Analysis
-
max time kernel
148s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe
Resource
win10v2004-20240226-en
General
-
Target
44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe
-
Size
4.1MB
-
MD5
efe81e338f7ac4d981457b0ee8e23851
-
SHA1
d485c50537711e84d05c5a9523a414a4f6860873
-
SHA256
44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a
-
SHA512
4a55eb64f5cb8ddc0ec002236011403e6df865a6fa1b4db2f6a809b11c8bb2aa9d6a37ee767009683e217253a47f7b0ef3226e91961804c63cd54a24c7c44259
-
SSDEEP
98304:VwBco1salv4p8AdbboIKOJLJ1nO5Zld79mTpi:VwqoWyv4yANjKQa7oE
Malware Config
Signatures
-
Glupteba payload 12 IoCs
resource yara_rule behavioral1/memory/4068-2-0x0000000004FE0000-0x00000000058CB000-memory.dmp family_glupteba behavioral1/memory/4068-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4068-9-0x0000000000400000-0x0000000002ED5000-memory.dmp family_glupteba behavioral1/memory/4068-27-0x0000000004FE0000-0x00000000058CB000-memory.dmp family_glupteba behavioral1/memory/4068-33-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4068-32-0x0000000000400000-0x0000000002ED5000-memory.dmp family_glupteba behavioral1/memory/4068-53-0x0000000000400000-0x0000000002ED5000-memory.dmp family_glupteba behavioral1/memory/4068-63-0x0000000000400000-0x0000000002ED5000-memory.dmp family_glupteba behavioral1/memory/716-92-0x0000000000400000-0x0000000002ED5000-memory.dmp family_glupteba behavioral1/memory/716-128-0x0000000000400000-0x0000000002ED5000-memory.dmp family_glupteba behavioral1/memory/716-147-0x0000000000400000-0x0000000002ED5000-memory.dmp family_glupteba behavioral1/memory/4844-163-0x0000000000400000-0x0000000002ED5000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4772 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 4844 csrss.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe File opened for modification C:\Windows\rss 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe -
pid Process 4868 powershell.exe 1128 powershell.exe 2368 powershell.exe 3140 powershell.exe 4076 powershell.exe 4976 powershell.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2864 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4076 powershell.exe 4076 powershell.exe 4076 powershell.exe 4068 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 4068 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 4976 powershell.exe 4976 powershell.exe 4976 powershell.exe 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 4868 powershell.exe 4868 powershell.exe 4868 powershell.exe 1128 powershell.exe 1128 powershell.exe 2368 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4076 powershell.exe Token: SeDebugPrivilege 4068 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Token: SeImpersonatePrivilege 4068 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe Token: SeDebugPrivilege 4976 powershell.exe Token: SeDebugPrivilege 4868 powershell.exe Token: SeDebugPrivilege 1128 powershell.exe Token: SeDebugPrivilege 2368 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 4068 wrote to memory of 4076 4068 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 96 PID 4068 wrote to memory of 4076 4068 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 96 PID 4068 wrote to memory of 4076 4068 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 96 PID 716 wrote to memory of 4976 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 103 PID 716 wrote to memory of 4976 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 103 PID 716 wrote to memory of 4976 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 103 PID 716 wrote to memory of 3672 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 105 PID 716 wrote to memory of 3672 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 105 PID 3672 wrote to memory of 4772 3672 cmd.exe 107 PID 3672 wrote to memory of 4772 3672 cmd.exe 107 PID 716 wrote to memory of 4868 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 108 PID 716 wrote to memory of 4868 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 108 PID 716 wrote to memory of 4868 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 108 PID 716 wrote to memory of 1128 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 110 PID 716 wrote to memory of 1128 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 110 PID 716 wrote to memory of 1128 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 110 PID 716 wrote to memory of 4844 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 112 PID 716 wrote to memory of 4844 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 112 PID 716 wrote to memory of 4844 716 44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe 112 PID 4844 wrote to memory of 2368 4844 csrss.exe 113 PID 4844 wrote to memory of 2368 4844 csrss.exe 113 PID 4844 wrote to memory of 2368 4844 csrss.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe"C:\Users\Admin\AppData\Local\Temp\44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4076
-
-
C:\Users\Admin\AppData\Local\Temp\44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe"C:\Users\Admin\AppData\Local\Temp\44585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4976
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4772
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2368
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2864
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3856
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:3140
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵PID:1924
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a940a8b94856dc02e5b1b799a0bff7ab
SHA1cb9b2a3c0603d128a11e5208ea024e71912c2bec
SHA256381482a854430a21cb7792979a125f209f10110946b2a5dc857a15163517fc45
SHA51297bd315d18c2d0d2140d8de0952c02d25479e2fe847ad38df97f35788a76588f49fd7b36a42888bdb56cab02c6423ca931918b5063cb3f78d9557608c64dc827
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f5b1c71050a4e21f95dbb13fc318f147
SHA193fa7e24890bbfd14110d5bc719dddbe723904c1
SHA2569ecbfe0dc379a548617de341cd75152ed9f58ed6006ab438f33a3c681d0ebaae
SHA51211e9481f5392fcfb60cedc4c956c8ea9e64263c48933fc0b52cbd1d488e3fa9f348b164562c13a96fae38f112554aa55cca405fa93ec21f95b77449b3285e7a3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5514a5123f245939d0899bf042fec86f8
SHA12198b220fa20b44a8f0ab3686c590d255c741f0e
SHA25632a3ee1a910d1c9302cbec21be0b4c2e9da97712c334295da56a6dfe24d719b0
SHA5127708d904465271edbb136c223540b5fee28c07bca24875d54822afa05a2b3f20b9dcdded323e219d9acc4ce01d47cb879920fc6430cebc4b10f5faf6580871b4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5962ab2cf5b2a42fa9f9806c6738bcd53
SHA15a86bab41913f2bcac60d0d5b781eadf3df2e755
SHA256fafe29316923a6fc8d43b48bb0cd79310d4aa1d3274ae1dab7463bef2c7533e6
SHA512844141c5257d4ef043d13d0c030209a72767f66f06490b1d328106fc793ee46fd8d41eaf4565a70ebabc45222ebe846986e0963a1f109c33cbcdf8a73db01b70
-
Filesize
4.1MB
MD5efe81e338f7ac4d981457b0ee8e23851
SHA1d485c50537711e84d05c5a9523a414a4f6860873
SHA25644585fd6d0950b09e982a66f087842be69ad891da6a41214015546178437fd0a
SHA5124a55eb64f5cb8ddc0ec002236011403e6df865a6fa1b4db2f6a809b11c8bb2aa9d6a37ee767009683e217253a47f7b0ef3226e91961804c63cd54a24c7c44259