Malware Analysis Report

2025-01-02 06:40

Sample ID 240515-s2eyysga5x
Target eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc
SHA256 eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc

Threat Level: Known bad

The file eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Manipulates WinMonFS driver.

Checks installed software on the system

Adds Run key to start application

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 15:37

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 15:36

Reported

2024-05-15 15:39

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1608 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1608 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1608 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4100 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4100 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4100 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4100 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\system32\cmd.exe
PID 4100 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\system32\cmd.exe
PID 760 wrote to memory of 3420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 760 wrote to memory of 3420 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4100 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4100 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4100 wrote to memory of 3292 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4100 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4100 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4100 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4100 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\rss\csrss.exe
PID 4100 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\rss\csrss.exe
PID 4100 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\rss\csrss.exe
PID 3696 wrote to memory of 3880 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3696 wrote to memory of 3880 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3696 wrote to memory of 3880 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3696 wrote to memory of 3420 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3696 wrote to memory of 3420 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3696 wrote to memory of 3420 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3696 wrote to memory of 3708 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3696 wrote to memory of 3708 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3696 wrote to memory of 3708 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3696 wrote to memory of 4432 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3696 wrote to memory of 4432 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1540 wrote to memory of 4852 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1540 wrote to memory of 4852 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1540 wrote to memory of 4852 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 1268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4852 wrote to memory of 1268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4852 wrote to memory of 1268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe

"C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe

"C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 84.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 67f1f6ed-d0fe-4bb1-8b1d-2d44b8b6d1a6.uuid.datadumpcloud.org udp
US 8.8.8.8:53 28.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 stun2.l.google.com udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server7.datadumpcloud.org udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun2.l.google.com udp
BG 185.82.216.104:443 server7.datadumpcloud.org tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.104:443 server7.datadumpcloud.org tcp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.104:443 server7.datadumpcloud.org tcp
US 8.8.8.8:53 13.179.89.13.in-addr.arpa udp

Files

memory/1608-1-0x0000000004850000-0x0000000004C52000-memory.dmp

memory/1608-2-0x0000000004C60000-0x000000000554B000-memory.dmp

memory/1608-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3708-4-0x0000000074F1E000-0x0000000074F1F000-memory.dmp

memory/3708-5-0x00000000033B0000-0x00000000033E6000-memory.dmp

memory/3708-7-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/3708-6-0x0000000005D20000-0x0000000006348000-memory.dmp

memory/3708-8-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/3708-10-0x0000000005C70000-0x0000000005CD6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rcfsdshb.edi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3708-11-0x00000000063C0000-0x0000000006426000-memory.dmp

memory/3708-9-0x0000000005B10000-0x0000000005B32000-memory.dmp

memory/3708-21-0x0000000006530000-0x0000000006884000-memory.dmp

memory/3708-22-0x00000000069C0000-0x00000000069DE000-memory.dmp

memory/3708-23-0x0000000006A50000-0x0000000006A9C000-memory.dmp

memory/3708-24-0x0000000007920000-0x0000000007964000-memory.dmp

memory/3708-25-0x0000000007CB0000-0x0000000007D26000-memory.dmp

memory/3708-27-0x0000000007D60000-0x0000000007D7A000-memory.dmp

memory/3708-26-0x00000000083B0000-0x0000000008A2A000-memory.dmp

memory/3708-28-0x0000000007F20000-0x0000000007F52000-memory.dmp

memory/3708-31-0x0000000070F30000-0x0000000071284000-memory.dmp

memory/3708-30-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/3708-41-0x0000000007F60000-0x0000000007F7E000-memory.dmp

memory/3708-29-0x0000000070DB0000-0x0000000070DFC000-memory.dmp

memory/3708-42-0x0000000007F80000-0x0000000008023000-memory.dmp

memory/3708-43-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/3708-44-0x0000000008070000-0x000000000807A000-memory.dmp

memory/3708-45-0x0000000008180000-0x0000000008216000-memory.dmp

memory/3708-46-0x0000000008080000-0x0000000008091000-memory.dmp

memory/3708-47-0x00000000080C0000-0x00000000080CE000-memory.dmp

memory/3708-48-0x00000000080E0000-0x00000000080F4000-memory.dmp

memory/3708-49-0x0000000008130000-0x000000000814A000-memory.dmp

memory/3708-50-0x0000000008120000-0x0000000008128000-memory.dmp

memory/3708-53-0x0000000074F10000-0x00000000756C0000-memory.dmp

memory/1608-55-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1608-56-0x0000000004850000-0x0000000004C52000-memory.dmp

memory/1608-57-0x0000000004C60000-0x000000000554B000-memory.dmp

memory/3732-63-0x00000000057D0000-0x0000000005B24000-memory.dmp

memory/3732-68-0x0000000070DB0000-0x0000000070DFC000-memory.dmp

memory/3732-69-0x0000000071550000-0x00000000718A4000-memory.dmp

memory/3732-79-0x0000000007010000-0x00000000070B3000-memory.dmp

memory/3732-80-0x0000000007340000-0x0000000007351000-memory.dmp

memory/1608-83-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4100-82-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3732-84-0x0000000007390000-0x00000000073A4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/3292-94-0x00000000059E0000-0x0000000005D34000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 dbdf56f56b5b8c8c786cd5a98ac799a8
SHA1 0172365ea20201c6f27d914780d8a1e4309641bf
SHA256 9ff25fdab7fdedcafcf8d7f491b7a8faee376a6e9538c8e50b91419d75d19292
SHA512 2ab190a13dd79865e4b83b8b6500ee90928898436adea22fcc68929eaf71bd16dbec4ae4e0234e426e83d8acf7e9b4e06e1afe84b527e3eeba133aa74c81501e

memory/3292-99-0x0000000070DB0000-0x0000000070DFC000-memory.dmp

memory/3292-100-0x0000000071530000-0x0000000071884000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 03559687bd06aaae189988427778524e
SHA1 dfc39de4368ef323a64241a17adb47e973f9497f
SHA256 a6cdaecdb33aeb89e5e8045f078c54b2168fd92f418d9f09f3ba5d8328a6b067
SHA512 b8f210c4ee860b6aaa2a010fcabdd35aa0b24739cc51833c7aad2a27e95272de569a5d87671ba36889e3adf03adfe3ee0af26bd30631929118a0f3310e41afeb

memory/2824-121-0x0000000070DB0000-0x0000000070DFC000-memory.dmp

memory/2824-122-0x0000000071530000-0x0000000071884000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 6e970a7404786e5a9f6a27982a558982
SHA1 8684c48f889339ec994a8d3d255b22c17f0c5a32
SHA256 eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc
SHA512 3ab47ba9b56cbc53f1ace02cb409d857db2477b96fce71a75cb2a462bf8d0b5d6589d67d039ad44de3f810180e2e7655b20801ab47bd8ad6975768c046fdddfb

memory/4100-136-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7f02bbdbe43cc48f17a0b03768076991
SHA1 528b638d5075d1ecf839156bded318d67a502b0a
SHA256 d1821caf9452bf8a0fdcbc9e31e507f84c1efceb3c400e3ef89732e679a6ee41
SHA512 53957c18555f7d7901eaf8febe7982b4e04983b1c5008c4797eac1df097db3334fc1b00c709c24eb89fe5c18487d8d3c8f6a8a0860c83fffb4541fdeeae75c51

memory/3880-150-0x0000000070DB0000-0x0000000070DFC000-memory.dmp

memory/3880-151-0x0000000071530000-0x0000000071884000-memory.dmp

memory/3420-171-0x0000000006470000-0x00000000067C4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 23f462228e7ced5253f8927bea27af69
SHA1 0268c3d2034baada23a1d37100c9efc72f7ac0e2
SHA256 3aa49b290a8de56c7de1faff7ba2ad224c71a56d84d741f9a60237023601eb63
SHA512 ff55971df818e9f52c065be9e27f23f2c05088def429bc1aa915342035bd2bfc3a4c7f7c016737b38cb2ac2b7cbaad24704b16647db8661af9eae94f48752d73

memory/3420-173-0x0000000006E80000-0x0000000006ECC000-memory.dmp

memory/3420-174-0x0000000070CD0000-0x0000000070D1C000-memory.dmp

memory/3420-175-0x0000000070E50000-0x00000000711A4000-memory.dmp

memory/3420-185-0x0000000007BE0000-0x0000000007C83000-memory.dmp

memory/3420-186-0x0000000007E90000-0x0000000007EA1000-memory.dmp

memory/3420-187-0x0000000006340000-0x0000000006354000-memory.dmp

memory/3708-189-0x00000000059F0000-0x0000000005D44000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 620dad8f5e425052346ad375ffec4962
SHA1 52e35261f42c054da1acc591f29c45cfa9506255
SHA256 c17e3b33665d39a97fb4d38e43753e1c7910c5c7ad05956f1644fbf9ad816e87
SHA512 5afbd07de882dc9d726ec7bb509f71fdc035214e0d3a38222f8bcbe04285b9d26bdae43482951c22f219961451cd891d9a6a12421e4f58bb513132a850ee12b0

memory/3708-200-0x0000000070CD0000-0x0000000070D1C000-memory.dmp

memory/3708-201-0x0000000071460000-0x00000000717B4000-memory.dmp

memory/3696-212-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3696-220-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1540-224-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2904-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1540-229-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3696-231-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2904-232-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3696-233-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3696-236-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2904-238-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3696-239-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3696-242-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3696-246-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3696-248-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3696-251-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3696-254-0x0000000000400000-0x0000000002B0B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 15:36

Reported

2024-05-15 15:39

Platform

win11-20240419-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-12 = "Azores Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3692 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3692 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3692 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3416 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3416 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3416 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3416 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\system32\cmd.exe
PID 3416 wrote to memory of 1456 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\system32\cmd.exe
PID 1456 wrote to memory of 4888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1456 wrote to memory of 4888 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3416 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3416 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3416 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3416 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3416 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3416 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3416 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\rss\csrss.exe
PID 3416 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\rss\csrss.exe
PID 3416 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe C:\Windows\rss\csrss.exe
PID 2104 wrote to memory of 2084 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 2084 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 2084 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 4480 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 4480 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 4480 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 2808 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 2808 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 2808 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2104 wrote to memory of 4568 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2104 wrote to memory of 4568 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1628 wrote to memory of 2320 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1628 wrote to memory of 2320 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1628 wrote to memory of 2320 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2320 wrote to memory of 256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2320 wrote to memory of 256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2320 wrote to memory of 256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe

"C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe

"C:\Users\Admin\AppData\Local\Temp\eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 1fc713b0-4dd0-4d39-902a-6b63c9210f2b.uuid.datadumpcloud.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server6.datadumpcloud.org udp
US 162.159.129.233:443 cdn.discordapp.com tcp
DE 81.3.27.44:3478 stun.ipfire.org udp
BG 185.82.216.104:443 server6.datadumpcloud.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.104:443 server6.datadumpcloud.org tcp
BG 185.82.216.104:443 server6.datadumpcloud.org tcp

Files

memory/3692-1-0x00000000048E0000-0x0000000004CDA000-memory.dmp

memory/3692-2-0x0000000004CE0000-0x00000000055CB000-memory.dmp

memory/3692-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3024-4-0x00000000749BE000-0x00000000749BF000-memory.dmp

memory/3024-5-0x0000000004AE0000-0x0000000004B16000-memory.dmp

memory/3024-6-0x0000000005280000-0x00000000058AA000-memory.dmp

memory/3024-7-0x00000000749B0000-0x0000000075161000-memory.dmp

memory/3024-8-0x0000000005100000-0x0000000005122000-memory.dmp

memory/3024-10-0x00000000059A0000-0x0000000005A06000-memory.dmp

memory/3024-9-0x00000000051A0000-0x0000000005206000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3fk10cjy.vby.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3024-19-0x0000000005B10000-0x0000000005E67000-memory.dmp

memory/3024-20-0x00000000749B0000-0x0000000075161000-memory.dmp

memory/3024-21-0x0000000005F90000-0x0000000005FAE000-memory.dmp

memory/3024-22-0x0000000006050000-0x000000000609C000-memory.dmp

memory/3024-23-0x0000000006520000-0x0000000006566000-memory.dmp

memory/3024-25-0x00000000073D0000-0x0000000007404000-memory.dmp

memory/3024-26-0x0000000070C20000-0x0000000070C6C000-memory.dmp

memory/3024-36-0x0000000007410000-0x000000000742E000-memory.dmp

memory/3024-27-0x0000000070DA0000-0x00000000710F7000-memory.dmp

memory/3024-37-0x0000000007430000-0x00000000074D4000-memory.dmp

memory/3024-38-0x00000000749B0000-0x0000000075161000-memory.dmp

memory/3024-39-0x00000000749B0000-0x0000000075161000-memory.dmp

memory/3692-24-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3024-40-0x0000000007BA0000-0x000000000821A000-memory.dmp

memory/3024-41-0x0000000007560000-0x000000000757A000-memory.dmp

memory/3024-42-0x00000000075A0000-0x00000000075AA000-memory.dmp

memory/3024-43-0x00000000076B0000-0x0000000007746000-memory.dmp

memory/3024-44-0x00000000075C0000-0x00000000075D1000-memory.dmp

memory/3024-45-0x0000000007610000-0x000000000761E000-memory.dmp

memory/3024-46-0x0000000007620000-0x0000000007635000-memory.dmp

memory/3024-47-0x0000000007670000-0x000000000768A000-memory.dmp

memory/3024-48-0x00000000076A0000-0x00000000076A8000-memory.dmp

memory/3024-51-0x00000000749B0000-0x0000000075161000-memory.dmp

memory/3692-53-0x00000000048E0000-0x0000000004CDA000-memory.dmp

memory/3692-54-0x0000000004CE0000-0x00000000055CB000-memory.dmp

memory/3692-56-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3692-55-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3964-57-0x0000000006450000-0x00000000067A7000-memory.dmp

memory/3964-66-0x0000000070C20000-0x0000000070C6C000-memory.dmp

memory/3964-67-0x0000000070E70000-0x00000000711C7000-memory.dmp

memory/3964-76-0x0000000007920000-0x00000000079C4000-memory.dmp

memory/3964-77-0x0000000007E70000-0x0000000007E81000-memory.dmp

memory/3416-78-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3964-79-0x0000000007EC0000-0x0000000007ED5000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c8ffa606a993ac985c5d9a0bad237a3b
SHA1 12bae422cf4adce140a21d31f523b6f8378f1e31
SHA256 75bb054e1bc67c292599dbd5fa70bb9387d24089eebcd018db6d992d27edf286
SHA512 dc607b4ce6d21cf9c094318326d64fc205dc29b572989c663421886ada15b1ba62caf185fc52d7c23e0bbbf7db4bf5f0931eee7e32f345e9209cf0dc7dad2e05

memory/2192-93-0x0000000070E70000-0x00000000711C7000-memory.dmp

memory/2192-92-0x0000000070C20000-0x0000000070C6C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 cea7602c3e6610e3e0b91710168cd093
SHA1 004e087d1504690082ab71b01c9901a1be96d19f
SHA256 3091d4e5cab4d8a33b8fee9b589886d81ff64a84a6b39129b2f94f3e0ebb5ff0
SHA512 c47fa592230d219b3311fbe7156ac6bdeddc44e3ffdcc61093bbb5c96cfbab9f32aa3d17081a4f3d984dfbdc541fa440ce94181addf6bfdfba84cfda857e411e

memory/5080-112-0x0000000070C20000-0x0000000070C6C000-memory.dmp

memory/5080-113-0x0000000070DA0000-0x00000000710F7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 6e970a7404786e5a9f6a27982a558982
SHA1 8684c48f889339ec994a8d3d255b22c17f0c5a32
SHA256 eb25d2beb11350982613ed5c44d6e788d4ad6071a8524d8f785167865245ebbc
SHA512 3ab47ba9b56cbc53f1ace02cb409d857db2477b96fce71a75cb2a462bf8d0b5d6589d67d039ad44de3f810180e2e7655b20801ab47bd8ad6975768c046fdddfb

memory/3416-129-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2084-139-0x0000000005890000-0x0000000005BE7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2da98e1ded8fe2e2f3c58a9a7713ae49
SHA1 e655dafd8bb9ee5c07480872c2dea0f98c6653fb
SHA256 7fe5956441f8759bde2767a1b230e6c5141c4fc7e9e4d758064e2570057d6e28
SHA512 aaa37823dfa0b823febe145cbe83e36014bdc5a581d340920e5c36838476a2a24122dc2597aba559b142fa216c42ed7edb5f10fcba2c4059a3be9b5b0c532ef6

memory/2084-141-0x0000000070C20000-0x0000000070C6C000-memory.dmp

memory/2084-142-0x0000000070E30000-0x0000000071187000-memory.dmp

memory/4480-153-0x0000000005BC0000-0x0000000005F17000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d116eb570b091f501976f1d91412321d
SHA1 cf854aab3e1ab5ccb4dc52d7f799233aa5f07b00
SHA256 57bf6ebd6cdd3a1233535df0a3aa22fd856fadf3b62e6812987ab6746ab985b9
SHA512 3335524697389ff64948c48dc1cde8db3f7f8892405dfab6b16215cc8e050446d24be03b774e1918acd1c96d1ca8bf8fa603ea92e81e7ae6227215e4d727bc21

memory/4480-163-0x00000000061F0000-0x000000000623C000-memory.dmp

memory/4480-165-0x0000000070D90000-0x00000000710E7000-memory.dmp

memory/4480-164-0x0000000070B40000-0x0000000070B8C000-memory.dmp

memory/4480-174-0x00000000073B0000-0x0000000007454000-memory.dmp

memory/4480-175-0x00000000075B0000-0x00000000075C1000-memory.dmp

memory/4480-176-0x0000000005F60000-0x0000000005F75000-memory.dmp

memory/2808-186-0x0000000005C30000-0x0000000005F87000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1bbc5aea83635ad0ae57e61c4ba35ed8
SHA1 0309d14aa64dbb55b8e56434911ea52b65def53f
SHA256 87cba1bb89a2f3da3c61f0b945273a8e115baa97b6f4c667e0565d91906ddc6d
SHA512 29ae546e098322542b9a00f31946882ced93fc920874246146c5bc38022bd2e85babfbf76dae56974ffd05a5d0392618e1a4e139577726078a598561885d03cf

memory/2808-188-0x0000000070B40000-0x0000000070B8C000-memory.dmp

memory/2808-189-0x0000000070CC0000-0x0000000071017000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2104-205-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1628-211-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1628-215-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2104-216-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1868-220-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2104-219-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2104-224-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1868-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2104-228-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2104-232-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2104-235-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2104-240-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2104-244-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2104-247-0x0000000000400000-0x0000000002B0B000-memory.dmp