Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 08:38
Static task
static1
Behavioral task
behavioral1
Sample
1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe
Resource
win7-20240221-en
General
-
Target
1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe
-
Size
4.2MB
-
MD5
d7003ff49d2089fbc7d4fc56fe1d7484
-
SHA1
2f4a546593505f3732ad803dfb7f0d4eaf7d170f
-
SHA256
1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642
-
SHA512
140a8b15a6347b4765fdc00e4384fe165be63c41c2c679ad5352fc0f57830c295342fcf8f9ad1b60ff12c41dca1849acc4a535fdecdff503ab44f92bdf2907f1
-
SSDEEP
98304:K7V5WBlU86Tvm6P9JrD90yOgG9ATmX7qCnxtH2:a5Wq66PzD9dwAKrqCx52
Malware Config
Signatures
-
Glupteba payload 15 IoCs
resource yara_rule behavioral2/memory/4060-2-0x00000000050D0000-0x00000000059BB000-memory.dmp family_glupteba behavioral2/memory/4060-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4060-22-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4060-49-0x00000000050D0000-0x00000000059BB000-memory.dmp family_glupteba behavioral2/memory/4060-58-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/4060-59-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/452-86-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/452-136-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/452-142-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2584-181-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2584-221-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2584-231-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2584-238-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2584-241-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba behavioral2/memory/2584-244-0x0000000000400000-0x0000000003009000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3680 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 2584 csrss.exe 3372 injector.exe 4176 windefender.exe 4840 windefender.exe -
resource yara_rule behavioral2/files/0x0004000000000739-230.dat upx behavioral2/memory/4176-232-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4840-235-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4176-236-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4840-239-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4840-246-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rss\csrss.exe 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4300 sc.exe -
pid Process 3720 powershell.exe 216 powershell.exe 844 powershell.exe 5032 powershell.exe 1444 powershell.exe 5032 powershell.exe 4592 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2776 schtasks.exe 1948 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-572 = "China Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5032 powershell.exe 5032 powershell.exe 4060 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 4060 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 4592 powershell.exe 4592 powershell.exe 4592 powershell.exe 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 3720 powershell.exe 3720 powershell.exe 3720 powershell.exe 216 powershell.exe 216 powershell.exe 216 powershell.exe 844 powershell.exe 844 powershell.exe 844 powershell.exe 5032 powershell.exe 5032 powershell.exe 1444 powershell.exe 1444 powershell.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 2584 csrss.exe 2584 csrss.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 2584 csrss.exe 2584 csrss.exe 3372 injector.exe 3372 injector.exe 2584 csrss.exe 2584 csrss.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe 3372 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 5032 powershell.exe Token: SeDebugPrivilege 4060 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Token: SeImpersonatePrivilege 4060 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe Token: SeDebugPrivilege 4592 powershell.exe Token: SeDebugPrivilege 3720 powershell.exe Token: SeDebugPrivilege 216 powershell.exe Token: SeDebugPrivilege 844 powershell.exe Token: SeDebugPrivilege 5032 powershell.exe Token: SeDebugPrivilege 1444 powershell.exe Token: SeSystemEnvironmentPrivilege 2584 csrss.exe Token: SeSecurityPrivilege 4300 sc.exe Token: SeSecurityPrivilege 4300 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4060 wrote to memory of 5032 4060 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 92 PID 4060 wrote to memory of 5032 4060 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 92 PID 4060 wrote to memory of 5032 4060 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 92 PID 452 wrote to memory of 4592 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 103 PID 452 wrote to memory of 4592 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 103 PID 452 wrote to memory of 4592 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 103 PID 452 wrote to memory of 3904 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 106 PID 452 wrote to memory of 3904 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 106 PID 3904 wrote to memory of 3680 3904 cmd.exe 108 PID 3904 wrote to memory of 3680 3904 cmd.exe 108 PID 452 wrote to memory of 3720 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 109 PID 452 wrote to memory of 3720 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 109 PID 452 wrote to memory of 3720 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 109 PID 452 wrote to memory of 216 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 111 PID 452 wrote to memory of 216 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 111 PID 452 wrote to memory of 216 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 111 PID 452 wrote to memory of 2584 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 113 PID 452 wrote to memory of 2584 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 113 PID 452 wrote to memory of 2584 452 1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe 113 PID 2584 wrote to memory of 844 2584 csrss.exe 114 PID 2584 wrote to memory of 844 2584 csrss.exe 114 PID 2584 wrote to memory of 844 2584 csrss.exe 114 PID 2584 wrote to memory of 5032 2584 csrss.exe 119 PID 2584 wrote to memory of 5032 2584 csrss.exe 119 PID 2584 wrote to memory of 5032 2584 csrss.exe 119 PID 2584 wrote to memory of 1444 2584 csrss.exe 122 PID 2584 wrote to memory of 1444 2584 csrss.exe 122 PID 2584 wrote to memory of 1444 2584 csrss.exe 122 PID 2584 wrote to memory of 3372 2584 csrss.exe 124 PID 2584 wrote to memory of 3372 2584 csrss.exe 124 PID 4176 wrote to memory of 1056 4176 windefender.exe 130 PID 4176 wrote to memory of 1056 4176 windefender.exe 130 PID 4176 wrote to memory of 1056 4176 windefender.exe 130 PID 1056 wrote to memory of 4300 1056 cmd.exe 131 PID 1056 wrote to memory of 4300 1056 cmd.exe 131 PID 1056 wrote to memory of 4300 1056 cmd.exe 131 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe"C:\Users\Admin\AppData\Local\Temp\1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
C:\Users\Admin\AppData\Local\Temp\1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe"C:\Users\Admin\AppData\Local\Temp\1ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3680
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3720
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:216
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:844
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2776
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:1852
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3372
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1948
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2808 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵PID:3272
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4840
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f592e1ef0963360dde009bf0b1f24370
SHA149be90a89b3af2ec7c71cb01c4b92ce92179f4e8
SHA256bb7652ffdf8e8223fbd61f7f02239064e0ded28dc016430de739e9de20ed0b08
SHA512c7099070bf38f6fa3aaa6f3c9ab7b868a755948a3fb15b55b4fc2d6d28e03c789ecefa10261d7467f2f0e771c4ae2559f0b5f3278912230b601867ab7c602bb6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD525691f2382956e33fef8adf80c664eeb
SHA18d8985661bdb943297fb22290e9f808534049a96
SHA2562aa6588f42c097a3cd0ff27b3ed81e727e9146a9ea567562612f136bfc34574e
SHA51209261568b7d9890985635068ffa39e4ebba50bcae1134d154f0a6ef69878e8bc94a53d9e09fcb9382fd1ce804834e3c519d565c622fc921f8b48209d0eb40061
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD55468342f31dc44019e46e7e94374cddc
SHA17ad2870812769538dd83f2d79fc466a38724e64e
SHA2565ee091834d057bb97227480a7054deef0d9b5406d68668d7c411baa5134f8a63
SHA51287349104b1d9a7e459211ee18110796660c8a01efda91ade2e23ad95d282cce960672c3d4cd2c12c532c579d0503811ff50d3945bdafe5e141e8418fcc68ea08
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f4d33499421518d26a69ecd8db72dae7
SHA13e26b61acabb4590194941524bebd9488a8516c1
SHA256021ac3f30a872e1f828a3baf7fcb2ec4d97ab89e470cec9e4dbdd3d9a6e091dd
SHA512f18f450bd4c9f093bbad908fb1a542f9ec85610fa7c274be86dcf523c11a54030a8742440b09becd43f1388c6389315d1b026e31af95eafb4f94cd7dfda2de40
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD59e42bf8d14d3bce4a00436cc9d458782
SHA142bc0f6c86174458984c2440108d32dec1bdfb02
SHA2562d2c9595427a4de3385bf1261155cfba76c41376253fa385b1ed54182ce058ee
SHA512d1b694e2abf46ffc80879a31ee55dcb4f42d77b14123e99a80fb7c41a295bc5bcfa9d8292637ed128deb8e4c3a586c7b8518d305e6f66ac866783e3f7133359e
-
Filesize
4.2MB
MD5d7003ff49d2089fbc7d4fc56fe1d7484
SHA12f4a546593505f3732ad803dfb7f0d4eaf7d170f
SHA2561ad9131850474561beb17f304b1264ca9a73fc9a53355a153c43bbdfa920e642
SHA512140a8b15a6347b4765fdc00e4384fe165be63c41c2c679ad5352fc0f57830c295342fcf8f9ad1b60ff12c41dca1849acc4a535fdecdff503ab44f92bdf2907f1
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec