Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 04:48
Static task
static1
Behavioral task
behavioral1
Sample
6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe
Resource
win10v2004-20240226-en
General
-
Target
6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe
-
Size
4.1MB
-
MD5
b068b5a5ee8be4de86f67b5c2b5bf5d5
-
SHA1
5e18f8587e2f0dcb60b7b8da2ba34b322dc3a101
-
SHA256
6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e
-
SHA512
bcedd5ef88e873b4273b6d5938854655006866f8fdcfcea0f845c2ce7dc6582b1787a5f4b668ae9e7bc09c73d1e574dc2bfe5d46a24cd7b8d62e8dd3ed2c7cc7
-
SSDEEP
98304:gmt2HMNzbl5vG6exEEj3um3jyNJdQ91UKr1D7kBRa7m:gmt2Hsbl5vMradQvtZvri
Malware Config
Signatures
-
Glupteba payload 11 IoCs
resource yara_rule behavioral1/memory/3352-2-0x0000000005220000-0x0000000005B0B000-memory.dmp family_glupteba behavioral1/memory/3352-3-0x0000000000400000-0x0000000002ED3000-memory.dmp family_glupteba behavioral1/memory/3352-4-0x0000000000400000-0x0000000002ED3000-memory.dmp family_glupteba behavioral1/memory/3352-5-0x0000000000400000-0x0000000002ED3000-memory.dmp family_glupteba behavioral1/memory/3352-27-0x0000000005220000-0x0000000005B0B000-memory.dmp family_glupteba behavioral1/memory/3352-53-0x0000000000400000-0x0000000002ED3000-memory.dmp family_glupteba behavioral1/memory/3352-61-0x0000000000400000-0x0000000002ED3000-memory.dmp family_glupteba behavioral1/memory/1536-74-0x0000000000400000-0x0000000002ED3000-memory.dmp family_glupteba behavioral1/memory/1536-91-0x0000000000400000-0x0000000002ED3000-memory.dmp family_glupteba behavioral1/memory/1536-137-0x0000000000400000-0x0000000002ED3000-memory.dmp family_glupteba behavioral1/memory/1536-142-0x0000000000400000-0x0000000002ED3000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5080 netsh.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5040 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
pid Process 2528 powershell.exe 2528 powershell.exe 2528 powershell.exe 3352 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 3352 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 3872 powershell.exe 3872 powershell.exe 3872 powershell.exe 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 1188 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2528 powershell.exe Token: SeDebugPrivilege 3352 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Token: SeImpersonatePrivilege 3352 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeDebugPrivilege 1188 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3352 wrote to memory of 2528 3352 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 99 PID 3352 wrote to memory of 2528 3352 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 99 PID 3352 wrote to memory of 2528 3352 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 99 PID 1536 wrote to memory of 3872 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 104 PID 1536 wrote to memory of 3872 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 104 PID 1536 wrote to memory of 3872 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 104 PID 1536 wrote to memory of 3400 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 106 PID 1536 wrote to memory of 3400 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 106 PID 3400 wrote to memory of 5080 3400 cmd.exe 108 PID 3400 wrote to memory of 5080 3400 cmd.exe 108 PID 1536 wrote to memory of 1188 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 109 PID 1536 wrote to memory of 1188 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 109 PID 1536 wrote to memory of 1188 1536 6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe"C:\Users\Admin\AppData\Local\Temp\6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Users\Admin\AppData\Local\Temp\6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe"C:\Users\Admin\AppData\Local\Temp\6cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e.exe"2⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:5080
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1188
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵PID:3788
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵PID:1928
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:2196
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:5040
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4996
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵PID:1740
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:81⤵PID:3612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD501d7efed29a5ccbb6a10166cc11de6e8
SHA1cab285821e81a4a8b7fd1367ee8a827c6ce68636
SHA2568fd35e8a0feedad5ba67f6c6c72cfc0a3edd0a7e31dd86e668b619c9ecc5ca81
SHA51219745277b76ea8e8da1c4ddf01bca3c2bb07876f2de9ee042f8c26ec505786804f89448929bb26ed0ce49847eaf9da78909d4937fe0e8bb4ccb550ff67c97028
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD560d4979368543a3ca6057f067e147ec2
SHA1cee1cd2f33e942443ff4e64e1105ac950a880ab3
SHA2567f390737470c3b68a3474ce275a050e96f735f703498ca92927dfdb5b43db0c4
SHA512f4d90bbe0475c1dc0bfce456595b111888076897e170f58460a7c58aebb35b4fe5d8b9b3a87d0d08822548bff97e0420165f69e5c8c147ffa72bcde273bf7bd4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD50cf36fff81b621f7ce48c707e8e40e49
SHA125cd5557713acf28195024a729913e28659631f2
SHA256f8f9cbcc0e933b42d8b96dacf1ec13846f30fa15c7bec8cf4576703779fe53aa
SHA5120c5ee54e339486967ad9f2d7e63604171b004f7abda187e8550175369287f86254dd1678f8f03b29b58810e411d70a76b85d4877e387be1cfe4d9238af697d63
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD50f776c4e3dedef2d7b054de5d0a0ce3a
SHA1a668775b6d6e2acd192acaa0f4de5b3c01b9db1b
SHA2561f8d9730c64d85943c65616464f40e16ddfe0d4986f61c8b52eb7e5d4e248613
SHA512d6a5e5d3a90c995ce2f9ff658360f895e766dbbdc5eee7a9e7b9c77bd94391fb203f8c1bba0e53ac71892232074549e429feaa6ba53a57e1b9c5ffdd66e33faa
-
Filesize
4.1MB
MD5b068b5a5ee8be4de86f67b5c2b5bf5d5
SHA15e18f8587e2f0dcb60b7b8da2ba34b322dc3a101
SHA2566cfa7bcedd6d520680771a1c26ace9e12c0d1756d0409353a1ee084d73e0b96e
SHA512bcedd5ef88e873b4273b6d5938854655006866f8fdcfcea0f845c2ce7dc6582b1787a5f4b668ae9e7bc09c73d1e574dc2bfe5d46a24cd7b8d62e8dd3ed2c7cc7