Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-04-2024 20:59
Static task
static1
Behavioral task
behavioral1
Sample
31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe
Resource
win10v2004-20240419-en
General
-
Target
31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe
-
Size
4.2MB
-
MD5
c10260d38cf87a868cea639502863074
-
SHA1
e4e314be6651d8cb63da0be0201c3a95f6033a76
-
SHA256
31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f
-
SHA512
d676b6021b80719d5840d53146626d9a24c3d935dad45610ea02e1d53a24b0200d8bb7ab5fa25c9e00194d7e9c2fb265078d39eb4bbb1ba57fa6dabcc810d0fb
-
SSDEEP
98304:9x1RyBW5eh1jvdHfL95CEfIBLRbKwJWZNSsbjNHIm:/fIvBT9wRBLRbbJ6NSsbZH1
Malware Config
Signatures
-
Glupteba payload 19 IoCs
Processes:
resource yara_rule behavioral2/memory/4304-2-0x0000000006D30000-0x000000000761B000-memory.dmp family_glupteba behavioral2/memory/4304-3-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/4304-74-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/960-116-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/960-121-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/4304-145-0x0000000006D30000-0x000000000761B000-memory.dmp family_glupteba behavioral2/memory/684-148-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-183-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-201-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-203-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-206-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-208-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-210-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-211-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-213-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-216-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-218-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-219-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba behavioral2/memory/684-221-0x0000000000400000-0x000000000441C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 4732 netsh.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exeinjector.exepid process 684 csrss.exe 2860 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
csrss.exe31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-891789021-684472942-1795878712-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-891789021-684472942-1795878712-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe -
Drops file in Windows directory 2 IoCs
Processes:
31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exedescription ioc process File opened for modification C:\Windows\rss 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe File created C:\Windows\rss\csrss.exe 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2552 schtasks.exe 4732 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exe31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exepowershell.exe31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 1040 powershell.exe 1040 powershell.exe 4304 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 4304 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 2892 powershell.exe 2892 powershell.exe 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe 1032 powershell.exe 1032 powershell.exe 1380 powershell.exe 1380 powershell.exe 2248 powershell.exe 2248 powershell.exe 1420 powershell.exe 1420 powershell.exe 1072 powershell.exe 1072 powershell.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 684 csrss.exe 684 csrss.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 684 csrss.exe 684 csrss.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe 2860 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exe31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exedescription pid process Token: SeDebugPrivilege 1040 powershell.exe Token: SeDebugPrivilege 4304 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Token: SeImpersonatePrivilege 4304 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe Token: SeDebugPrivilege 2892 powershell.exe Token: SeDebugPrivilege 1032 powershell.exe Token: SeDebugPrivilege 1380 powershell.exe Token: SeDebugPrivilege 2248 powershell.exe Token: SeDebugPrivilege 1420 powershell.exe Token: SeDebugPrivilege 1072 powershell.exe Token: SeSystemEnvironmentPrivilege 684 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.execmd.execsrss.exedescription pid process target process PID 4304 wrote to memory of 1040 4304 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 4304 wrote to memory of 1040 4304 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 4304 wrote to memory of 1040 4304 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 960 wrote to memory of 2892 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 960 wrote to memory of 2892 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 960 wrote to memory of 2892 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 960 wrote to memory of 4472 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe cmd.exe PID 960 wrote to memory of 4472 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe cmd.exe PID 4472 wrote to memory of 4732 4472 cmd.exe netsh.exe PID 4472 wrote to memory of 4732 4472 cmd.exe netsh.exe PID 960 wrote to memory of 1032 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 960 wrote to memory of 1032 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 960 wrote to memory of 1032 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 960 wrote to memory of 1380 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 960 wrote to memory of 1380 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 960 wrote to memory of 1380 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe powershell.exe PID 960 wrote to memory of 684 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe csrss.exe PID 960 wrote to memory of 684 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe csrss.exe PID 960 wrote to memory of 684 960 31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe csrss.exe PID 684 wrote to memory of 2248 684 csrss.exe powershell.exe PID 684 wrote to memory of 2248 684 csrss.exe powershell.exe PID 684 wrote to memory of 2248 684 csrss.exe powershell.exe PID 684 wrote to memory of 1420 684 csrss.exe powershell.exe PID 684 wrote to memory of 1420 684 csrss.exe powershell.exe PID 684 wrote to memory of 1420 684 csrss.exe powershell.exe PID 684 wrote to memory of 1072 684 csrss.exe powershell.exe PID 684 wrote to memory of 1072 684 csrss.exe powershell.exe PID 684 wrote to memory of 1072 684 csrss.exe powershell.exe PID 684 wrote to memory of 2860 684 csrss.exe injector.exe PID 684 wrote to memory of 2860 684 csrss.exe injector.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe"C:\Users\Admin\AppData\Local\Temp\31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe"C:\Users\Admin\AppData\Local\Temp\31170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g1gjmslw.5lx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD51d0aadaa74c4c548cb22616da1f48842
SHA1d0d95cacb0d88b0b897f5dc307944bd6b27daf05
SHA256e0a558a64dc5ae8eba523bff393eda0491c280bcbe01448f646d36a78fa97790
SHA51265c57a59774ef5a5db508708692634da042dcd75539f210f9249507173f304b47e4b91d32279612b902a597ce754b4ff1e921823f05cf662e2f3d7987e36d5f3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD505dd27a44458d62764de98f349c41a20
SHA18e47a79469df5998b79803880bec5f3bf2c86760
SHA2568c14eab7d62f285b838c2b020da3a30af32d3d304295bf70b8237f2f359b87e7
SHA512cc397082352c7467bef11c79377a16a601a67d3a59b2ceb625ee69a097b937468a024d3bb36b70f53369c912f1daf53af07f1632bd11fa612d53084888fa83b3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD56e52199679060ce20bd672bc359f4168
SHA1775b02fb595f920f51668a1b8de3d7fa1446ca9f
SHA25646bb2f47e81fed62b12d0746bfa85c0efb9715f753696a398eaa8028aef1ce92
SHA512da6241f0c278297d8eac613b63bb36735654c57abf6dc6fcdcddbc2f6728d64b36fd44579434a25c669c9ba35459a3c6c5ee859283050293cb015f21fed6b850
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5b015a4a665ec19d94a2a7b58a1efb500
SHA10581d137b93bfdd086de221be4a454acc6a26df1
SHA256bcb2aafac8d2baf8d272b0e3144c7a827848786e033386eb548e7b4ada49d44d
SHA512e41d1cded0dba40eb022eda9f4fbce86522035b89654d498430521371a162f8a029ed42003747318f4be69ab4f06c02ae00637a5d172111fedb79cdcc5d4787a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD513fc8705475672a809c8c049bcc5c225
SHA1160a2b0c3898f628c910cca0ef73c4eb6aff1275
SHA256eb1f5ade410fb352cf5762ce3779552ceb70ff524186f4e5fcc674469cedfc59
SHA5121c433f7b51035cae8877c88b94ac2a672748a37ec09145600a64df84ea04c17af3aee0bcd1d88c3355ed8bb35fab3db8d84a6614d07825c32ba22dd363cae65f
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5c10260d38cf87a868cea639502863074
SHA1e4e314be6651d8cb63da0be0201c3a95f6033a76
SHA25631170e131d7044b02f58494119ca6a3d9e124c32ad1d998ad57b1817ec31443f
SHA512d676b6021b80719d5840d53146626d9a24c3d935dad45610ea02e1d53a24b0200d8bb7ab5fa25c9e00194d7e9c2fb265078d39eb4bbb1ba57fa6dabcc810d0fb
-
memory/684-211-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-216-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-206-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-201-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-208-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-183-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-210-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-213-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-148-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-203-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-221-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-218-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/684-219-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/960-116-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/960-121-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/1032-86-0x0000000071320000-0x0000000071677000-memory.dmpFilesize
3.3MB
-
memory/1032-85-0x00000000710D0000-0x000000007111C000-memory.dmpFilesize
304KB
-
memory/1040-25-0x00000000710D0000-0x000000007111C000-memory.dmpFilesize
304KB
-
memory/1040-41-0x0000000007A90000-0x0000000007AA1000-memory.dmpFilesize
68KB
-
memory/1040-44-0x0000000007B40000-0x0000000007B5A000-memory.dmpFilesize
104KB
-
memory/1040-45-0x0000000007B60000-0x0000000007B68000-memory.dmpFilesize
32KB
-
memory/1040-48-0x0000000074E60000-0x0000000075611000-memory.dmpFilesize
7.7MB
-
memory/1040-4-0x0000000002FA0000-0x0000000002FD6000-memory.dmpFilesize
216KB
-
memory/1040-5-0x0000000074E60000-0x0000000075611000-memory.dmpFilesize
7.7MB
-
memory/1040-6-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/1040-8-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/1040-7-0x0000000005830000-0x0000000005E5A000-memory.dmpFilesize
6.2MB
-
memory/1040-9-0x00000000055C0000-0x00000000055E2000-memory.dmpFilesize
136KB
-
memory/1040-11-0x0000000005F40000-0x0000000005FA6000-memory.dmpFilesize
408KB
-
memory/1040-42-0x0000000007AE0000-0x0000000007AEE000-memory.dmpFilesize
56KB
-
memory/1040-35-0x00000000078E0000-0x00000000078FE000-memory.dmpFilesize
120KB
-
memory/1040-40-0x0000000007B80000-0x0000000007C16000-memory.dmpFilesize
600KB
-
memory/1040-39-0x0000000007A70000-0x0000000007A7A000-memory.dmpFilesize
40KB
-
memory/1040-10-0x0000000005ED0000-0x0000000005F36000-memory.dmpFilesize
408KB
-
memory/1040-38-0x0000000007A30000-0x0000000007A4A000-memory.dmpFilesize
104KB
-
memory/1040-20-0x0000000005FB0000-0x0000000006307000-memory.dmpFilesize
3.3MB
-
memory/1040-21-0x0000000006480000-0x000000000649E000-memory.dmpFilesize
120KB
-
memory/1040-43-0x0000000007AF0000-0x0000000007B05000-memory.dmpFilesize
84KB
-
memory/1040-37-0x0000000008070000-0x00000000086EA000-memory.dmpFilesize
6.5MB
-
memory/1040-24-0x0000000007880000-0x00000000078B4000-memory.dmpFilesize
208KB
-
memory/1040-22-0x00000000064B0000-0x00000000064FC000-memory.dmpFilesize
304KB
-
memory/1040-26-0x0000000071260000-0x00000000715B7000-memory.dmpFilesize
3.3MB
-
memory/1040-23-0x0000000006A20000-0x0000000006A66000-memory.dmpFilesize
280KB
-
memory/1040-36-0x0000000007900000-0x00000000079A4000-memory.dmpFilesize
656KB
-
memory/1072-184-0x0000000070FF0000-0x000000007103C000-memory.dmpFilesize
304KB
-
memory/1072-185-0x0000000071170000-0x00000000714C7000-memory.dmpFilesize
3.3MB
-
memory/1380-104-0x0000000005C70000-0x0000000005FC7000-memory.dmpFilesize
3.3MB
-
memory/1380-106-0x00000000710D0000-0x000000007111C000-memory.dmpFilesize
304KB
-
memory/1380-107-0x0000000071250000-0x00000000715A7000-memory.dmpFilesize
3.3MB
-
memory/1420-170-0x0000000007AD0000-0x0000000007B74000-memory.dmpFilesize
656KB
-
memory/1420-159-0x0000000006860000-0x00000000068AC000-memory.dmpFilesize
304KB
-
memory/1420-161-0x0000000071170000-0x00000000714C7000-memory.dmpFilesize
3.3MB
-
memory/1420-171-0x0000000007E10000-0x0000000007E21000-memory.dmpFilesize
68KB
-
memory/1420-172-0x00000000061E0000-0x00000000061F5000-memory.dmpFilesize
84KB
-
memory/1420-157-0x00000000064A0000-0x00000000067F7000-memory.dmpFilesize
3.3MB
-
memory/1420-160-0x0000000070FF0000-0x000000007103C000-memory.dmpFilesize
304KB
-
memory/2248-134-0x00000000710D0000-0x000000007111C000-memory.dmpFilesize
304KB
-
memory/2248-135-0x0000000071250000-0x00000000715A7000-memory.dmpFilesize
3.3MB
-
memory/2892-60-0x0000000071320000-0x0000000071677000-memory.dmpFilesize
3.3MB
-
memory/2892-71-0x0000000007160000-0x0000000007175000-memory.dmpFilesize
84KB
-
memory/2892-70-0x0000000007110000-0x0000000007121000-memory.dmpFilesize
68KB
-
memory/2892-69-0x0000000006DC0000-0x0000000006E64000-memory.dmpFilesize
656KB
-
memory/2892-59-0x00000000710D0000-0x000000007111C000-memory.dmpFilesize
304KB
-
memory/2892-58-0x0000000005680000-0x00000000059D7000-memory.dmpFilesize
3.3MB
-
memory/4304-117-0x00000000046F0000-0x0000000004AF6000-memory.dmpFilesize
4.0MB
-
memory/4304-1-0x00000000046F0000-0x0000000004AF6000-memory.dmpFilesize
4.0MB
-
memory/4304-74-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/4304-145-0x0000000006D30000-0x000000000761B000-memory.dmpFilesize
8.9MB
-
memory/4304-3-0x0000000000400000-0x000000000441C000-memory.dmpFilesize
64.1MB
-
memory/4304-2-0x0000000006D30000-0x000000000761B000-memory.dmpFilesize
8.9MB