Malware Analysis Report

2025-01-02 06:43

Sample ID 240515-3jgd6shg6s
Target 79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1
SHA256 79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1

Threat Level: Known bad

The file 79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Checks installed software on the system

Adds Run key to start application

Manipulates WinMonFS driver.

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Command and Scripting Interpreter: PowerShell

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 23:32

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 23:32

Reported

2024-05-15 23:35

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1284 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1284 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1284 wrote to memory of 2380 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\system32\cmd.exe
PID 4796 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\system32\cmd.exe
PID 2056 wrote to memory of 1780 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2056 wrote to memory of 1780 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 3468 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 2040 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4796 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\rss\csrss.exe
PID 4796 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\rss\csrss.exe
PID 4796 wrote to memory of 3224 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\rss\csrss.exe
PID 3224 wrote to memory of 4400 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3224 wrote to memory of 4400 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3224 wrote to memory of 4400 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3224 wrote to memory of 4296 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3224 wrote to memory of 4296 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3224 wrote to memory of 4296 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3224 wrote to memory of 2428 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3224 wrote to memory of 2428 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3224 wrote to memory of 2428 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3224 wrote to memory of 3416 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3224 wrote to memory of 3416 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1476 wrote to memory of 3784 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1476 wrote to memory of 3784 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1476 wrote to memory of 3784 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3784 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3784 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3784 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe

"C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe

"C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.123:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.107.123:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 123.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 47bac46d-b612-46be-8b53-cb3abbd44b85.uuid.realupdate.ru udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 stun4.l.google.com udp
US 8.8.8.8:53 server16.realupdate.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun4.l.google.com udp
BG 185.82.216.96:443 server16.realupdate.ru tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
BG 185.82.216.96:443 server16.realupdate.ru tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
BG 185.82.216.96:443 server16.realupdate.ru tcp

Files

memory/1284-1-0x00000000047D0000-0x0000000004BD7000-memory.dmp

memory/1284-2-0x0000000004BE0000-0x00000000054CB000-memory.dmp

memory/1284-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2380-4-0x00000000740AE000-0x00000000740AF000-memory.dmp

memory/2380-5-0x0000000003140000-0x0000000003176000-memory.dmp

memory/2380-7-0x00000000740A0000-0x0000000074850000-memory.dmp

memory/2380-6-0x0000000005930000-0x0000000005F58000-memory.dmp

memory/2380-8-0x00000000740A0000-0x0000000074850000-memory.dmp

memory/2380-9-0x0000000005870000-0x0000000005892000-memory.dmp

memory/2380-10-0x0000000005FD0000-0x0000000006036000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jsnqajok.0x4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2380-11-0x00000000060F0000-0x0000000006156000-memory.dmp

memory/2380-21-0x0000000006260000-0x00000000065B4000-memory.dmp

memory/2380-22-0x0000000006710000-0x000000000672E000-memory.dmp

memory/2380-23-0x00000000067D0000-0x000000000681C000-memory.dmp

memory/2380-24-0x0000000006CB0000-0x0000000006CF4000-memory.dmp

memory/2380-25-0x0000000007A40000-0x0000000007AB6000-memory.dmp

memory/2380-27-0x0000000007AE0000-0x0000000007AFA000-memory.dmp

memory/2380-26-0x0000000008140000-0x00000000087BA000-memory.dmp

memory/2380-31-0x00000000700C0000-0x0000000070414000-memory.dmp

memory/2380-41-0x0000000007CE0000-0x0000000007CFE000-memory.dmp

memory/2380-42-0x0000000007D00000-0x0000000007DA3000-memory.dmp

memory/2380-30-0x00000000740A0000-0x0000000074850000-memory.dmp

memory/2380-43-0x0000000007DF0000-0x0000000007DFA000-memory.dmp

memory/2380-28-0x0000000007CA0000-0x0000000007CD2000-memory.dmp

memory/2380-29-0x000000006FF40000-0x000000006FF8C000-memory.dmp

memory/2380-44-0x00000000740A0000-0x0000000074850000-memory.dmp

memory/2380-45-0x0000000007EB0000-0x0000000007F46000-memory.dmp

memory/2380-46-0x0000000007E10000-0x0000000007E21000-memory.dmp

memory/2380-47-0x0000000007E50000-0x0000000007E5E000-memory.dmp

memory/2380-48-0x0000000007E60000-0x0000000007E74000-memory.dmp

memory/2380-50-0x0000000007EA0000-0x0000000007EA8000-memory.dmp

memory/2380-49-0x0000000007F50000-0x0000000007F6A000-memory.dmp

memory/2380-53-0x00000000740A0000-0x0000000074850000-memory.dmp

memory/1284-55-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1284-56-0x00000000047D0000-0x0000000004BD7000-memory.dmp

memory/1284-57-0x0000000004BE0000-0x00000000054CB000-memory.dmp

memory/4904-58-0x0000000005540000-0x0000000005894000-memory.dmp

memory/4904-68-0x000000006FF40000-0x000000006FF8C000-memory.dmp

memory/4904-69-0x00000000706C0000-0x0000000070A14000-memory.dmp

memory/4904-79-0x0000000006DA0000-0x0000000006E43000-memory.dmp

memory/4904-80-0x00000000070D0000-0x00000000070E1000-memory.dmp

memory/4904-81-0x0000000007120000-0x0000000007134000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/3468-94-0x0000000005B20000-0x0000000005E74000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 15c37182475d5fb49c77f08e9cdcd41d
SHA1 c09f9441d9ef86126b5907e4065527ff992b989d
SHA256 009a2e44c4626a3f39985bc22e2e948e455cc9ee2967357160d581260459a176
SHA512 519e15cc0d21c1af15908c13e3e6215f49db2d3f1957aae9839f65f232da6bc57a1514cf6a3c412b304eac24832b9d5eb14ee68847b8a12c8a586c14c480708e

memory/3468-96-0x000000006FF40000-0x000000006FF8C000-memory.dmp

memory/3468-97-0x0000000070940000-0x0000000070C94000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 80fecd60e26beeef99d7b6db129aadca
SHA1 af9917ebeef30a3f5bc729b2f09e4d23195d5ff5
SHA256 028c6330e82bb4cfd6cb6410cf83856f8f103e8c18a039b93558146aa341fab9
SHA512 bd4aa54c8d5eaccaa0b70c087284a3c87751037d438906f4bb5089652f87a974f446883cf31a5a1d3ee4292c7d65fb70e3c5f1f2dfe5850d711c0792c5cc2767

memory/1284-120-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4796-119-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2040-121-0x000000006FF40000-0x000000006FF8C000-memory.dmp

memory/2040-122-0x00000000700C0000-0x0000000070414000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 abd59d1c428fd2c9b1d1628705e2e652
SHA1 9f422b95cc815e117cf2b9167eb6192c3b09af5f
SHA256 79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1
SHA512 a9a952a96bb0f35af5c067befc6e76a6d65b4be054633e1476d0306ba7b2b8c406c080ecee3b110fff29c9aa488e0306eff001225e8f74bfd90f2d4beb60cda6

memory/4400-147-0x0000000006370000-0x00000000066C4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c6a188b55ed64d163b65fac2a5ec9ea3
SHA1 908040b9c06d28d1b332dc95976316517d7d0c72
SHA256 84c8ea7b41458e4d23da350d284eb4dc23d5be2c52f4d32a8a9f55ae98253b7a
SHA512 ef68dfca3051fc81ab6083114f5e8895db470b1adfa726dd72b2a45af57428d344f8f1ac6b28b65602cb84ec1a637873e0db5b6be0b700cfd043e8452f535db9

memory/4400-149-0x000000006FF40000-0x000000006FF8C000-memory.dmp

memory/4400-150-0x0000000070100000-0x0000000070454000-memory.dmp

memory/4296-167-0x0000000005430000-0x0000000005784000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 09ad1497bf27f4e6f60cbb8e1c60d22f
SHA1 c7677921a42d26c0c2303fbda9efbedf92078615
SHA256 be180f61495a2a0cb73b77b563d522748fe5e6499636357d53ee19908af5cb19
SHA512 41a2a444a40de1c636324dc5a7567c338e77f117e59a3a0e0af6ab497397fa169f2fdbe922bace6659ea22ed1c6dbb7251531565655ea590db1ad3490e66515c

memory/4296-172-0x0000000006140000-0x000000000618C000-memory.dmp

memory/4296-173-0x000000006FE60000-0x000000006FEAC000-memory.dmp

memory/4296-174-0x0000000070C30000-0x0000000070F84000-memory.dmp

memory/4296-184-0x0000000006E00000-0x0000000006EA3000-memory.dmp

memory/4296-185-0x0000000007140000-0x0000000007151000-memory.dmp

memory/4296-186-0x0000000005990000-0x00000000059A4000-memory.dmp

memory/2428-197-0x00000000056D0000-0x0000000005A24000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 198648a9668c8910d3c475ef3c6c24eb
SHA1 b25f54cae41c9489c1fe3d7b2f2080b9f9b7b60e
SHA256 c3cbb2991301a831e4bb66d058909eeb0713394400c941e2b2ce919d5b5fc08a
SHA512 333f6ba22c842dee399844474c41f22bf5f3f33ab68821d034f331fdfe0e53c373fe32c45dd176ccf5b26c463428577d75837c64792edc7c0e9f003ddf42fc4d

memory/2428-200-0x000000006FFE0000-0x0000000070334000-memory.dmp

memory/2428-199-0x000000006FE60000-0x000000006FEAC000-memory.dmp

memory/4796-212-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3224-218-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1476-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4688-229-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1476-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3224-230-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4688-234-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3224-233-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3224-237-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4688-242-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3224-241-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3224-246-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3224-249-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3224-253-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3224-257-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3224-261-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3224-266-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3224-269-0x0000000000400000-0x0000000002B0B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 23:32

Reported

2024-05-15 23:35

Platform

win11-20240508-en

Max time kernel

150s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-572 = "China Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4556 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4556 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4556 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\system32\cmd.exe
PID 3380 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\system32\cmd.exe
PID 3212 wrote to memory of 2076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3212 wrote to memory of 2076 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3380 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 4656 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\rss\csrss.exe
PID 3380 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\rss\csrss.exe
PID 3380 wrote to memory of 2508 N/A C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe C:\Windows\rss\csrss.exe
PID 2508 wrote to memory of 2244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 2244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 2244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 4944 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 4944 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 4944 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 4076 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 4076 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 4076 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2508 wrote to memory of 1884 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2508 wrote to memory of 1884 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4624 wrote to memory of 1652 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4624 wrote to memory of 1652 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4624 wrote to memory of 1652 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 1944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1652 wrote to memory of 1944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1652 wrote to memory of 1944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe

"C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe

"C:\Users\Admin\AppData\Local\Temp\79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun1.l.google.com udp
BG 185.82.216.96:443 server6.realupdate.ru tcp
US 172.67.221.71:443 carsalessystem.com tcp
BG 185.82.216.96:443 server6.realupdate.ru tcp
SE 192.229.221.95:80 tcp

Files

memory/4556-1-0x00000000048F0000-0x0000000004CF0000-memory.dmp

memory/4556-2-0x0000000004CF0000-0x00000000055DB000-memory.dmp

memory/4556-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3696-4-0x0000000074DAE000-0x0000000074DAF000-memory.dmp

memory/3696-5-0x0000000003300000-0x0000000003336000-memory.dmp

memory/3696-7-0x0000000005AC0000-0x00000000060EA000-memory.dmp

memory/3696-6-0x0000000074DA0000-0x0000000075551000-memory.dmp

memory/3696-9-0x00000000061F0000-0x0000000006256000-memory.dmp

memory/3696-8-0x00000000058F0000-0x0000000005912000-memory.dmp

memory/3696-10-0x0000000006260000-0x00000000062C6000-memory.dmp

memory/3696-11-0x0000000074DA0000-0x0000000075551000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3tslxcj4.zrr.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3696-20-0x00000000062D0000-0x0000000006627000-memory.dmp

memory/3696-21-0x00000000067B0000-0x00000000067CE000-memory.dmp

memory/3696-22-0x0000000006800000-0x000000000684C000-memory.dmp

memory/3696-23-0x0000000006D20000-0x0000000006D66000-memory.dmp

memory/3696-25-0x0000000007BC0000-0x0000000007BF4000-memory.dmp

memory/3696-26-0x0000000071010000-0x000000007105C000-memory.dmp

memory/3696-27-0x00000000711A0000-0x00000000714F7000-memory.dmp

memory/3696-36-0x0000000007C20000-0x0000000007C3E000-memory.dmp

memory/3696-37-0x0000000007C40000-0x0000000007CE4000-memory.dmp

memory/3696-38-0x0000000074DA0000-0x0000000075551000-memory.dmp

memory/4556-24-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3696-40-0x0000000007D70000-0x0000000007D8A000-memory.dmp

memory/3696-39-0x00000000083B0000-0x0000000008A2A000-memory.dmp

memory/3696-41-0x0000000007DB0000-0x0000000007DBA000-memory.dmp

memory/3696-42-0x0000000007EC0000-0x0000000007F56000-memory.dmp

memory/3696-43-0x0000000007DD0000-0x0000000007DE1000-memory.dmp

memory/3696-44-0x0000000007E20000-0x0000000007E2E000-memory.dmp

memory/3696-45-0x0000000007E30000-0x0000000007E45000-memory.dmp

memory/3696-46-0x0000000007E80000-0x0000000007E9A000-memory.dmp

memory/3696-47-0x0000000007EB0000-0x0000000007EB8000-memory.dmp

memory/3696-50-0x0000000074DA0000-0x0000000075551000-memory.dmp

memory/4556-53-0x00000000048F0000-0x0000000004CF0000-memory.dmp

memory/4556-54-0x0000000004CF0000-0x00000000055DB000-memory.dmp

memory/4556-52-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1952-63-0x0000000005A00000-0x0000000005D57000-memory.dmp

memory/1952-64-0x0000000071010000-0x000000007105C000-memory.dmp

memory/1952-65-0x0000000071190000-0x00000000714E7000-memory.dmp

memory/4556-76-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1952-75-0x0000000007070000-0x0000000007114000-memory.dmp

memory/3380-66-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1952-77-0x0000000007390000-0x00000000073A1000-memory.dmp

memory/1952-78-0x00000000073E0000-0x00000000073F5000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/4656-87-0x0000000005740000-0x0000000005A97000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2154cdc288001c472298156de6e35bc3
SHA1 23ddebedf106255a455aec2dd3294c931a33ef8e
SHA256 e3e72f3c7f9840206c550fe8cbae711d8b1aed31af4cdaa41c3dc3b5e34800e4
SHA512 dbe0077ecb8a2aba3674320ff69d91011bd09e81fedbd166974cee3b88c9b8741f44c270763ea76fb8a3439d1362f162ea819ac397e69faca9a7f3fb7ff2d769

memory/4656-92-0x0000000071010000-0x000000007105C000-memory.dmp

memory/4656-93-0x0000000071240000-0x0000000071597000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4d1bf97932702566ca76999524965655
SHA1 c00a9cb55b36a19a97acef94a27375aeff754f9e
SHA256 c868df29c4342ed95be7eb34bd40ee0a4716851e80a136a8c554acb76d47fcbf
SHA512 810aadfa2d24bc547c172bd20d44fa67ae806b70336a93926711c905417663ae97cd50b266e2bd1ac5f156d995156627ed9c55cf05d972d32ff615454404bba7

memory/2956-112-0x0000000071010000-0x000000007105C000-memory.dmp

memory/2956-113-0x0000000071190000-0x00000000714E7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 abd59d1c428fd2c9b1d1628705e2e652
SHA1 9f422b95cc815e117cf2b9167eb6192c3b09af5f
SHA256 79d1a7d83f7ddaf3abc53cead355293a5e677f6a9e2b7f12f8c3bfb393b0a1d1
SHA512 a9a952a96bb0f35af5c067befc6e76a6d65b4be054633e1476d0306ba7b2b8c406c080ecee3b110fff29c9aa488e0306eff001225e8f74bfd90f2d4beb60cda6

memory/3380-127-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2244-139-0x0000000006270000-0x00000000065C7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 381cd7bfc0b4884d56a044cfacdd4e0e
SHA1 d1beddc00f7e21c7e6008d5eb8de927131fc1b18
SHA256 23c47d82335081e3f6315c929fb9011138415244bbed0b13ee7238038029c233
SHA512 610410e6bcade3efb9e4411431928f0e1ebcff5428be20852258230fbdec4cbaa9685577ae08208a4633533cfa15ab8bf2c4fef2448d86cf411606fa4371f95a

memory/2244-142-0x0000000071220000-0x0000000071577000-memory.dmp

memory/2244-141-0x0000000071010000-0x000000007105C000-memory.dmp

memory/4944-160-0x00000000058D0000-0x0000000005C27000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f0ca1cff522af3aaa8d3c0979bd664b8
SHA1 bfed1cf7d8584d59746f6b26691077743e5731ca
SHA256 e91e6b31e7d3b9ef184c5ddf7767e1257c92255f38e8aa5b4e119fd58be20214
SHA512 5a67a72c0d65369ea0de8872fe9f68c64d2aae1ba07903e0e615598370290e45e33b90dbf3895063869ba280c7160848c099e8ca56c926ffb5abb88d5fed5fb6

memory/4944-162-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

memory/4944-163-0x0000000070F30000-0x0000000070F7C000-memory.dmp

memory/4944-164-0x00000000710B0000-0x0000000071407000-memory.dmp

memory/4944-173-0x00000000070C0000-0x0000000007164000-memory.dmp

memory/4944-174-0x0000000007450000-0x0000000007461000-memory.dmp

memory/4944-176-0x0000000005C50000-0x0000000005C65000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5d5a34d55242fe9f6b0eeb9284cac63d
SHA1 43987c26f16b5ec1f49fe01ff9584e4730b99f7b
SHA256 782ee8b0ae4385a1d8531cd02d33b56cf51f217e4194fb9f69011ee50c4bb0ca
SHA512 e3b42e3fa8c3f415464247946ba46065a5b1c3fb749e46454c13210a815954e0f2d26e6a219387b6821d34ed819293dddf73f19977ecdd6389493cb1c0a90597

memory/4076-188-0x00000000710B0000-0x0000000071407000-memory.dmp

memory/4076-187-0x0000000070F30000-0x0000000070F7C000-memory.dmp

memory/2508-197-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2508-205-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4624-209-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2424-212-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4624-214-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2508-216-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2424-217-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2508-219-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2508-222-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2424-223-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2508-225-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2508-228-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2508-231-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2508-234-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2508-237-0x0000000000400000-0x0000000002B0B000-memory.dmp