	1184	66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe	103

C:\Users\Admin\AppData\Local\Temp\66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
"C:\Users\Admin\AppData\Local\Temp\66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3268
- C:\Users\Admin\AppData\Local\Temp\66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe
  "C:\Users\Admin\AppData\Local\Temp\66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362.exe"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:1600
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2696
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:1460
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    PID:1464
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    PID:4768
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:1912
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:5116
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:2392
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4488
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:2012
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:3916
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      PID:5020
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:3540
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        
        PID:4484

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dxxagjie.dp1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
e38cf80ccd733d12acd8ed657fa76a0f

SHA1
580e49e1b482dcf0480cefe6d5bf8f0331732296

SHA256
47996c1354ee704ef75a94ae2217033da52695ca164573023cda951bdec728be

SHA512
ed7056b56d6cd0fd42f9bb716c647ed21f988231aa0817f28be7fceab199a274a479af4e7b77b86ed298b6734b39c2e6714d46bd6bd408d9862a77d97013bc12

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
b63c5497606ce8e6112e8b5c1417e0b7

SHA1
5d4326b8db9a7c6879aaaa06104e3d51d6346a31

SHA256
024ee31d91abe382cdc752c64169d16dca85b2e19a6a8880ed7558488f9b6dea

SHA512
f199d97ac8d49b9e9a42f52087d31f09275413c8c00e3678f0ac9d85b5e78f5162a68dcdb6ab82372ae56351fb0b6a80962b2e331cd937610dc919bf9825059d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
b4b3ef6d4d096060e08cda0e3a44069c

SHA1
965428b5e82bf025512a827034a3715146e93ca2

SHA256
fc8032a4371919e9749bb3393bb9a65b886dd255f7559cf26b7b1b9581a168ec

SHA512
ef2fe659641db7263fe8b073285ff82c5b810dd892547ac57d3486111f48d18a8e873533aee45b28d21119739a67dd29adc2750e00e7aa5a49eb6b55ed28eb63

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
2d861f0d57886168139236d0fe90047a

SHA1
172419bbcaa14cd1dd30f5f52fa4b1bfc9149b3e

SHA256
16f8d4ef96378f444401be4f3671940a5fcdd6006e0a14a3134b191d9a6f87de

SHA512
34573f001fcdf7e51a95c939e6a1dca0a5e22a39f67fbe08caef57556f4f7a8d2d368924c7915014f8a44df5cf7bd6489b94b9281149c57c41ea93d986895338

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
45c5ce77ad33e02945b3536a9d75dbb9

SHA1
a79ae269e76b9543c42fd270d80a9cfdde6ce29e

SHA256
35a64f7925b38ffe0edc0db192867681365fc410444953f279b701f01d315b99

SHA512
aa65551958f9cb743785561cd73b49072f29cc86c562cecc0d30dc528e0de87209d5d436c45b2c54315d9fee449d1ed515b2d67b790a10cd387b7d00da6d7a36

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
7403eea406cd973ea3e9e81644639ddc

SHA1
54dbe9be59ac904c30e6853d52e3d9fd8cdc419a

SHA256
e3c44b1ba282671f86c4757d6a7d7953e496f5c9984e8b12653716e984610c61

SHA512
e95fbb7b3609d66964ed71d38f74401e8eb2773a0ba8f1f17c6548ff1b0345a1214f7c128c9b6203b623411995bb123062b0f4c2c80ce90c1f8bf22fc6eab691

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
ae6a41a495a6e0aa09c2b9a719557498

SHA1
1860dc6c87fd196d1958e4859ea05a2701097134

SHA256
66b43b6467e42c67b30e4ae665ea8e6d8b25f20aeb514da0166172a17f9df362

SHA512
71eb08cac47d0a0debf6f5398daab4871299d54f1f5d7dedc0b481734c29564df120bbf0b34b25d31a642cd4e647caba2c881ee75b12c02bf386ae72c3540642

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/1072-63-0x0000000002C80000-0x0000000002C90000-memory.dmp

Filesize
64KB

Download
memory/1072-93-0x00000000740A0000-0x0000000074850000-memory.dmp

Filesize
7.7MB

Download
memory/1072-88-0x0000000002C80000-0x0000000002C90000-memory.dmp

Filesize
64KB

Download
memory/1072-62-0x00000000740A0000-0x0000000074850000-memory.dmp

Filesize
7.7MB

Download
memory/1072-75-0x000000007F140000-0x000000007F150000-memory.dmp

Filesize
64KB

Download
memory/1072-89-0x0000000007730000-0x0000000007741000-memory.dmp

Filesize
68KB

Download
memory/1072-64-0x0000000002C80000-0x0000000002C90000-memory.dmp

Filesize
64KB

Download
memory/1072-90-0x0000000007780000-0x0000000007794000-memory.dmp

Filesize
80KB

Download
memory/1072-74-0x0000000005F70000-0x00000000062C4000-memory.dmp

Filesize
3.3MB

Download
memory/1072-76-0x000000006FF40000-0x000000006FF8C000-memory.dmp

Filesize
304KB

Download
memory/1072-77-0x00000000700C0000-0x0000000070414000-memory.dmp

Filesize
3.3MB

Download
memory/1072-87-0x0000000007410000-0x00000000074B3000-memory.dmp

Filesize
652KB

Download
memory/1184-110-0x0000000003600000-0x00000000039FA000-memory.dmp

Filesize
4.0MB

Download
memory/1184-161-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/1184-95-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/1184-60-0x00000000051A0000-0x0000000005A8B000-memory.dmp

Filesize
8.9MB

Download
memory/1184-59-0x0000000003600000-0x00000000039FA000-memory.dmp

Filesize
4.0MB

Download
memory/1184-61-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/1460-126-0x00000000740A0000-0x0000000074850000-memory.dmp

Filesize
7.7MB

Download
memory/1460-96-0x00000000740A0000-0x0000000074850000-memory.dmp

Filesize
7.7MB

Download
memory/1460-98-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/1460-97-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/1460-108-0x0000000005F60000-0x00000000062B4000-memory.dmp

Filesize
3.3MB

Download
memory/1460-111-0x000000006FF40000-0x000000006FF8C000-memory.dmp

Filesize
304KB

Download
memory/1460-112-0x000000007F5E0000-0x000000007F5F0000-memory.dmp

Filesize
64KB

Download
memory/1460-113-0x0000000070C70000-0x0000000070FC4000-memory.dmp

Filesize
3.3MB

Download
memory/1460-123-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/1460-124-0x0000000005280000-0x0000000005290000-memory.dmp

Filesize
64KB

Download
memory/1464-128-0x00000000740A0000-0x0000000074850000-memory.dmp

Filesize
7.7MB

Download
memory/1464-129-0x0000000005100000-0x0000000005110000-memory.dmp

Filesize
64KB

Download
memory/1464-130-0x0000000006010000-0x0000000006364000-memory.dmp

Filesize
3.3MB

Download
memory/2288-57-0x00000000052C0000-0x0000000005BAB000-memory.dmp

Filesize
8.9MB

Download
memory/2288-56-0x0000000003720000-0x0000000003B20000-memory.dmp

Filesize
4.0MB

Download
memory/2288-55-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/2288-2-0x00000000052C0000-0x0000000005BAB000-memory.dmp

Filesize
8.9MB

Download
memory/2288-3-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/2288-1-0x0000000003720000-0x0000000003B20000-memory.dmp

Filesize
4.0MB

Download
memory/3268-21-0x0000000005CD0000-0x0000000006024000-memory.dmp

Filesize
3.3MB

Download
memory/3268-49-0x0000000007B10000-0x0000000007B2A000-memory.dmp

Filesize
104KB

Download
memory/3268-44-0x00000000079B0000-0x00000000079BA000-memory.dmp

Filesize
40KB

Download
memory/3268-41-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Filesize
64KB

Download
memory/3268-43-0x00000000078C0000-0x0000000007963000-memory.dmp

Filesize
652KB

Download
memory/3268-42-0x00000000078A0000-0x00000000078BE000-memory.dmp

Filesize
120KB

Download
memory/3268-31-0x0000000070310000-0x0000000070664000-memory.dmp

Filesize
3.3MB

Download
memory/3268-30-0x000000006FF40000-0x000000006FF8C000-memory.dmp

Filesize
304KB

Download
memory/3268-29-0x0000000007860000-0x0000000007892000-memory.dmp

Filesize
200KB

Download
memory/3268-28-0x000000007EE40000-0x000000007EE50000-memory.dmp

Filesize
64KB

Download
memory/3268-27-0x00000000076A0000-0x00000000076BA000-memory.dmp

Filesize
104KB

Download
memory/3268-26-0x0000000007D00000-0x000000000837A000-memory.dmp

Filesize
6.5MB

Download
memory/3268-25-0x0000000007600000-0x0000000007676000-memory.dmp

Filesize
472KB

Download
memory/3268-24-0x0000000006830000-0x0000000006874000-memory.dmp

Filesize
272KB

Download
memory/3268-23-0x0000000006310000-0x000000000635C000-memory.dmp

Filesize
304KB

Download
memory/3268-22-0x00000000062D0000-0x00000000062EE000-memory.dmp

Filesize
120KB

Download
memory/3268-46-0x00000000079D0000-0x00000000079E1000-memory.dmp

Filesize
68KB

Download
memory/3268-11-0x0000000005C20000-0x0000000005C86000-memory.dmp

Filesize
408KB

Download
memory/3268-10-0x0000000005440000-0x00000000054A6000-memory.dmp

Filesize
408KB

Download
memory/3268-47-0x0000000007A10000-0x0000000007A1E000-memory.dmp

Filesize
56KB

Download
memory/3268-48-0x0000000007A20000-0x0000000007A34000-memory.dmp

Filesize
80KB

Download
memory/3268-45-0x0000000007A70000-0x0000000007B06000-memory.dmp

Filesize
600KB

Download
memory/3268-9-0x00000000052A0000-0x00000000052C2000-memory.dmp

Filesize
136KB

Download
memory/3268-8-0x00000000054C0000-0x0000000005AE8000-memory.dmp

Filesize
6.2MB

Download
memory/3268-7-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Filesize
64KB

Download
memory/3268-6-0x0000000002CB0000-0x0000000002CC0000-memory.dmp

Filesize
64KB

Download
memory/3268-5-0x00000000740A0000-0x0000000074850000-memory.dmp

Filesize
7.7MB

Download
memory/3268-53-0x00000000740A0000-0x0000000074850000-memory.dmp

Filesize
7.7MB

Download
memory/3268-4-0x0000000002C60000-0x0000000002C96000-memory.dmp

Filesize
216KB

Download
memory/3268-50-0x0000000007A60000-0x0000000007A68000-memory.dmp

Filesize
32KB

Download
memory/3988-278-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3988-286-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4768-285-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/4768-277-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/4768-281-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/4768-266-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/4768-228-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/4768-289-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/4768-293-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/4768-297-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/4768-301-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/4768-305-0x0000000000400000-0x0000000003005000-memory.dmp

Filesize
44.0MB

Download
memory/5020-274-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download