Analysis
-
max time kernel
140s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 08:32
Static task
static1
Behavioral task
behavioral1
Sample
c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe
Resource
win10v2004-20240226-en
General
-
Target
c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe
-
Size
4.1MB
-
MD5
e0db9f95bae4d1209d6389fbee946f3a
-
SHA1
752abe4504a0a5e96b12e1ae4981d2eeb2032b92
-
SHA256
c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc
-
SHA512
a22973b36aa5b991c36a7ff8a4fe8f1c64de5d4e6ccec87aa785ba6fd1c03154530d53fdc94e450ec6845eb1171b44ef89a380fd630c0e2520c11e5fa5025a62
-
SSDEEP
98304:RBrcvoQ3bpeAYFyI5s2iXAaDVcYvvxcUB482tlsgYA74z:RBQ8JjsJRJcupcUK8wlX7k
Malware Config
Signatures
-
Glupteba payload 13 IoCs
Processes:
resource yara_rule behavioral1/memory/2148-2-0x00000000050F0000-0x00000000059DB000-memory.dmp family_glupteba behavioral1/memory/2148-3-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba behavioral1/memory/2148-4-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba behavioral1/memory/2148-24-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba behavioral1/memory/2148-33-0x00000000050F0000-0x00000000059DB000-memory.dmp family_glupteba behavioral1/memory/2148-50-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba behavioral1/memory/2148-58-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba behavioral1/memory/1968-84-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba behavioral1/memory/1968-133-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba behavioral1/memory/1968-140-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba behavioral1/memory/1956-171-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba behavioral1/memory/1956-222-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba behavioral1/memory/1956-230-0x0000000000400000-0x0000000002EDF000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 5016 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 1956 csrss.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe -
Drops file in Windows directory 2 IoCs
Processes:
c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exedescription ioc process File opened for modification C:\Windows\rss c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe File created C:\Windows\rss\csrss.exe c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1064 schtasks.exe 1600 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exec522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
powershell.exec522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exepowershell.exec522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1516 powershell.exe 1516 powershell.exe 2148 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 2148 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 2716 powershell.exe 2716 powershell.exe 2716 powershell.exe 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe 3972 powershell.exe 3972 powershell.exe 3972 powershell.exe 4748 powershell.exe 4748 powershell.exe 4748 powershell.exe 4608 powershell.exe 4608 powershell.exe 4404 powershell.exe 4404 powershell.exe 1136 powershell.exe 1136 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exec522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1516 powershell.exe Token: SeDebugPrivilege 2148 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Token: SeImpersonatePrivilege 2148 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe Token: SeDebugPrivilege 2716 powershell.exe Token: SeDebugPrivilege 3972 powershell.exe Token: SeDebugPrivilege 4748 powershell.exe Token: SeDebugPrivilege 4608 powershell.exe Token: SeDebugPrivilege 4404 powershell.exe Token: SeDebugPrivilege 1136 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exec522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.execmd.execsrss.exedescription pid process target process PID 2148 wrote to memory of 1516 2148 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 2148 wrote to memory of 1516 2148 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 2148 wrote to memory of 1516 2148 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 1968 wrote to memory of 2716 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 1968 wrote to memory of 2716 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 1968 wrote to memory of 2716 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 1968 wrote to memory of 1964 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe cmd.exe PID 1968 wrote to memory of 1964 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe cmd.exe PID 1964 wrote to memory of 5016 1964 cmd.exe netsh.exe PID 1964 wrote to memory of 5016 1964 cmd.exe netsh.exe PID 1968 wrote to memory of 3972 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 1968 wrote to memory of 3972 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 1968 wrote to memory of 3972 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 1968 wrote to memory of 4748 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 1968 wrote to memory of 4748 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 1968 wrote to memory of 4748 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe powershell.exe PID 1968 wrote to memory of 1956 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe csrss.exe PID 1968 wrote to memory of 1956 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe csrss.exe PID 1968 wrote to memory of 1956 1968 c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe csrss.exe PID 1956 wrote to memory of 4608 1956 csrss.exe powershell.exe PID 1956 wrote to memory of 4608 1956 csrss.exe powershell.exe PID 1956 wrote to memory of 4608 1956 csrss.exe powershell.exe PID 1956 wrote to memory of 4404 1956 csrss.exe powershell.exe PID 1956 wrote to memory of 4404 1956 csrss.exe powershell.exe PID 1956 wrote to memory of 4404 1956 csrss.exe powershell.exe PID 1956 wrote to memory of 1136 1956 csrss.exe powershell.exe PID 1956 wrote to memory of 1136 1956 csrss.exe powershell.exe PID 1956 wrote to memory of 1136 1956 csrss.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe"C:\Users\Admin\AppData\Local\Temp\c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe"C:\Users\Admin\AppData\Local\Temp\c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_msljhhfb.zd3.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5565f9b59dfadb98a4e4f7232a3325752
SHA106f7b09b966c73fa227fb2b41f0780d3b9f7dc9c
SHA256febc38ae3eb14a043df5e2b9a3f899b76fbc90ac6854df57db1d6c3af095a41e
SHA512bac9a8c5c9ea90d57ba89fe5285168abea235534fc609f11258a9745d8bd68c7b0552492590eb95627d5a0507fa5f5d5e1357b41df6183925a2dc0f8c54d2b14
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5ed205ae7417972c23c37f175b55275a3
SHA1682941683921abaa83c5f18a22881033377081e8
SHA2567ad2189cab22b6268a58dfe66da2591b3ed5da1e32419ee4606f8ae8f53a0d3b
SHA512d0a4480202c202c27af340b42bd40dc0d2a767e33c856ce6d7b21830c7cb304ba9b4eca49068a5e94bdfb8bd6e65cad4ff1d66e92e345dd310d95aa08a7d48de
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5378ce3a7be3375cf0deac03f097cbb05
SHA1c6b1ac44f862fc20f3cf9eaa0f0e8ded0931272a
SHA25639269849a9dda55c418e755e93a78a005d0558021f4466789543671be10f6346
SHA5121dafa27b199affa398b2fd260e2db58e6e482bdffd5c7ef5be00db4006b98ab3d9035ad8d113e9a421c41b62811b95ac4152b19899c7f4a62eaa10e76fec5454
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD596ff6ff15de0b0716f7caece189a4104
SHA1c83a53e61af5a97091686ffa1cb2f1831e872fe3
SHA256a5c22f50e0c22472dbd20dad9e7263be9c6aa923395144465b954225cf35e41e
SHA512527f4f0c853a664570fbbc566fc83df4e46994d251e4c384c75e230881db85c8aae0a83730dea4fca40d53be609b2c706a64e79b136d040f013d9bfd9815e157
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD53134e061c0d43d8b71a07ce49bd9bac0
SHA17f3aad1fc29d8d280bacee7787a13064e39d364f
SHA256204f9d3ffa176992f05d3f492302317c16934b4049c2865c08d69a72cc6570d9
SHA5121ea517169ab3b8f8e9c1d12d4525ab888f9d616eca2965e3db414e8bf525a7441f0e7ed321b62ebf1498d98dfc5313dd2ca6252ae08cbe52e26229b6f35ac43f
-
C:\Windows\rss\csrss.exeFilesize
4.1MB
MD5e0db9f95bae4d1209d6389fbee946f3a
SHA1752abe4504a0a5e96b12e1ae4981d2eeb2032b92
SHA256c522ec7d500b7eff8ae4a1b046b951e40a4efa2c994049b09861560f306aeabc
SHA512a22973b36aa5b991c36a7ff8a4fe8f1c64de5d4e6ccec87aa785ba6fd1c03154530d53fdc94e450ec6845eb1171b44ef89a380fd630c0e2520c11e5fa5025a62
-
memory/1136-209-0x00000000053C0000-0x0000000005714000-memory.dmpFilesize
3.3MB
-
memory/1136-212-0x0000000070B20000-0x0000000070E74000-memory.dmpFilesize
3.3MB
-
memory/1136-211-0x0000000070360000-0x00000000703AC000-memory.dmpFilesize
304KB
-
memory/1516-46-0x0000000007670000-0x0000000007713000-memory.dmpFilesize
652KB
-
memory/1516-51-0x00000000077D0000-0x00000000077DE000-memory.dmpFilesize
56KB
-
memory/1516-5-0x0000000074540000-0x0000000074CF0000-memory.dmpFilesize
7.7MB
-
memory/1516-6-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/1516-25-0x00000000064C0000-0x0000000006504000-memory.dmpFilesize
272KB
-
memory/1516-26-0x0000000002AD0000-0x0000000002AE0000-memory.dmpFilesize
64KB
-
memory/1516-27-0x00000000073E0000-0x0000000007456000-memory.dmpFilesize
472KB
-
memory/1516-28-0x0000000007AE0000-0x000000000815A000-memory.dmpFilesize
6.5MB
-
memory/1516-29-0x0000000007480000-0x000000000749A000-memory.dmpFilesize
104KB
-
memory/1516-7-0x0000000002A90000-0x0000000002AC6000-memory.dmpFilesize
216KB
-
memory/1516-8-0x0000000005220000-0x0000000005848000-memory.dmpFilesize
6.2MB
-
memory/1516-31-0x0000000007630000-0x0000000007662000-memory.dmpFilesize
200KB
-
memory/1516-35-0x0000000070560000-0x00000000708B4000-memory.dmpFilesize
3.3MB
-
memory/1516-34-0x000000007FA40000-0x000000007FA50000-memory.dmpFilesize
64KB
-
memory/1516-32-0x00000000703E0000-0x000000007042C000-memory.dmpFilesize
304KB
-
memory/1516-45-0x00000000075F0000-0x000000000760E000-memory.dmpFilesize
120KB
-
memory/1516-9-0x00000000051D0000-0x00000000051F2000-memory.dmpFilesize
136KB
-
memory/1516-47-0x0000000007740000-0x000000000774A000-memory.dmpFilesize
40KB
-
memory/1516-48-0x0000000007810000-0x00000000078A6000-memory.dmpFilesize
600KB
-
memory/1516-49-0x0000000007790000-0x00000000077A1000-memory.dmpFilesize
68KB
-
memory/1516-10-0x0000000005980000-0x00000000059E6000-memory.dmpFilesize
408KB
-
memory/1516-11-0x00000000059F0000-0x0000000005A56000-memory.dmpFilesize
408KB
-
memory/1516-52-0x00000000077E0000-0x00000000077F4000-memory.dmpFilesize
80KB
-
memory/1516-53-0x00000000078D0000-0x00000000078EA000-memory.dmpFilesize
104KB
-
memory/1516-54-0x00000000078B0000-0x00000000078B8000-memory.dmpFilesize
32KB
-
memory/1516-57-0x0000000074540000-0x0000000074CF0000-memory.dmpFilesize
7.7MB
-
memory/1516-21-0x0000000005CA0000-0x0000000005FF4000-memory.dmpFilesize
3.3MB
-
memory/1516-22-0x00000000060A0000-0x00000000060BE000-memory.dmpFilesize
120KB
-
memory/1516-23-0x0000000006140000-0x000000000618C000-memory.dmpFilesize
304KB
-
memory/1956-171-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/1956-222-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/1956-230-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/1968-133-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/1968-140-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/1968-84-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/2148-50-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/2148-2-0x00000000050F0000-0x00000000059DB000-memory.dmpFilesize
8.9MB
-
memory/2148-33-0x00000000050F0000-0x00000000059DB000-memory.dmpFilesize
8.9MB
-
memory/2148-30-0x0000000003540000-0x0000000003943000-memory.dmpFilesize
4.0MB
-
memory/2148-1-0x0000000003540000-0x0000000003943000-memory.dmpFilesize
4.0MB
-
memory/2148-24-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/2148-4-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/2148-3-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/2148-58-0x0000000000400000-0x0000000002EDF000-memory.dmpFilesize
42.9MB
-
memory/2716-70-0x0000000006440000-0x000000000648C000-memory.dmpFilesize
304KB
-
memory/2716-61-0x0000000005DC0000-0x0000000006114000-memory.dmpFilesize
3.3MB
-
memory/2716-71-0x00000000704E0000-0x000000007052C000-memory.dmpFilesize
304KB
-
memory/2716-72-0x0000000070C80000-0x0000000070FD4000-memory.dmpFilesize
3.3MB
-
memory/2716-82-0x00000000075F0000-0x0000000007693000-memory.dmpFilesize
652KB
-
memory/2716-83-0x00000000078E0000-0x00000000078F1000-memory.dmpFilesize
68KB
-
memory/2716-85-0x0000000007950000-0x0000000007964000-memory.dmpFilesize
80KB
-
memory/3972-100-0x0000000070C80000-0x0000000070FD4000-memory.dmpFilesize
3.3MB
-
memory/3972-99-0x00000000704E0000-0x000000007052C000-memory.dmpFilesize
304KB
-
memory/4404-183-0x0000000005E90000-0x0000000005EDC000-memory.dmpFilesize
304KB
-
memory/4404-197-0x0000000005BE0000-0x0000000005BF4000-memory.dmpFilesize
80KB
-
memory/4404-181-0x0000000005830000-0x0000000005B84000-memory.dmpFilesize
3.3MB
-
memory/4404-196-0x0000000007390000-0x00000000073A1000-memory.dmpFilesize
68KB
-
memory/4404-195-0x0000000007130000-0x00000000071D3000-memory.dmpFilesize
652KB
-
memory/4404-184-0x0000000070360000-0x00000000703AC000-memory.dmpFilesize
304KB
-
memory/4404-185-0x0000000070500000-0x0000000070854000-memory.dmpFilesize
3.3MB
-
memory/4608-169-0x00000000067E0000-0x00000000067F4000-memory.dmpFilesize
80KB
-
memory/4608-168-0x0000000007E10000-0x0000000007E21000-memory.dmpFilesize
68KB
-
memory/4608-167-0x0000000007D10000-0x0000000007DB3000-memory.dmpFilesize
652KB
-
memory/4608-157-0x00000000705C0000-0x0000000070914000-memory.dmpFilesize
3.3MB
-
memory/4608-155-0x0000000070440000-0x000000007048C000-memory.dmpFilesize
304KB
-
memory/4608-154-0x0000000006A50000-0x0000000006A9C000-memory.dmpFilesize
304KB
-
memory/4608-152-0x0000000006440000-0x0000000006794000-memory.dmpFilesize
3.3MB
-
memory/4748-123-0x0000000070C60000-0x0000000070FB4000-memory.dmpFilesize
3.3MB
-
memory/4748-120-0x0000000005740000-0x0000000005A94000-memory.dmpFilesize
3.3MB
-
memory/4748-122-0x00000000704E0000-0x000000007052C000-memory.dmpFilesize
304KB