Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe
Resource
win10v2004-20240508-en
General
-
Target
9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe
-
Size
4.1MB
-
MD5
c41b21fe2fcb66071f624818a895b90d
-
SHA1
4ae8a24c25e5503293b5ea66edb6b1cae9223931
-
SHA256
9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889
-
SHA512
93ac9c73fa73248f07e52780dfff02d34d69044d9a6035f75818783c574595ce904b1bfac9129810638c92cc8bda1d576349825d7d17005e254306338835f8b2
-
SSDEEP
98304:xF6ieDB4Q2OtKb6TlvzLX19wqsRLeMbc4b5st3+vVhNu642TN:f6ZBzRtxlbPwqsRHvV2Mp
Malware Config
Signatures
-
Glupteba payload 18 IoCs
resource yara_rule behavioral1/memory/1424-2-0x0000000004F90000-0x000000000587B000-memory.dmp family_glupteba behavioral1/memory/1424-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1424-4-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/1424-55-0x0000000004F90000-0x000000000587B000-memory.dmp family_glupteba behavioral1/memory/1424-57-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1424-54-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/3672-82-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/3672-136-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/4372-220-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/4372-231-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/4372-233-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/4372-237-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/4372-240-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/4372-243-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/4372-245-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/4372-249-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/4372-252-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba behavioral1/memory/4372-255-0x0000000000400000-0x0000000002EE2000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3520 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 4372 csrss.exe 2948 injector.exe 1592 windefender.exe 3624 windefender.exe -
resource yara_rule behavioral1/files/0x000900000002338b-224.dat upx behavioral1/memory/1592-225-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3624-228-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1592-230-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3624-234-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/3624-239-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe File created C:\Windows\rss\csrss.exe 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe File created C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2480 sc.exe -
pid Process 1688 powershell.exe 2592 powershell.exe 3084 powershell.exe 3368 powershell.exe 3928 powershell.exe 3692 powershell.exe 4468 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1244 schtasks.exe 2884 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-42 = "E. South America Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-492 = "India Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3084 powershell.exe 3084 powershell.exe 1424 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 1424 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3368 powershell.exe 3368 powershell.exe 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 3928 powershell.exe 3928 powershell.exe 3692 powershell.exe 3692 powershell.exe 4468 powershell.exe 4468 powershell.exe 1688 powershell.exe 1688 powershell.exe 2592 powershell.exe 2592 powershell.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 4372 csrss.exe 4372 csrss.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 4372 csrss.exe 4372 csrss.exe 2948 injector.exe 2948 injector.exe 4372 csrss.exe 4372 csrss.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe 2948 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 3084 powershell.exe Token: SeDebugPrivilege 1424 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Token: SeImpersonatePrivilege 1424 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe Token: SeDebugPrivilege 3368 powershell.exe Token: SeDebugPrivilege 3928 powershell.exe Token: SeDebugPrivilege 3692 powershell.exe Token: SeDebugPrivilege 4468 powershell.exe Token: SeDebugPrivilege 1688 powershell.exe Token: SeDebugPrivilege 2592 powershell.exe Token: SeSystemEnvironmentPrivilege 4372 csrss.exe Token: SeSecurityPrivilege 2480 sc.exe Token: SeSecurityPrivilege 2480 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1424 wrote to memory of 3084 1424 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 86 PID 1424 wrote to memory of 3084 1424 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 86 PID 1424 wrote to memory of 3084 1424 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 86 PID 3672 wrote to memory of 3368 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 91 PID 3672 wrote to memory of 3368 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 91 PID 3672 wrote to memory of 3368 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 91 PID 3672 wrote to memory of 4384 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 93 PID 3672 wrote to memory of 4384 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 93 PID 4384 wrote to memory of 3520 4384 cmd.exe 95 PID 4384 wrote to memory of 3520 4384 cmd.exe 95 PID 3672 wrote to memory of 3928 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 96 PID 3672 wrote to memory of 3928 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 96 PID 3672 wrote to memory of 3928 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 96 PID 3672 wrote to memory of 3692 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 99 PID 3672 wrote to memory of 3692 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 99 PID 3672 wrote to memory of 3692 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 99 PID 3672 wrote to memory of 4372 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 101 PID 3672 wrote to memory of 4372 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 101 PID 3672 wrote to memory of 4372 3672 9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe 101 PID 4372 wrote to memory of 4468 4372 csrss.exe 102 PID 4372 wrote to memory of 4468 4372 csrss.exe 102 PID 4372 wrote to memory of 4468 4372 csrss.exe 102 PID 4372 wrote to memory of 1688 4372 csrss.exe 107 PID 4372 wrote to memory of 1688 4372 csrss.exe 107 PID 4372 wrote to memory of 1688 4372 csrss.exe 107 PID 4372 wrote to memory of 2592 4372 csrss.exe 110 PID 4372 wrote to memory of 2592 4372 csrss.exe 110 PID 4372 wrote to memory of 2592 4372 csrss.exe 110 PID 4372 wrote to memory of 2948 4372 csrss.exe 112 PID 4372 wrote to memory of 2948 4372 csrss.exe 112 PID 1592 wrote to memory of 3248 1592 windefender.exe 118 PID 1592 wrote to memory of 3248 1592 windefender.exe 118 PID 1592 wrote to memory of 3248 1592 windefender.exe 118 PID 3248 wrote to memory of 2480 3248 cmd.exe 119 PID 3248 wrote to memory of 2480 3248 cmd.exe 119 PID 3248 wrote to memory of 2480 3248 cmd.exe 119 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe"C:\Users\Admin\AppData\Local\Temp\9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084
-
-
C:\Users\Admin\AppData\Local\Temp\9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe"C:\Users\Admin\AppData\Local\Temp\9f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3368
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3520
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3692
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1244
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4324
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2948
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2884
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:3624
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD58d714134d1826d4bb7a4bbd7479701f6
SHA1b1ac4838f95a695d12fc4447077c27df26d66d10
SHA256445e49d00259757025f23917860d707a52827c0aa682cb4cbd18604ec5c1ed67
SHA512ba40d53d570258e0984e375cce395ea2fdf8b1fb3f37c4669bb380c02375ab0cbe022fe80aea4c89c1d55c66150532737b1f845f93fa19a13975001db25b9c7c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD521630dd443d3890de8ef6bc226c6561d
SHA1232670280de63e699df4527aec53a4ed06c675a1
SHA256d235dcc280ac3a48463e6b838c263e170e5f99cf2ed6e5aeb58d78b9c12746b0
SHA512aeae3a92c4b469ddc67f5a5a1d29dd44a060215dff7e3d88e3e494c97d9a4d2521c388a2b69fa6cdde2dd070715558c93f7fa7cdc0ee1648d1407a95eb0559e4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD50012b8794ea70aac523b4385a11276b0
SHA168a6ec6753e9f556f7da08547b0c7625db81f548
SHA2561178688f92e4b4dad07d2c1c06e240838fc0724e7e677ac2d7158a02b4f21c9c
SHA512807fa50466a73b2fd4f24ab0ecd25a8e43386366fa4cdeb7e592b48cc6979e1d9a27c182ced60db6dc7c8e0635736e66e413325bc31250913458567f1d70636e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ea61729138e56261825d351c685cc45a
SHA175c795ac2684d6a5162f1c31fa9332d5d7bfabed
SHA2564caaeb4b7f4891ab554749aa21ac8f46761beea500f8cf955eb7d28496f1e63f
SHA512a6363bb65b6aa9837187ef73be67d28ae11e9a838090092f4d0687a26ab89543f11e52df588a2f963b42de237bc3832f662110a6614a4b0141d417b66b8bf306
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD58d492137fc97c486e8e8edb3cafd2470
SHA16ac40a97787695140ea931e6a6f2b64e13357eb8
SHA256cedec2ceae37ae28f7a7d19ec9b26069e902c276cb5cc76dd6dce50b7d0575d7
SHA512a6c882aca3150648a37f2b0e1171b9680784760b7b04703fd381eb672d575b11d8156a2f52acf83f65a1685de4fc9f0300eb617a8b5866ad1d3d802937da9d3e
-
Filesize
4.1MB
MD5c41b21fe2fcb66071f624818a895b90d
SHA14ae8a24c25e5503293b5ea66edb6b1cae9223931
SHA2569f7ebc42f5976c03c79432e841b67d17a4645bd6c643377d59b4dca09fe04889
SHA51293ac9c73fa73248f07e52780dfff02d34d69044d9a6035f75818783c574595ce904b1bfac9129810638c92cc8bda1d576349825d7d17005e254306338835f8b2
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec