Malware Analysis Report

2025-06-16 01:58

Sample ID 240509-xz9srsdf62
Target 735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f
SHA256 735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f

Threat Level: Known bad

The file 735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Manipulates WinMonFS driver.

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Command and Scripting Interpreter: PowerShell

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-09 19:18

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-09 19:18

Reported

2024-05-09 19:21

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-12 = "Azores Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2432 = "Cuba Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2152 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 116 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 688 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\system32\cmd.exe
PID 2868 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\system32\cmd.exe
PID 4972 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4972 wrote to memory of 3548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2868 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2868 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\rss\csrss.exe
PID 2868 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\rss\csrss.exe
PID 2868 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\rss\csrss.exe
PID 2336 wrote to memory of 2968 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2336 wrote to memory of 2968 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2336 wrote to memory of 2968 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2336 wrote to memory of 3152 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2336 wrote to memory of 3152 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2336 wrote to memory of 3152 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2336 wrote to memory of 3684 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2336 wrote to memory of 3684 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2336 wrote to memory of 3684 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2336 wrote to memory of 3036 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2336 wrote to memory of 3036 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2532 wrote to memory of 1780 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2532 wrote to memory of 1780 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2532 wrote to memory of 1780 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1780 wrote to memory of 928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1780 wrote to memory of 928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1780 wrote to memory of 928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe

"C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe

"C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 36.56.20.217.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
BE 2.17.196.74:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 74.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 32.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 b21d0ad1-4165-4598-86b9-04cd476506e3.uuid.datadumpcloud.org udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 stun.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server15.datadumpcloud.org udp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun.l.google.com udp
BG 185.82.216.104:443 server15.datadumpcloud.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.104:443 server15.datadumpcloud.org tcp
US 52.111.229.43:443 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
BG 185.82.216.104:443 server15.datadumpcloud.org tcp
US 8.8.8.8:53 153.141.79.40.in-addr.arpa udp

Files

memory/2152-1-0x00000000032C0000-0x00000000036BE000-memory.dmp

memory/2152-2-0x0000000004F60000-0x000000000584B000-memory.dmp

memory/2152-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/116-5-0x000000007417E000-0x000000007417F000-memory.dmp

memory/116-6-0x00000000047A0000-0x00000000047D6000-memory.dmp

memory/2152-4-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/116-7-0x0000000074170000-0x0000000074920000-memory.dmp

memory/116-8-0x0000000004ED0000-0x00000000054F8000-memory.dmp

memory/116-9-0x0000000074170000-0x0000000074920000-memory.dmp

memory/116-10-0x0000000005570000-0x0000000005592000-memory.dmp

memory/116-11-0x0000000005690000-0x00000000056F6000-memory.dmp

memory/116-12-0x0000000005700000-0x0000000005766000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e251aetm.3a0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/116-22-0x0000000005770000-0x0000000005AC4000-memory.dmp

memory/116-23-0x0000000005D60000-0x0000000005D7E000-memory.dmp

memory/116-24-0x0000000005D90000-0x0000000005DDC000-memory.dmp

memory/116-25-0x0000000006170000-0x00000000061B4000-memory.dmp

memory/116-26-0x0000000007080000-0x00000000070F6000-memory.dmp

memory/116-27-0x0000000007780000-0x0000000007DFA000-memory.dmp

memory/116-28-0x0000000007120000-0x000000000713A000-memory.dmp

memory/116-29-0x00000000072E0000-0x0000000007312000-memory.dmp

memory/116-30-0x0000000070010000-0x000000007005C000-memory.dmp

memory/116-32-0x0000000074170000-0x0000000074920000-memory.dmp

memory/116-31-0x00000000705C0000-0x0000000070914000-memory.dmp

memory/116-43-0x0000000007340000-0x00000000073E3000-memory.dmp

memory/116-42-0x0000000007320000-0x000000000733E000-memory.dmp

memory/116-44-0x0000000074170000-0x0000000074920000-memory.dmp

memory/116-45-0x0000000007430000-0x000000000743A000-memory.dmp

memory/116-46-0x0000000007540000-0x00000000075D6000-memory.dmp

memory/116-47-0x0000000007440000-0x0000000007451000-memory.dmp

memory/116-48-0x0000000007480000-0x000000000748E000-memory.dmp

memory/116-49-0x00000000074A0000-0x00000000074B4000-memory.dmp

memory/116-50-0x00000000074F0000-0x000000000750A000-memory.dmp

memory/116-51-0x00000000074E0000-0x00000000074E8000-memory.dmp

memory/116-54-0x0000000074170000-0x0000000074920000-memory.dmp

memory/2152-56-0x00000000032C0000-0x00000000036BE000-memory.dmp

memory/2152-57-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/2152-58-0x0000000004F60000-0x000000000584B000-memory.dmp

memory/2152-59-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/688-69-0x0000000005EE0000-0x0000000006234000-memory.dmp

memory/2868-70-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/688-72-0x0000000070790000-0x0000000070AE4000-memory.dmp

memory/688-71-0x0000000070010000-0x000000007005C000-memory.dmp

memory/688-82-0x00000000076D0000-0x0000000007773000-memory.dmp

memory/688-83-0x0000000007A00000-0x0000000007A11000-memory.dmp

memory/688-84-0x0000000007A50000-0x0000000007A64000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/2452-98-0x00000000062D0000-0x0000000006624000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 de0ea1ac76e8b01b4398c94033306d1c
SHA1 83e457147f7445af0a54ca0af5e8c7f85f02c45d
SHA256 7ac6794194932fe832a5840c7634b729b79a3d651b9c23afee7515f6bf558adb
SHA512 5077c1b6fb9dd82f7a56595675c7ef9e1acf3c5b24555d5b298e3bf53eb6066a2b43cc3794bded5bd1d32109ca1ec713ef3be2ea75938cde12b5b74c75d3a1de

memory/2452-101-0x0000000070DC0000-0x0000000071114000-memory.dmp

memory/2452-100-0x0000000070010000-0x000000007005C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0dfdfb9aa2b01703f1f77f5f6976e13a
SHA1 31c16474e1696ee3746dda41caf9ba0efcdbaa5c
SHA256 bd8d8afc5fd104a05d3ba9d18f3af74bf29c36905e4bce2c3ae0cf2d1f91b34d
SHA512 b4f9d25a704777539f1a7bb641e9e6ebad8f16155b500941a4032e97713cda8a7dd41c4158527b038d96f22973e20ba8167b1492c6da643b625e57521229e15b

memory/4852-122-0x0000000070010000-0x000000007005C000-memory.dmp

memory/4852-123-0x0000000070790000-0x0000000070AE4000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 8b276996d5f025a6910d58c61615ad2d
SHA1 cbd78ed04260737e194aa83c02b7dbc9403d5dca
SHA256 735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f
SHA512 706672e6139bfde18147a37aab12a87e5557264fa3478dca01d725bf2bfbd077652365bb37c95594d200c1bf09fd07a60745b88e09c07c20a15bbe03705244f5

memory/2868-139-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/2968-150-0x00000000058F0000-0x0000000005C44000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3038cf3f60e4386b32b63e2ec8f8a37c
SHA1 0b238233b7638b655cc100e1e9000086b45835bf
SHA256 6cdd563f37ea0edb482824d7894dafa3b69096d214c8c3963deb5f33ed140e81
SHA512 56a089432beb3f628bee07a768a7da4b865f90ff79286721a526a962f5d7e808cc862abf87b5951558f55fe925c26ee0ab857a7833e16b44441fedbf3b21a57f

memory/2968-152-0x0000000070010000-0x000000007005C000-memory.dmp

memory/2968-153-0x0000000070190000-0x00000000704E4000-memory.dmp

memory/2336-163-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/3152-174-0x0000000006250000-0x00000000065A4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5195b9da052a691c4f412f16630044b5
SHA1 377ca02770d08c16f34b5e03de63ac0d2a854684
SHA256 b06a5e5f0b1bb9dd1994d9963fa57435a2a01609c92fcb24f7316a2271a1b3a6
SHA512 c93ef62a2be1fbfb008151e33a924a9daafb81dbf0541e3c4c0c0ea3810ed928c9f10e72ba7d90f28559bfb641bf057d36caa08afb37a33ba53c274782ca41df

memory/3152-176-0x0000000006CB0000-0x0000000006CFC000-memory.dmp

memory/3152-177-0x000000006FF30000-0x000000006FF7C000-memory.dmp

memory/3152-178-0x00000000706C0000-0x0000000070A14000-memory.dmp

memory/3152-188-0x0000000007AD0000-0x0000000007B73000-memory.dmp

memory/3152-191-0x0000000007E20000-0x0000000007E31000-memory.dmp

memory/3152-192-0x0000000006650000-0x0000000006664000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 63943b5ecad617552f11268a7c6b542d
SHA1 e1478069b1cf7f4f9b30583e0dbfebdf7bec98c9
SHA256 f3096e926713b595d527e126a315e4c52a04ae7bb8b21707b51752619f75c933
SHA512 afcdd3271cb5f6cfc896f1c0fa21918de2461a6343eb1ca4f80b2b0105532072f0378cec5a3ffd74e6f66d65953f37fb60e1c3baa7cf4d1b958b138ebc4e00ed

memory/3684-204-0x000000006FF30000-0x000000006FF7C000-memory.dmp

memory/3684-205-0x00000000706C0000-0x0000000070A14000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2336-222-0x0000000000400000-0x0000000002EDD000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2532-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2532-231-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2336-233-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/3148-235-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2336-237-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/2336-241-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/3148-243-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2336-244-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/2336-249-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/2336-253-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/2336-257-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/2336-260-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/2336-264-0x0000000000400000-0x0000000002EDD000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-09 19:18

Reported

2024-05-09 19:21

Platform

win11-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4972 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4972 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\system32\cmd.exe
PID 4792 wrote to memory of 1880 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\system32\cmd.exe
PID 1880 wrote to memory of 4412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1880 wrote to memory of 4412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4792 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 4744 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\rss\csrss.exe
PID 4792 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\rss\csrss.exe
PID 4792 wrote to memory of 3812 N/A C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe C:\Windows\rss\csrss.exe
PID 3812 wrote to memory of 1472 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3812 wrote to memory of 1472 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3812 wrote to memory of 1472 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3812 wrote to memory of 720 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3812 wrote to memory of 720 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3812 wrote to memory of 720 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3812 wrote to memory of 1120 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3812 wrote to memory of 1120 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3812 wrote to memory of 1120 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3812 wrote to memory of 900 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3812 wrote to memory of 900 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3344 wrote to memory of 3828 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 3828 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 3828 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3828 wrote to memory of 1656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3828 wrote to memory of 1656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3828 wrote to memory of 1656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe

"C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe

"C:\Users\Admin\AppData\Local\Temp\735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 eac87241-7e80-4f3a-96ba-ec6af8356c88.uuid.datadumpcloud.org udp
US 8.8.8.8:53 stun.ipfire.org udp
US 8.8.8.8:53 server3.datadumpcloud.org udp
US 162.159.130.233:443 cdn.discordapp.com tcp
DE 81.3.27.44:3478 stun.ipfire.org udp
BG 185.82.216.104:443 server3.datadumpcloud.org tcp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
US 172.67.221.71:443 carsalessystem.com tcp
BG 185.82.216.104:443 server3.datadumpcloud.org tcp
US 52.111.227.14:443 tcp
BG 185.82.216.104:443 server3.datadumpcloud.org tcp

Files

memory/4972-1-0x0000000003290000-0x000000000368B000-memory.dmp

memory/4972-2-0x0000000005030000-0x000000000591B000-memory.dmp

memory/4972-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4136-4-0x000000007487E000-0x000000007487F000-memory.dmp

memory/4136-5-0x0000000002EC0000-0x0000000002EF6000-memory.dmp

memory/4136-7-0x0000000005A70000-0x000000000609A000-memory.dmp

memory/4136-6-0x0000000074870000-0x0000000075021000-memory.dmp

memory/4136-8-0x0000000005930000-0x0000000005952000-memory.dmp

memory/4136-9-0x0000000074870000-0x0000000075021000-memory.dmp

memory/4136-10-0x0000000006110000-0x0000000006176000-memory.dmp

memory/4136-11-0x0000000006180000-0x00000000061E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_agbcu010.si1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4136-20-0x00000000061F0000-0x0000000006547000-memory.dmp

memory/4136-21-0x00000000066D0000-0x00000000066EE000-memory.dmp

memory/4136-22-0x0000000006790000-0x00000000067DC000-memory.dmp

memory/4136-23-0x0000000006C60000-0x0000000006CA6000-memory.dmp

memory/4136-25-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

memory/4136-24-0x0000000007AF0000-0x0000000007B24000-memory.dmp

memory/4136-35-0x0000000007B50000-0x0000000007B6E000-memory.dmp

memory/4136-26-0x0000000070CF0000-0x0000000071047000-memory.dmp

memory/4136-36-0x0000000007B70000-0x0000000007C14000-memory.dmp

memory/4136-38-0x00000000082D0000-0x000000000894A000-memory.dmp

memory/4136-39-0x0000000007C90000-0x0000000007CAA000-memory.dmp

memory/4972-37-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/4136-40-0x0000000007CD0000-0x0000000007CDA000-memory.dmp

memory/4136-41-0x0000000007D90000-0x0000000007E26000-memory.dmp

memory/4136-42-0x0000000007D00000-0x0000000007D11000-memory.dmp

memory/4136-43-0x0000000007D40000-0x0000000007D4E000-memory.dmp

memory/4136-44-0x0000000007D50000-0x0000000007D65000-memory.dmp

memory/4136-45-0x0000000007E50000-0x0000000007E6A000-memory.dmp

memory/4136-46-0x0000000007E30000-0x0000000007E38000-memory.dmp

memory/4136-49-0x0000000074870000-0x0000000075021000-memory.dmp

memory/4972-51-0x0000000003290000-0x000000000368B000-memory.dmp

memory/4972-53-0x0000000005030000-0x000000000591B000-memory.dmp

memory/4972-52-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/4748-62-0x0000000005790000-0x0000000005AE7000-memory.dmp

memory/4748-63-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

memory/4748-64-0x0000000070C60000-0x0000000070FB7000-memory.dmp

memory/4748-73-0x0000000006DE0000-0x0000000006E84000-memory.dmp

memory/4972-75-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4748-76-0x0000000007110000-0x0000000007121000-memory.dmp

memory/4792-74-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/4748-77-0x0000000007160000-0x0000000007175000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/2244-89-0x00000000063C0000-0x0000000006717000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e68191d002b3d7792561270e3fdf4bdc
SHA1 6d9022ed140042eb722f1f383f0ab6ee0268dc1f
SHA256 421560588f5fd0506e3035e8861ce4d99473d033cefc74a4c760a6bccbbc7069
SHA512 3569a1bca0883fcb6ee83299ea4c5a9673ae009767d18d66d99394888dae73d39c29592303913a259e70a638e65a2571255103dc4715a665ffc8e4763d69940e

memory/2244-92-0x0000000070D30000-0x0000000071087000-memory.dmp

memory/2244-91-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f787794d806c073f835005bb350d583f
SHA1 a90e879584a6d05e42d867eb70353536c8358bb8
SHA256 19570c5c5007d6e98bba68d1d92953df34490feb5f78c67ca7ef756449e2cf46
SHA512 b0dab9e412763cf9821c3e4c2f80749db5fbb3936de36882ae6b30c1b733ab1827bac16014af0be517137bf4b1d9abb5b323138e74792562cf6e5613e4fe550d

memory/4744-111-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

memory/4744-113-0x0000000070C60000-0x0000000070FB7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 8b276996d5f025a6910d58c61615ad2d
SHA1 cbd78ed04260737e194aa83c02b7dbc9403d5dca
SHA256 735d7c8bd31dbedadcb392e3f30db32e35a975aa1632650796958989c19ff89f
SHA512 706672e6139bfde18147a37aab12a87e5557264fa3478dca01d725bf2bfbd077652365bb37c95594d200c1bf09fd07a60745b88e09c07c20a15bbe03705244f5

memory/4792-128-0x0000000000400000-0x0000000002EDD000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 74635fc477c1d92daa15be553cdc1394
SHA1 14237aa114139c8e21c2e456006acf7fad89b957
SHA256 f7955b0af3be044533a99c21a8e0b8f250d750973f9b0cb2a2872fb417e45a3e
SHA512 f740be5a937dd1364ce701a2fefd4d84b07f07688a08b98bf0245c270b4ad156e0f39e126a96833481015a636ed62bde26161d5bda1c3ad894e8cb99e7d28126

memory/1472-140-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

memory/1472-141-0x0000000070D30000-0x0000000071087000-memory.dmp

memory/720-159-0x0000000005F00000-0x0000000006257000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e4a6d0aaf08d003d0dda147ce3197936
SHA1 5d9f9e3b9e4a481ba7a40a059b3fcbbc06ee3ef9
SHA256 bca8e531932f60c2ddeed54c769bab03e9c5c601b45adac0e8c4ace101bd064a
SHA512 2ff628e64f3e07a9a0dff115bb18d1fd3724d6893d11f87d86de7dee1c04d958a072f38db1db0ba1545cdfe7ab3dc60c724ad199df7bdb2717f639059b5a6d56

memory/720-161-0x0000000006970000-0x00000000069BC000-memory.dmp

memory/720-162-0x0000000070A00000-0x0000000070A4C000-memory.dmp

memory/720-163-0x0000000070BA0000-0x0000000070EF7000-memory.dmp

memory/720-172-0x0000000007480000-0x0000000007524000-memory.dmp

memory/720-174-0x0000000005E80000-0x0000000005E91000-memory.dmp

memory/720-175-0x0000000006260000-0x0000000006275000-memory.dmp

memory/1120-177-0x0000000006040000-0x0000000006397000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ccf7e704c629f45d2d0488eca6c71eb8
SHA1 b6962d04fa610ec89826824e3ae159a5132367c8
SHA256 1209f39d98eb70a8c52198dc2d2eb8b24a749d197d90546887a7db9ad6144ad5
SHA512 6492336adebbd11dcf44146d59665b92076a9e5db3804406d2fcb852447acb426ac4b9b48e194f205312c603b5420626f436a4bdbde1f6528b736b74f8d0595d

memory/1120-188-0x0000000070C50000-0x0000000070FA7000-memory.dmp

memory/1120-187-0x0000000070A00000-0x0000000070A4C000-memory.dmp

memory/3812-197-0x0000000000400000-0x0000000002EDD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3344-210-0x0000000000400000-0x00000000008DF000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2632-214-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3344-215-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3812-206-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/3812-218-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/2632-220-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3812-223-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/2632-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3812-227-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/3812-231-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/3812-234-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/3812-239-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/3812-243-0x0000000000400000-0x0000000002EDD000-memory.dmp

memory/3812-247-0x0000000000400000-0x0000000002EDD000-memory.dmp