Malware Analysis Report

2025-06-16 01:58

Sample ID 240509-x6hb4adh53
Target dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159
SHA256 dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159

Threat Level: Known bad

The file dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Adds Run key to start application

Manipulates WinMonFS driver.

Checks installed software on the system

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 19:27

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 19:27

Reported

2024-05-09 19:30

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-491 = "India Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3880 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3880 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3880 wrote to memory of 4252 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1776 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1776 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1776 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1776 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\system32\cmd.exe
PID 1776 wrote to memory of 5052 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\system32\cmd.exe
PID 5052 wrote to memory of 3432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5052 wrote to memory of 3432 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1776 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1776 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1776 wrote to memory of 4100 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1776 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1776 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1776 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1776 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\rss\csrss.exe
PID 1776 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\rss\csrss.exe
PID 1776 wrote to memory of 1192 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\rss\csrss.exe
PID 1192 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 3584 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 3584 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 3584 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 3724 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 3724 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 3724 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1192 wrote to memory of 640 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1192 wrote to memory of 640 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3184 wrote to memory of 5020 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3184 wrote to memory of 5020 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3184 wrote to memory of 5020 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5020 wrote to memory of 1012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5020 wrote to memory of 1012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5020 wrote to memory of 1012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe

"C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe

"C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
BE 2.17.196.113:443 www.bing.com tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 113.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 91c43e3b-8f44-418e-badc-3982a702f965.uuid.filesdumpplace.org udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 stun2.l.google.com udp
US 8.8.8.8:53 server7.filesdumpplace.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun2.l.google.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server7.filesdumpplace.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.96:443 server7.filesdumpplace.org tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
BG 185.82.216.96:443 server7.filesdumpplace.org tcp

Files

memory/3880-1-0x0000000003330000-0x000000000372F000-memory.dmp

memory/3880-2-0x00000000050D0000-0x00000000059BB000-memory.dmp

memory/3880-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4252-5-0x000000007455E000-0x000000007455F000-memory.dmp

memory/4252-6-0x0000000004A40000-0x0000000004A76000-memory.dmp

memory/4252-7-0x00000000050B0000-0x00000000056D8000-memory.dmp

memory/4252-8-0x0000000074550000-0x0000000074D00000-memory.dmp

memory/4252-9-0x0000000074550000-0x0000000074D00000-memory.dmp

memory/3880-4-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/4252-10-0x0000000005030000-0x0000000005052000-memory.dmp

memory/4252-11-0x0000000005750000-0x00000000057B6000-memory.dmp

memory/4252-12-0x00000000057C0000-0x0000000005826000-memory.dmp

memory/4252-15-0x00000000059B0000-0x0000000005D04000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yyx4diym.qgf.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4252-23-0x0000000005FE0000-0x0000000005FFE000-memory.dmp

memory/4252-24-0x0000000006010000-0x000000000605C000-memory.dmp

memory/4252-25-0x0000000006590000-0x00000000065D4000-memory.dmp

memory/4252-26-0x0000000007320000-0x0000000007396000-memory.dmp

memory/4252-27-0x0000000007A20000-0x000000000809A000-memory.dmp

memory/4252-28-0x00000000073C0000-0x00000000073DA000-memory.dmp

memory/4252-31-0x0000000070B70000-0x0000000070EC4000-memory.dmp

memory/4252-32-0x0000000074550000-0x0000000074D00000-memory.dmp

memory/4252-30-0x00000000703F0000-0x000000007043C000-memory.dmp

memory/4252-29-0x0000000007570000-0x00000000075A2000-memory.dmp

memory/4252-42-0x00000000075B0000-0x00000000075CE000-memory.dmp

memory/4252-43-0x00000000075D0000-0x0000000007673000-memory.dmp

memory/4252-44-0x0000000074550000-0x0000000074D00000-memory.dmp

memory/4252-45-0x00000000076E0000-0x00000000076EA000-memory.dmp

memory/4252-46-0x00000000077A0000-0x0000000007836000-memory.dmp

memory/4252-47-0x0000000007700000-0x0000000007711000-memory.dmp

memory/4252-48-0x0000000007740000-0x000000000774E000-memory.dmp

memory/4252-49-0x0000000007750000-0x0000000007764000-memory.dmp

memory/4252-50-0x0000000007840000-0x000000000785A000-memory.dmp

memory/4252-51-0x0000000007780000-0x0000000007788000-memory.dmp

memory/4252-54-0x0000000074550000-0x0000000074D00000-memory.dmp

memory/3880-57-0x0000000003330000-0x000000000372F000-memory.dmp

memory/3880-58-0x00000000050D0000-0x00000000059BB000-memory.dmp

memory/3880-56-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/3880-59-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4940-65-0x0000000005570000-0x00000000058C4000-memory.dmp

memory/4940-70-0x00000000703F0000-0x000000007043C000-memory.dmp

memory/4940-71-0x0000000070B90000-0x0000000070EE4000-memory.dmp

memory/4940-81-0x0000000006DE0000-0x0000000006E83000-memory.dmp

memory/4940-82-0x0000000007100000-0x0000000007111000-memory.dmp

memory/1776-83-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/4940-84-0x0000000007150000-0x0000000007164000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/4100-97-0x0000000006330000-0x0000000006684000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 caf35228cc350d96e97a49696c8e3546
SHA1 be19e7fee7c75f12fe008056eb4c970fb61a9615
SHA256 1b4020e6d9500d15d2e2cb82046c180f7bb42ed24d42a6378e21a7df7e2a0454
SHA512 899d78512209f0908ae3ff199f9e6b1789b0cbee4e7e4c9347905c2769ecabb9ea501e481752194f86b88f3bde86d0efb0023056b682427e298debb11e0b7f02

memory/4100-100-0x00000000703F0000-0x000000007043C000-memory.dmp

memory/4100-101-0x0000000070570000-0x00000000708C4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0bd2d63332d45efc63b1db8408673df0
SHA1 7547e77623a1423e4270f5145f09c55070c4a838
SHA256 860edc51b6f20c1a1c9e070e55ebf87a3ab0c5313f69b7e7f340e85009ca8687
SHA512 6cb91820939fef693af0a0a5af9dfb06b1488c2e3b1305a9b37451d4a5d13e00a14d9d782dca6a4af6224dc664f0bdad9cc05967e6d52f500aa1b8531a56ece1

memory/3916-123-0x0000000070570000-0x00000000708C4000-memory.dmp

memory/3916-122-0x00000000703F0000-0x000000007043C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 1e10e303d8fa2fffe18a9a771aced539
SHA1 20339790f812489b837adae6a3481d729543a11b
SHA256 dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159
SHA512 dd6a74c13e735fe43093cfb1a291f9b5057cf1619531c46b257370077434cd08e5e15dd4f0c1a2198851d0aa6d0dd2552dcc38c6a2bb075a8f17b829bb13cbd2

memory/1776-137-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/1192-141-0x0000000000400000-0x0000000002ED5000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 858353806915d0c5c8cf6d9f3c96e61a
SHA1 21aadd59bcf74b1f594d1fcc20d4dfbbc7c74103
SHA256 bf9090b602e9424f2bbbc90db98c42c45395087cb60e924bef198a96385fd2b9
SHA512 ef3f9ed42ccadd18b1a4f621a8b9d1b7e3291deb4a4c4e9ae56126cac200326c93cf34786ea8a167853920b8afa6b6af64cc973a95412686756faed024e7352b

memory/3784-152-0x00000000703F0000-0x000000007043C000-memory.dmp

memory/3784-153-0x0000000070B70000-0x0000000070EC4000-memory.dmp

memory/3584-165-0x00000000056A0000-0x00000000059F4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 352577d324be8cc869ac391f1e1773d4
SHA1 d80e3a7d3aa3345a46d8b7f934684bdcc94ab800
SHA256 e1f9272ab4653f4809aae1b1a0b918982ac4072f2fa4ec5204f432b8b4ad7cb9
SHA512 bd940b4e88dbdad6bc63790635ab0d111cb9beee1ab7dc6ce202241bb3fd7057e4d9add72c08e92ecc4fb93130c2de76337680b664a25af4f4d7c75973c9da2d

memory/3584-176-0x0000000006270000-0x00000000062BC000-memory.dmp

memory/3584-177-0x0000000070310000-0x000000007035C000-memory.dmp

memory/3584-178-0x0000000070AA0000-0x0000000070DF4000-memory.dmp

memory/3584-188-0x0000000006F90000-0x0000000007033000-memory.dmp

memory/3584-189-0x00000000072B0000-0x00000000072C1000-memory.dmp

memory/3584-190-0x0000000005B40000-0x0000000005B54000-memory.dmp

memory/3724-201-0x00000000055F0000-0x0000000005944000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ea390c866530259e7b435ee2e9e1b0f9
SHA1 23e99192f7957004bd516f0f30b612915de57cd3
SHA256 1b83330c324a8b50873be9bcf0ce37c5209723a23ebc33dccc221fb4d77825a8
SHA512 a40b203f0573e631cc253df357d486d66711114b9df3a9301e02b27fbb44d806d7d91e1a7eb88775c28029256b4fa81e5862f6b6a419d86ca9511b1d7dd8ad83

memory/3724-203-0x0000000070310000-0x000000007035C000-memory.dmp

memory/3724-204-0x0000000070490000-0x00000000707E4000-memory.dmp

memory/1192-215-0x0000000000400000-0x0000000002ED5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3184-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1496-229-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3184-231-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1192-228-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/1496-234-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1192-233-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/1192-236-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/1496-240-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1192-239-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/1192-242-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/1192-245-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/1192-248-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/1192-251-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/1192-254-0x0000000000400000-0x0000000002ED5000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 19:27

Reported

2024-05-09 19:30

Platform

win11-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-301 = "Romance Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2356 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2356 wrote to memory of 4780 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\system32\cmd.exe
PID 4792 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\system32\cmd.exe
PID 4568 wrote to memory of 2928 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4568 wrote to memory of 2928 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4792 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 4240 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\rss\csrss.exe
PID 4792 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\rss\csrss.exe
PID 4792 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe C:\Windows\rss\csrss.exe
PID 2772 wrote to memory of 3916 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 3916 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 3916 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2288 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2288 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2288 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2232 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2232 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2232 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2772 wrote to memory of 2996 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2772 wrote to memory of 2996 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2000 wrote to memory of 2624 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2624 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2624 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2624 wrote to memory of 648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2624 wrote to memory of 648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2624 wrote to memory of 648 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe

"C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe

"C:\Users\Admin\AppData\Local\Temp\dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 0170e0fc-b72a-4e0e-96f2-de3adfc4d70c.uuid.filesdumpplace.org udp
US 8.8.8.8:53 server6.filesdumpplace.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun3.l.google.com udp
BG 185.82.216.96:443 server6.filesdumpplace.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
BG 185.82.216.96:443 server6.filesdumpplace.org tcp
BG 185.82.216.96:443 server6.filesdumpplace.org tcp
BG 185.82.216.96:443 server6.filesdumpplace.org tcp

Files

memory/2356-1-0x0000000003280000-0x0000000003688000-memory.dmp

memory/2356-2-0x0000000005070000-0x000000000595B000-memory.dmp

memory/2356-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4780-4-0x0000000074A0E000-0x0000000074A0F000-memory.dmp

memory/4780-5-0x0000000002F10000-0x0000000002F46000-memory.dmp

memory/4780-7-0x00000000057A0000-0x0000000005DCA000-memory.dmp

memory/4780-6-0x0000000074A00000-0x00000000751B1000-memory.dmp

memory/4780-8-0x0000000005550000-0x0000000005572000-memory.dmp

memory/4780-9-0x00000000056F0000-0x0000000005756000-memory.dmp

memory/4780-10-0x0000000005ED0000-0x0000000005F36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ra2wgcn.ujh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4780-19-0x0000000005F40000-0x0000000006297000-memory.dmp

memory/4780-20-0x00000000063E0000-0x00000000063FE000-memory.dmp

memory/4780-21-0x0000000006410000-0x000000000645C000-memory.dmp

memory/4780-22-0x0000000006820000-0x0000000006866000-memory.dmp

memory/4780-25-0x0000000070E80000-0x00000000711D7000-memory.dmp

memory/4780-24-0x0000000070C70000-0x0000000070CBC000-memory.dmp

memory/4780-34-0x0000000007850000-0x000000000786E000-memory.dmp

memory/4780-23-0x0000000007810000-0x0000000007844000-memory.dmp

memory/4780-35-0x0000000007870000-0x0000000007914000-memory.dmp

memory/4780-36-0x0000000007FE0000-0x000000000865A000-memory.dmp

memory/4780-37-0x00000000079A0000-0x00000000079BA000-memory.dmp

memory/4780-38-0x00000000079E0000-0x00000000079EA000-memory.dmp

memory/4780-39-0x0000000007AA0000-0x0000000007B36000-memory.dmp

memory/4780-40-0x0000000007A10000-0x0000000007A21000-memory.dmp

memory/4780-41-0x0000000007A50000-0x0000000007A5E000-memory.dmp

memory/4780-42-0x0000000007A60000-0x0000000007A75000-memory.dmp

memory/4780-43-0x0000000007B60000-0x0000000007B7A000-memory.dmp

memory/4780-44-0x0000000007B40000-0x0000000007B48000-memory.dmp

memory/4780-47-0x0000000074A00000-0x00000000751B1000-memory.dmp

memory/2356-49-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/3560-58-0x0000000070C70000-0x0000000070CBC000-memory.dmp

memory/3560-59-0x0000000070E80000-0x00000000711D7000-memory.dmp

memory/3560-68-0x00000000075B0000-0x0000000007654000-memory.dmp

memory/3560-69-0x0000000007900000-0x0000000007911000-memory.dmp

memory/2356-70-0x0000000003280000-0x0000000003688000-memory.dmp

memory/2356-71-0x0000000005070000-0x000000000595B000-memory.dmp

memory/3560-72-0x0000000007930000-0x0000000007945000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/4240-76-0x0000000006070000-0x00000000063C7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f762ff0e69ccbb0b01eed557ea06a435
SHA1 f822d256cb4f1004e095ac81097871a0e173037e
SHA256 6d6ba4abb70cb16cb2806d2a4d8debc9a1276439da0c0373c171dcbd004add02
SHA512 afe96bde5c7104cfff8581d4c0ec241c66b72475d8cc56030dc3f99e8564e7fd5505a39a76e126bba5179f6640fb5566ff566064c774b81ca7844c1bb68969cd

memory/4240-86-0x0000000070C70000-0x0000000070CBC000-memory.dmp

memory/4240-87-0x0000000070EC0000-0x0000000071217000-memory.dmp

memory/4792-97-0x0000000000400000-0x0000000002ED5000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 695cb7d51eab4f93a908428eb71604e5
SHA1 df5c808da50792177c9f78dc5f4e4127181a7bbb
SHA256 6eb97669ac85014fb95dba1673dd65089c948f641f1cc7bb9c15f7ddebcd4b2d
SHA512 e676bd862fd2dd3fa3b15159e808ae83a83a43b28ff6d77051e42bba53b7d09d89942893105196169dfd239be9ba0e61105380c492847e19a8736298bd8acedc

memory/2240-108-0x0000000070C70000-0x0000000070CBC000-memory.dmp

memory/2240-109-0x0000000070EC0000-0x0000000071217000-memory.dmp

memory/2356-123-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 1e10e303d8fa2fffe18a9a771aced539
SHA1 20339790f812489b837adae6a3481d729543a11b
SHA256 dab6d099876b7025dba8aaf1098f47e2cadedb47f5136167c9026cf06defa159
SHA512 dd6a74c13e735fe43093cfb1a291f9b5057cf1619531c46b257370077434cd08e5e15dd4f0c1a2198851d0aa6d0dd2552dcc38c6a2bb075a8f17b829bb13cbd2

memory/4792-126-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/3916-135-0x0000000005810000-0x0000000005B67000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8afa6747cd5c9663b1e83b212c7eccb7
SHA1 cdb76b2ee9abde54f400d1e286e03e619f309ea9
SHA256 04c61c92b95b61d689eca777e1476a9a2910ab0d065ae03e997249771e117914
SHA512 9172316ebfb56d478eb374e5d13e21023006ad7ba97c0d7706eb539db08eb89127a882a5fc385d100dd31151bb73466b3ae1bc40c427b021ada9c75e17fbdb86

memory/3916-137-0x0000000070C70000-0x0000000070CBC000-memory.dmp

memory/3916-138-0x0000000070DF0000-0x0000000071147000-memory.dmp

memory/2288-149-0x0000000006030000-0x0000000006387000-memory.dmp

memory/2772-148-0x0000000000400000-0x0000000002ED5000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 52bd52510dc675916f18b3fbce31c158
SHA1 f86976fa6cdcb2c37e53df9c4fe2bd32943b4d68
SHA256 8e3002641b0f31edac309e4458003974347dd3f6cae07dba6604ed9aac5f5570
SHA512 3b8c26ca60e81193dbdf28f00b2fcd30bc1b46cbf0415b0c478e79fbc14d15cac12a8a826889b6cb4b32fe409ff7370c388a9bb03b4cd6319407724f80362173

memory/2288-159-0x0000000006910000-0x000000000695C000-memory.dmp

memory/2288-160-0x0000000070B90000-0x0000000070BDC000-memory.dmp

memory/2288-161-0x0000000070DA0000-0x00000000710F7000-memory.dmp

memory/2288-170-0x0000000007830000-0x00000000078D4000-memory.dmp

memory/2288-171-0x0000000007A20000-0x0000000007A31000-memory.dmp

memory/2288-172-0x00000000063F0000-0x0000000006405000-memory.dmp

memory/2232-176-0x0000000005770000-0x0000000005AC7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ad8f82c6a1765b2f7541abd57cddeff6
SHA1 1fe91da177d84b30146e90442ef36b830adc60df
SHA256 8f4d3df2b80910b7266a6f03c8e07fa3b6762231405b2f3b889711ee2829d0ed
SHA512 c24b6c2b8a2fd6cfe8a4f1b8ce9ac6f84f15cac1668b73d54d7be71508f18e65dfdfa112d130bd1dacd2faa501e64c3f8784849798482c6bfae3cf0fbc76a321

memory/2232-184-0x0000000070B90000-0x0000000070BDC000-memory.dmp

memory/2232-185-0x0000000070DE0000-0x0000000071137000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2772-202-0x0000000000400000-0x0000000002ED5000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2000-207-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/392-211-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2000-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2772-214-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/392-215-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2772-218-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/2772-222-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/392-223-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2772-226-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/2772-230-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/2772-234-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/2772-238-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/2772-242-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/2772-246-0x0000000000400000-0x0000000002ED5000-memory.dmp

memory/2772-250-0x0000000000400000-0x0000000002ED5000-memory.dmp