Malware Analysis Report

2025-06-16 01:58

Sample ID 240509-vcrmkafd44
Target ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003
SHA256 ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003

Threat Level: Known bad

The file ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Checks installed software on the system

Adds Run key to start application

Manipulates WinMonFS driver.

Drops file in System32 directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 16:50

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 16:50

Reported

2024-05-09 16:53

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2842 = "Saratov Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3528 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3528 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3528 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 716 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\system32\cmd.exe
PID 1656 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\system32\cmd.exe
PID 3632 wrote to memory of 4224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3632 wrote to memory of 4224 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1656 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 4016 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 4788 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1656 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\rss\csrss.exe
PID 1656 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\rss\csrss.exe
PID 1656 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\rss\csrss.exe
PID 5092 wrote to memory of 2108 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 2108 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 2108 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 2420 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 2420 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 2420 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 4204 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 4204 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 4204 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5092 wrote to memory of 1428 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 5092 wrote to memory of 1428 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4656 wrote to memory of 4784 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4656 wrote to memory of 4784 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4656 wrote to memory of 4784 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4784 wrote to memory of 3340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4784 wrote to memory of 3340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4784 wrote to memory of 3340 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe

"C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe

"C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
BE 88.221.83.240:443 www.bing.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 240.83.221.88.in-addr.arpa udp
BE 88.221.83.240:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 31.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 eb044ade-2d10-4408-82f4-95d69a95df1c.uuid.alldatadump.org udp
US 8.8.8.8:53 stun3.l.google.com udp
US 8.8.8.8:53 server3.alldatadump.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun3.l.google.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server3.alldatadump.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.108:443 server3.alldatadump.org tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.108:443 server3.alldatadump.org tcp
US 8.8.8.8:53 udp

Files

memory/3528-1-0x0000000003180000-0x000000000357E000-memory.dmp

memory/3528-2-0x0000000004F20000-0x000000000580B000-memory.dmp

memory/3528-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2128-4-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

memory/2128-5-0x0000000004BF0000-0x0000000004C26000-memory.dmp

memory/2128-6-0x0000000005260000-0x0000000005888000-memory.dmp

memory/2128-7-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/2128-8-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/2128-11-0x0000000005B30000-0x0000000005B96000-memory.dmp

memory/2128-10-0x0000000005AC0000-0x0000000005B26000-memory.dmp

memory/2128-9-0x00000000051F0000-0x0000000005212000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_inplw4cw.mnl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2128-21-0x0000000005BA0000-0x0000000005EF4000-memory.dmp

memory/2128-23-0x00000000061D0000-0x000000000621C000-memory.dmp

memory/2128-22-0x00000000061B0000-0x00000000061CE000-memory.dmp

memory/2128-24-0x0000000006740000-0x0000000006784000-memory.dmp

memory/2128-25-0x00000000074C0000-0x0000000007536000-memory.dmp

memory/2128-27-0x0000000007560000-0x000000000757A000-memory.dmp

memory/2128-26-0x0000000007BC0000-0x000000000823A000-memory.dmp

memory/2128-29-0x0000000070C80000-0x0000000070CCC000-memory.dmp

memory/2128-28-0x0000000007720000-0x0000000007752000-memory.dmp

memory/2128-41-0x0000000007760000-0x000000000777E000-memory.dmp

memory/2128-42-0x0000000007780000-0x0000000007823000-memory.dmp

memory/2128-43-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/2128-31-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/2128-30-0x0000000071380000-0x00000000716D4000-memory.dmp

memory/2128-44-0x0000000007870000-0x000000000787A000-memory.dmp

memory/2128-45-0x0000000007930000-0x00000000079C6000-memory.dmp

memory/2128-46-0x0000000007890000-0x00000000078A1000-memory.dmp

memory/2128-48-0x00000000078E0000-0x00000000078F4000-memory.dmp

memory/2128-47-0x00000000078D0000-0x00000000078DE000-memory.dmp

memory/2128-49-0x00000000079D0000-0x00000000079EA000-memory.dmp

memory/2128-50-0x0000000007910000-0x0000000007918000-memory.dmp

memory/2128-53-0x0000000074DE0000-0x0000000075590000-memory.dmp

memory/3528-55-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/3528-56-0x0000000003180000-0x000000000357E000-memory.dmp

memory/3528-57-0x0000000004F20000-0x000000000580B000-memory.dmp

memory/716-67-0x00000000058D0000-0x0000000005C24000-memory.dmp

memory/716-68-0x0000000070C80000-0x0000000070CCC000-memory.dmp

memory/716-69-0x0000000071420000-0x0000000071774000-memory.dmp

memory/716-79-0x0000000007130000-0x00000000071D3000-memory.dmp

memory/716-80-0x0000000007440000-0x0000000007451000-memory.dmp

memory/716-81-0x0000000007490000-0x00000000074A4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4016-85-0x0000000005520000-0x0000000005874000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a1daf7b7d1cb183a5c6d7b0bd41b1267
SHA1 fd9b27ecd975e1705f174b663fc8d674ce9ae10d
SHA256 ed0d94e6431783ef5c7ea9f98197368fdf618aef3c0d76adbd31a95dfb7e25e7
SHA512 46685ef6dc95b26fc2c73870057fa14be3f746f32ace005c73f59c81a83620db5d61f540fffbf11e192a76fe21e8bfa032aa19e67e25aa5388f91d74e2ebf59d

memory/3528-98-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1656-97-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/4016-99-0x0000000070C80000-0x0000000070CCC000-memory.dmp

memory/4016-100-0x0000000071400000-0x0000000071754000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f440cc8d381ea7a56925d3f1399c2869
SHA1 ae4ad9555ef3dbb912b7fae94d626747a225856a
SHA256 68a3b3326f6e9ea697f9cb421db955e3c0248efe1c915ab7671dff2dc3916534
SHA512 6c2b04f8713f02097d5d163e9bfc6dd17640aaa86e96a0d221d53d914192c3709d7227ae0f298eb85a51101a7fe31cd33b450b642b76398676869ccfe2d2ced3

memory/4788-121-0x0000000070C80000-0x0000000070CCC000-memory.dmp

memory/4788-122-0x0000000071420000-0x0000000071774000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 71a7eb12dad2372dc64f6549ef333883
SHA1 7fb77158b157866598a0b7d42d9a161f0dcb55a8
SHA256 ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003
SHA512 a903a469f4d3d3e4997a13b9ad5484978b3e91b5dce057a0115df6bafc5d33c7caf0ef77d192c09748440ccaf5f2d9e2528d7858662533b1ecd03b8eea1ea7b0

memory/1656-139-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/2108-149-0x0000000005D40000-0x0000000006094000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 53a875ccde8c4415a7244bb8c73c3001
SHA1 0eceb8b3864f89f91d8df27b8ab9ed4bc00072a5
SHA256 bb1c59eda6b51720d4135cf2dba6008ebc21e4d2a7cd0b4968beefa840c3fd92
SHA512 d9af3586ffb6e6733dc3f492952e3fae291c6cf6b2a87c5b2386ba23e1b100d459593aae65996055fe405f6ef3be8b2089e56a5fbaa236987148e9f70dd56df5

memory/2108-151-0x0000000070C80000-0x0000000070CCC000-memory.dmp

memory/2108-152-0x0000000070E00000-0x0000000071154000-memory.dmp

memory/2420-169-0x0000000005910000-0x0000000005C64000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b67de4094a52f7dab5f774663d2bb2e5
SHA1 8f8dc8a5c9493580c5b7190167165a1752e4df5c
SHA256 c70a1cf0f2825ee354b4c00afe949666809059968098ee0c65c26b36b1025958
SHA512 857050627b2e3f26c720564a12e360a03b9bdfe39541aa36c3bd7847269b301f62f15ed17151f1cc1d478eff5b2416e56d8e3b3d653dde153bba854ac4025b81

memory/2420-174-0x0000000006000000-0x000000000604C000-memory.dmp

memory/2420-175-0x0000000070BA0000-0x0000000070BEC000-memory.dmp

memory/2420-176-0x0000000071330000-0x0000000071684000-memory.dmp

memory/2420-186-0x00000000071D0000-0x0000000007273000-memory.dmp

memory/2420-187-0x0000000007550000-0x0000000007561000-memory.dmp

memory/2420-188-0x0000000005DD0000-0x0000000005DE4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 90f49ae2db295977eb29880b083f8cf8
SHA1 b2132059d6c8ef4defc01544fa622e38a184acd8
SHA256 b2ef9434ae213365807f00522c260673c1c5187b35e50321f25caaf9558ca121
SHA512 49a61f5bca776fa01f4908c7595d0d52ff4b5e869748955bdbf0bcb23a53aba602c0c7652d05a130d951274ec2deee870dcc10deeef22e9ea66bb13811e3b6cf

memory/4204-202-0x0000000070BA0000-0x0000000070BEC000-memory.dmp

memory/4204-203-0x0000000071330000-0x0000000071684000-memory.dmp

memory/5092-214-0x0000000000400000-0x0000000002ED6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4656-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4656-230-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3596-229-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/5092-231-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/3596-235-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/5092-234-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/5092-238-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/3596-243-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/5092-242-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/5092-246-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/5092-250-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/5092-254-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/5092-258-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/5092-262-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/5092-267-0x0000000000400000-0x0000000002ED6000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 16:50

Reported

2024-05-09 16:53

Platform

win11-20240508-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2024 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2024 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2024 wrote to memory of 852 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4716 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\system32\cmd.exe
PID 4528 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\system32\cmd.exe
PID 1604 wrote to memory of 3424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1604 wrote to memory of 3424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4528 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4600 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 4064 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4528 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\rss\csrss.exe
PID 4528 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\rss\csrss.exe
PID 4528 wrote to memory of 3816 N/A C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe C:\Windows\rss\csrss.exe
PID 3816 wrote to memory of 3340 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3816 wrote to memory of 3340 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3816 wrote to memory of 3340 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3816 wrote to memory of 4108 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3816 wrote to memory of 4108 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3816 wrote to memory of 4108 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3816 wrote to memory of 3912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3816 wrote to memory of 3912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3816 wrote to memory of 3912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3816 wrote to memory of 3432 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3816 wrote to memory of 3432 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1224 wrote to memory of 4060 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 4060 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1224 wrote to memory of 4060 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4060 wrote to memory of 4716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4060 wrote to memory of 4716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4060 wrote to memory of 4716 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe

"C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe

"C:\Users\Admin\AppData\Local\Temp\ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 79a33fcd-37ca-4dc6-8386-7df939542a6a.uuid.alldatadump.org udp
US 8.8.8.8:53 server7.alldatadump.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun3.l.google.com udp
BG 185.82.216.108:443 server7.alldatadump.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.108:443 server7.alldatadump.org tcp
BG 185.82.216.108:443 server7.alldatadump.org tcp

Files

memory/2024-1-0x0000000003370000-0x0000000003776000-memory.dmp

memory/2024-2-0x0000000005020000-0x000000000590B000-memory.dmp

memory/2024-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/852-4-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

memory/852-5-0x0000000002E60000-0x0000000002E96000-memory.dmp

memory/852-6-0x00000000055F0000-0x0000000005C1A000-memory.dmp

memory/852-7-0x0000000074CE0000-0x0000000075491000-memory.dmp

memory/852-8-0x00000000054A0000-0x00000000054C2000-memory.dmp

memory/852-10-0x0000000005D90000-0x0000000005DF6000-memory.dmp

memory/852-9-0x0000000005D20000-0x0000000005D86000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_krugz2cz.mjz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/852-19-0x0000000074CE0000-0x0000000075491000-memory.dmp

memory/852-20-0x0000000005E00000-0x0000000006157000-memory.dmp

memory/852-21-0x00000000062F0000-0x000000000630E000-memory.dmp

memory/852-22-0x0000000006330000-0x000000000637C000-memory.dmp

memory/852-23-0x0000000006880000-0x00000000068C6000-memory.dmp

memory/852-24-0x0000000007710000-0x0000000007744000-memory.dmp

memory/852-25-0x0000000070F50000-0x0000000070F9C000-memory.dmp

memory/852-26-0x0000000071160000-0x00000000714B7000-memory.dmp

memory/852-35-0x0000000007750000-0x000000000776E000-memory.dmp

memory/852-36-0x0000000007770000-0x0000000007814000-memory.dmp

memory/852-37-0x0000000007EE0000-0x000000000855A000-memory.dmp

memory/852-38-0x0000000007890000-0x00000000078AA000-memory.dmp

memory/852-40-0x00000000078D0000-0x00000000078DA000-memory.dmp

memory/852-41-0x0000000007990000-0x0000000007A26000-memory.dmp

memory/2024-39-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/852-42-0x0000000007900000-0x0000000007911000-memory.dmp

memory/852-43-0x0000000007940000-0x000000000794E000-memory.dmp

memory/852-44-0x0000000007950000-0x0000000007965000-memory.dmp

memory/852-45-0x0000000007A50000-0x0000000007A6A000-memory.dmp

memory/852-46-0x0000000007A30000-0x0000000007A38000-memory.dmp

memory/852-49-0x0000000074CE0000-0x0000000075491000-memory.dmp

memory/2024-51-0x0000000003370000-0x0000000003776000-memory.dmp

memory/2024-53-0x0000000005020000-0x000000000590B000-memory.dmp

memory/2024-52-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/4716-62-0x0000000005620000-0x0000000005977000-memory.dmp

memory/4716-63-0x0000000070F50000-0x0000000070F9C000-memory.dmp

memory/4716-64-0x00000000710F0000-0x0000000071447000-memory.dmp

memory/4716-73-0x0000000006CC0000-0x0000000006D64000-memory.dmp

memory/4716-74-0x0000000006FF0000-0x0000000007001000-memory.dmp

memory/4716-75-0x0000000007040000-0x0000000007055000-memory.dmp

memory/2024-77-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4528-76-0x0000000000400000-0x0000000002ED6000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/4600-81-0x0000000005CA0000-0x0000000005FF7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 956418236e9869839d70274a37accb9e
SHA1 62f485221bbdd7784fde5bbf6bf7b28dbb8f8c6e
SHA256 0b1f05a41aac685097866e12988e839cc0aaef9c518894c04a15e88d2cb35681
SHA512 155119587efadc53514748408781c19ae62b48979a5d0fd6006aec6cffd0ff2fdb2d3e41ae771a6530a98910c4376e34fdcb135462f4c2d941d6ba51c39cb68f

memory/4600-91-0x0000000070F50000-0x0000000070F9C000-memory.dmp

memory/4600-92-0x00000000711A0000-0x00000000714F7000-memory.dmp

memory/4064-110-0x0000000005D20000-0x0000000006077000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e385447ab3d3a6c3121d0272da131576
SHA1 14f2825372590487f82038021a3467284511f35f
SHA256 83678168c97bc3daa54ff658149d46c7c9a4280a98263ce7223430435de4dda3
SHA512 ea521cebc85ddf7db12a6bb5dc39646e0734b622d164adf969e84052568811480c3a9cd6fd3728b58a1a5520916947eea86b6f0581ffe48bd9a8cb17a18c7333

memory/4064-112-0x0000000070F50000-0x0000000070F9C000-memory.dmp

memory/4064-113-0x00000000710D0000-0x0000000071427000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 71a7eb12dad2372dc64f6549ef333883
SHA1 7fb77158b157866598a0b7d42d9a161f0dcb55a8
SHA256 ab7dd508e16a2a78100f71ba00c1942f84481997bf21f4988866b1596cb37003
SHA512 a903a469f4d3d3e4997a13b9ad5484978b3e91b5dce057a0115df6bafc5d33c7caf0ef77d192c09748440ccaf5f2d9e2528d7858662533b1ecd03b8eea1ea7b0

memory/4528-129-0x0000000000400000-0x0000000002ED6000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 cbb861194a66fda03946301487ef26a4
SHA1 2ba708dd0cd053da1276e917eb2aea6322ebcc58
SHA256 712a0e93ca51a822ae6a0b0c62ba0c4512c5bb284d5cb693db8f1a7f5b038746
SHA512 bacd91ac9d721ece1a4df197ccba78c90be6ae2c8fe39ba0f8183467f3edf4da380a9004621fdf2ce2c25c60e1f712fc51cce76670ffebf284b03397790b76b4

memory/3340-140-0x0000000070F50000-0x0000000070F9C000-memory.dmp

memory/3340-141-0x00000000710D0000-0x0000000071427000-memory.dmp

memory/4108-160-0x0000000005760000-0x0000000005AB7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8b8fa3da5feccc94592f57e8843dcbbd
SHA1 7f078a758fb700f6ffc39e2b2cd0c96359b4d164
SHA256 2bbddcdc9367fd01506ed56cef3a741330e5acb2ca9184d7fa3ac96ce8474be3
SHA512 3864de389efc8700dfc60bd53893b0a820e1e7e9dd4d1d4e2d17f76692a5b1dd0b632a0c1db161c93f2489fc848397eff7a4d0ed6511d146b11b6a225f8245d0

memory/4108-162-0x0000000006180000-0x00000000061CC000-memory.dmp

memory/4108-164-0x0000000070FF0000-0x0000000071347000-memory.dmp

memory/4108-163-0x0000000070E70000-0x0000000070EBC000-memory.dmp

memory/4108-173-0x0000000006EC0000-0x0000000006F64000-memory.dmp

memory/4108-174-0x00000000071F0000-0x0000000007201000-memory.dmp

memory/4108-175-0x00000000056C0000-0x00000000056D5000-memory.dmp

memory/3912-185-0x0000000005CD0000-0x0000000006027000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4158e65a4ad9c469094c557d2ce16f2a
SHA1 2dd0c4e7014bbff0acb9da77dc39cb89cf73f112
SHA256 640be0f9210f6a6c5fcecab7ab363f7e87175e4f608143bdeee7aedf13c860ac
SHA512 a68622465837a90a9ae7d85a28d947d5e50dec6b1dce7db7e215d78c61a15a970032debf72d34a35c87f14883fa98466fb48d3822b7a9b3ad6db2a0e6182389a

memory/3912-187-0x0000000070E70000-0x0000000070EBC000-memory.dmp

memory/3912-188-0x0000000071010000-0x0000000071367000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3816-205-0x0000000000400000-0x0000000002ED6000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1224-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1224-214-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3816-216-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/1136-220-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3816-219-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/3816-222-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/1136-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3816-226-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/3816-232-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/3816-235-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/3816-239-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/3816-242-0x0000000000400000-0x0000000002ED6000-memory.dmp

memory/3816-248-0x0000000000400000-0x0000000002ED6000-memory.dmp