Malware Analysis Report

2025-01-02 06:40

Sample ID 240515-sppbvsfc5v
Target 1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394
SHA256 1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394

Threat Level: Known bad

The file 1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Checks installed software on the system

Manipulates WinMonFS driver.

Adds Run key to start application

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Command and Scripting Interpreter: PowerShell

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 15:18

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 15:18

Reported

2024-05-15 15:20

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3272 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3272 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3272 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4144 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4144 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4144 wrote to memory of 4844 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4144 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\system32\cmd.exe
PID 4144 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\system32\cmd.exe
PID 3328 wrote to memory of 3184 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3328 wrote to memory of 3184 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4144 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4144 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4144 wrote to memory of 3044 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4144 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4144 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4144 wrote to memory of 5080 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4144 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\rss\csrss.exe
PID 4144 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\rss\csrss.exe
PID 4144 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\rss\csrss.exe
PID 3892 wrote to memory of 2504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3892 wrote to memory of 2504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3892 wrote to memory of 2504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3892 wrote to memory of 2756 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3892 wrote to memory of 2756 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3892 wrote to memory of 2756 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3892 wrote to memory of 1060 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3892 wrote to memory of 1060 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3892 wrote to memory of 1060 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3892 wrote to memory of 3896 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3892 wrote to memory of 3896 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4816 wrote to memory of 3852 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 3852 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 3852 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3852 wrote to memory of 4776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3852 wrote to memory of 4776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3852 wrote to memory of 4776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe

"C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe

"C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BE 2.17.196.115:443 www.bing.com tcp
US 8.8.8.8:53 115.196.17.2.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
BE 2.17.196.115:443 www.bing.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 98.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 49f0324d-3c2d-458e-870a-d4c3e72b4eb9.uuid.datadumpcloud.org udp
US 8.8.8.8:53 stun.l.google.com udp
US 8.8.8.8:53 server11.datadumpcloud.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun.l.google.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
BG 185.82.216.104:443 server11.datadumpcloud.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BG 185.82.216.104:443 server11.datadumpcloud.org tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BG 185.82.216.104:443 server11.datadumpcloud.org tcp
US 8.8.8.8:53 90.16.208.104.in-addr.arpa udp

Files

memory/3272-1-0x0000000004980000-0x0000000004D7F000-memory.dmp

memory/3272-2-0x0000000004D80000-0x000000000566B000-memory.dmp

memory/3272-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1612-4-0x0000000074AFE000-0x0000000074AFF000-memory.dmp

memory/1612-5-0x0000000002BA0000-0x0000000002BD6000-memory.dmp

memory/1612-7-0x0000000074AF0000-0x00000000752A0000-memory.dmp

memory/1612-8-0x0000000074AF0000-0x00000000752A0000-memory.dmp

memory/1612-6-0x0000000005730000-0x0000000005D58000-memory.dmp

memory/1612-9-0x0000000005520000-0x0000000005542000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3lz1qwav.ild.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1612-11-0x0000000005E80000-0x0000000005EE6000-memory.dmp

memory/1612-10-0x0000000005E10000-0x0000000005E76000-memory.dmp

memory/1612-21-0x0000000005FF0000-0x0000000006344000-memory.dmp

memory/1612-22-0x00000000064B0000-0x00000000064CE000-memory.dmp

memory/1612-23-0x0000000006500000-0x000000000654C000-memory.dmp

memory/1612-24-0x0000000007490000-0x00000000074D4000-memory.dmp

memory/1612-25-0x0000000007800000-0x0000000007876000-memory.dmp

memory/1612-27-0x00000000078A0000-0x00000000078BA000-memory.dmp

memory/1612-26-0x0000000007F00000-0x000000000857A000-memory.dmp

memory/1612-41-0x0000000007A90000-0x0000000007AAE000-memory.dmp

memory/1612-31-0x0000000070B10000-0x0000000070E64000-memory.dmp

memory/1612-43-0x0000000007BA0000-0x0000000007BAA000-memory.dmp

memory/1612-44-0x0000000074AF0000-0x00000000752A0000-memory.dmp

memory/1612-42-0x0000000007AB0000-0x0000000007B53000-memory.dmp

memory/1612-30-0x0000000074AF0000-0x00000000752A0000-memory.dmp

memory/1612-45-0x0000000007C60000-0x0000000007CF6000-memory.dmp

memory/1612-29-0x0000000070990000-0x00000000709DC000-memory.dmp

memory/1612-28-0x0000000007A50000-0x0000000007A82000-memory.dmp

memory/1612-46-0x0000000007BC0000-0x0000000007BD1000-memory.dmp

memory/1612-47-0x0000000007C00000-0x0000000007C0E000-memory.dmp

memory/1612-48-0x0000000007C10000-0x0000000007C24000-memory.dmp

memory/1612-50-0x0000000007C50000-0x0000000007C58000-memory.dmp

memory/1612-49-0x0000000007D00000-0x0000000007D1A000-memory.dmp

memory/1612-53-0x0000000074AF0000-0x00000000752A0000-memory.dmp

memory/3272-57-0x0000000004D80000-0x000000000566B000-memory.dmp

memory/3272-56-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3272-54-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4844-67-0x0000000005F00000-0x0000000006254000-memory.dmp

memory/4844-68-0x0000000006890000-0x00000000068DC000-memory.dmp

memory/4844-70-0x0000000070A90000-0x0000000070ADC000-memory.dmp

memory/4844-81-0x0000000007520000-0x00000000075C3000-memory.dmp

memory/4844-71-0x0000000070C10000-0x0000000070F64000-memory.dmp

memory/4144-69-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4844-82-0x0000000007830000-0x0000000007841000-memory.dmp

memory/4844-83-0x0000000007880000-0x0000000007894000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/3044-96-0x0000000005AB0000-0x0000000005E04000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3e86631388ec8e9399050fcc3ca711ee
SHA1 0eeecc2dc43eb247bc07326186a9c7baf088e439
SHA256 c6325e0ab66c9c16ee544da394dd961436751ae4773e4b38ab2241c3739db0fd
SHA512 03be6b857f3ec2e3281f3b69860c7774078b357237f23c65c1491faebced1fc1c7a5c13275928accab886808aa136c9d044692d11ad05af36fe044d73d61c33c

memory/3044-98-0x0000000070A90000-0x0000000070ADC000-memory.dmp

memory/3044-99-0x0000000071230000-0x0000000071584000-memory.dmp

memory/5080-116-0x0000000005C80000-0x0000000005FD4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 735cc14365bc426adfd1fc42679bda58
SHA1 0b0cf376de6ce27306140395edc12ad72ed00185
SHA256 645ee6a99dee3a6812c572597b293969dd96a30039dec71ee2b10c68fc61284e
SHA512 e3618cbf38109d8cb1fbcd41b55158795d5f2dfb25aee53e1a32a6a9a47825ba95fd09d739a0bc5e70183e2e3ab2f3dd075c95cc0d5e7a3cf452be27a8dfe8bc

memory/5080-122-0x0000000071280000-0x00000000715D4000-memory.dmp

memory/5080-121-0x0000000070A90000-0x0000000070ADC000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 b50888fc0b0a1d04f2ff4a3a7bd23f51
SHA1 ce131e91e553af9cab999f906d1d2a5d86ee8421
SHA256 1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394
SHA512 244981d4fb8815e518e585616e3f125f1250b9173790d8c5ef72a0b0e679bdf488ada39145110465f3598dd98c167675f67b97305b98dabe784c21ca3e865724

memory/4144-138-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2504-148-0x0000000005670000-0x00000000059C4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 64797031368cae42b2f4ff70e148c44e
SHA1 e7ab43dcd8fd169b790378888cbeaf5171b84a49
SHA256 1a784b6d9c034c484c47df977f1aef2d277a2285d0821e04bf36c0c8030ae845
SHA512 1c2285106d509f85be273235aee46c7d62bde16fcb130605a6b022545bca4af9ea0adc4da1692ff7b035d68bc97adf535b6fc5cffba98703814a53ade0657015

memory/2504-150-0x0000000005C60000-0x0000000005CAC000-memory.dmp

memory/2504-152-0x0000000070B70000-0x0000000070EC4000-memory.dmp

memory/2504-151-0x00000000709F0000-0x0000000070A3C000-memory.dmp

memory/2504-162-0x0000000006E20000-0x0000000006EC3000-memory.dmp

memory/2504-163-0x0000000007150000-0x0000000007161000-memory.dmp

memory/2504-164-0x00000000059F0000-0x0000000005A04000-memory.dmp

memory/2756-175-0x0000000006130000-0x0000000006484000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6e8f4602807f920836f821ecbbb04ecc
SHA1 334ea4ad1f5e5491dc64f3beb39e948164a39f47
SHA256 e4d756cd40933c27ebcfad16423cd33dece61b8be1e8c829fb903b192ce34b6d
SHA512 32bdbbc11fbc1ce61e4bb246497e0304d0ad2e7efdf183e3280d9e2897a786e150b81cac10dfe09eb78b195f414ad120848e82758ede210a2ea6e6ca7433dd11

memory/2756-177-0x0000000006D80000-0x0000000006DCC000-memory.dmp

memory/2756-179-0x00000000710D0000-0x0000000071424000-memory.dmp

memory/2756-178-0x0000000070910000-0x000000007095C000-memory.dmp

memory/2756-189-0x0000000007A50000-0x0000000007AF3000-memory.dmp

memory/2756-190-0x0000000007D80000-0x0000000007D91000-memory.dmp

memory/2756-191-0x0000000006630000-0x0000000006644000-memory.dmp

memory/1060-202-0x0000000005620000-0x0000000005974000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ea748b41925844469b882ef4d7ad5506
SHA1 f75a44836580e10f5d5065e0927a02a5541eaca6
SHA256 cb9194b5f9aaf8d7c830195d30fb3e0740c33d0cfdd5a6d8f91631b093d02fc5
SHA512 1105764404c483d037ebee99d9f42b28a23aa5c887124bd0eb77c2657463ec9e271212cf8cb78fa2a9785a1a7f412c749d281ccd8971e1df7ab2e1739b969c08

memory/1060-205-0x0000000070AD0000-0x0000000070E24000-memory.dmp

memory/1060-204-0x0000000070910000-0x000000007095C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3892-222-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4816-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4816-232-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4780-230-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3892-233-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4780-235-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3892-236-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3892-239-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4780-241-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3892-242-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3892-245-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3892-248-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3892-251-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3892-254-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3892-257-0x0000000000400000-0x0000000002B0B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 15:18

Reported

2024-05-15 15:20

Platform

win11-20240419-en

Max time kernel

149s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3588 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3588 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3588 wrote to memory of 1832 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\system32\cmd.exe
PID 2404 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\system32\cmd.exe
PID 2440 wrote to memory of 2408 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2440 wrote to memory of 2408 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2404 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 3708 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2404 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\rss\csrss.exe
PID 2404 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\rss\csrss.exe
PID 2404 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe C:\Windows\rss\csrss.exe
PID 4320 wrote to memory of 2012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 2012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 2012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 1236 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 1236 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 1236 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 4280 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 4280 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 4280 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4320 wrote to memory of 4276 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4320 wrote to memory of 4276 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1692 wrote to memory of 2616 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1692 wrote to memory of 2616 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1692 wrote to memory of 2616 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2616 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2616 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2616 wrote to memory of 1740 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe

"C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe

"C:\Users\Admin\AppData\Local\Temp\1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 2c7c3c60-3acc-473a-b37c-cd318b12928f.uuid.datadumpcloud.org udp
US 8.8.8.8:53 server7.datadumpcloud.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun.l.google.com udp
BG 185.82.216.104:443 server7.datadumpcloud.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.104:443 server7.datadumpcloud.org tcp
BG 185.82.216.104:443 server7.datadumpcloud.org tcp

Files

memory/3588-1-0x0000000004A50000-0x0000000004E54000-memory.dmp

memory/3588-2-0x0000000004E60000-0x000000000574B000-memory.dmp

memory/3588-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1832-4-0x00000000746DE000-0x00000000746DF000-memory.dmp

memory/1832-5-0x0000000003250000-0x0000000003286000-memory.dmp

memory/1832-6-0x00000000746D0000-0x0000000074E81000-memory.dmp

memory/1832-7-0x0000000005AC0000-0x00000000060EA000-memory.dmp

memory/1832-8-0x0000000005750000-0x0000000005772000-memory.dmp

memory/1832-9-0x0000000005910000-0x0000000005976000-memory.dmp

memory/1832-10-0x0000000005980000-0x00000000059E6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oxhe2t5l.lif.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1832-19-0x00000000061F0000-0x0000000006547000-memory.dmp

memory/1832-20-0x0000000006720000-0x000000000673E000-memory.dmp

memory/1832-21-0x0000000006740000-0x000000000678C000-memory.dmp

memory/1832-22-0x0000000006C20000-0x0000000006C66000-memory.dmp

memory/1832-24-0x0000000007B40000-0x0000000007B74000-memory.dmp

memory/1832-25-0x0000000070940000-0x000000007098C000-memory.dmp

memory/1832-26-0x0000000070AD0000-0x0000000070E27000-memory.dmp

memory/1832-36-0x0000000007BA0000-0x0000000007C44000-memory.dmp

memory/1832-35-0x0000000007B80000-0x0000000007B9E000-memory.dmp

memory/1832-37-0x00000000746D0000-0x0000000074E81000-memory.dmp

memory/3588-23-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1832-40-0x0000000007CC0000-0x0000000007CDA000-memory.dmp

memory/1832-39-0x0000000008310000-0x000000000898A000-memory.dmp

memory/1832-38-0x00000000746D0000-0x0000000074E81000-memory.dmp

memory/1832-41-0x0000000007D00000-0x0000000007D0A000-memory.dmp

memory/1832-42-0x0000000007E10000-0x0000000007EA6000-memory.dmp

memory/1832-43-0x0000000007D30000-0x0000000007D41000-memory.dmp

memory/1832-44-0x0000000007D70000-0x0000000007D7E000-memory.dmp

memory/1832-45-0x0000000007D80000-0x0000000007D95000-memory.dmp

memory/1832-46-0x0000000007DD0000-0x0000000007DEA000-memory.dmp

memory/1832-47-0x0000000007EB0000-0x0000000007EB8000-memory.dmp

memory/1832-50-0x00000000746D0000-0x0000000074E81000-memory.dmp

memory/3588-52-0x0000000004A50000-0x0000000004E54000-memory.dmp

memory/3588-53-0x0000000004E60000-0x000000000574B000-memory.dmp

memory/3588-54-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/788-63-0x0000000006450000-0x00000000067A7000-memory.dmp

memory/788-64-0x0000000070940000-0x000000007098C000-memory.dmp

memory/788-65-0x0000000070B50000-0x0000000070EA7000-memory.dmp

memory/788-74-0x0000000007B60000-0x0000000007C04000-memory.dmp

memory/3588-76-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/788-77-0x0000000007E50000-0x0000000007E61000-memory.dmp

memory/2404-75-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/788-78-0x0000000007EA0000-0x0000000007EB5000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/3708-90-0x00000000057B0000-0x0000000005B07000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b8337349c117c1306f1b2417e7109de6
SHA1 a2bf13d6658993c1267fb52f6ed7172e08cdc30b
SHA256 0fac5352abdc35ef7bc9f011e1ce41ffd52aa18cd21ceaa43446a050b427d744
SHA512 5a506469818ace73a54b2f1aa991568fcc76def09f397a7640430ede1dc75d0dd26cce015a4c08678f2b3b031b885faee5b0660c48e35cde27a3e8cf1bfcb5d1

memory/3708-92-0x0000000070940000-0x000000007098C000-memory.dmp

memory/3708-93-0x0000000070B90000-0x0000000070EE7000-memory.dmp

memory/1900-111-0x00000000060A0000-0x00000000063F7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1fe6a8197c340e0adfb8b9d21b6654db
SHA1 b91b4f87912a903788c92bd695f6cbf0f6975edc
SHA256 dfe20c2353cc8df7c85a177c5a3160acdfe157dfe7a1e71bfd291eb54f2421a2
SHA512 17ae6e1d8239407230cdf8112ea7c6225eb0b04964a72d738d3364c3b61d9f9ba423cfc2a7c3be2583c09e486239d82daa36c02e41eb4d8e9b7d72ec387c6085

memory/1900-113-0x0000000070940000-0x000000007098C000-memory.dmp

memory/1900-114-0x0000000070AE0000-0x0000000070E37000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 b50888fc0b0a1d04f2ff4a3a7bd23f51
SHA1 ce131e91e553af9cab999f906d1d2a5d86ee8421
SHA256 1f3c5edc2163210b2c9b10e437299a5eb1dcf0ec34808b7347b5e6969324c394
SHA512 244981d4fb8815e518e585616e3f125f1250b9173790d8c5ef72a0b0e679bdf488ada39145110465f3598dd98c167675f67b97305b98dabe784c21ca3e865724

memory/2404-130-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4320-132-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2012-141-0x0000000005B30000-0x0000000005E87000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f4770afd849b9c57340d629b501cfbe1
SHA1 9a620e64e7de200d1f7e3e3fd269a7a13c5aa41f
SHA256 f472371879ca06cb9f4b0ff85995be3a4c6efbc407a6094d58d4ba4eefc64ec7
SHA512 a859cc0ab27fdd8f3e53d7534d33fff75d174aaaf8c3ac047b8056faefaecdc5dbf6dc08fd88bb5115801a9afff3239e953a4c4e85aa2c089c37006715002b03

memory/2012-144-0x0000000070AC0000-0x0000000070E17000-memory.dmp

memory/2012-143-0x0000000070940000-0x000000007098C000-memory.dmp

memory/1236-162-0x0000000006530000-0x0000000006887000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 fb5773d63d1d2a94a10ae8054e907e21
SHA1 399aa5c22ccc5f136c9b0a28950eda26c39803e1
SHA256 ee813eed464003e43e641e45543652a395c875759f873eb1dcc915aec7dbdf0c
SHA512 d8e5108f655708faa29580cfd39c31d6f341eb175b64dd616dd573f2aa26f7f359325c4d46cc4251fd81a7b1884f78951eae1f1350a1832520dc00f78d5ae0ce

memory/1236-164-0x00000000069B0000-0x00000000069FC000-memory.dmp

memory/1236-166-0x00000000709E0000-0x0000000070D37000-memory.dmp

memory/1236-165-0x0000000070860000-0x00000000708AC000-memory.dmp

memory/1236-175-0x0000000007BE0000-0x0000000007C84000-memory.dmp

memory/1236-176-0x0000000007F50000-0x0000000007F61000-memory.dmp

memory/1236-177-0x00000000062F0000-0x0000000006305000-memory.dmp

memory/4280-184-0x0000000005480000-0x00000000057D7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 697f346d3d353ef1aeb51610c4fab68a
SHA1 3c75ce23e3104ca7a1eaa56a605c02ef2518629e
SHA256 e0afd52a0162be8146f957e6fae81b4fc42febfdadfe2328e8a37777879f260d
SHA512 7b0fb4d3990fd7f592cb8b09f6b916b2ebc3bf33820cce43a7b49b06208e48a7dd937336b0273807602b6b1dc01bdd172a9e81c035ab8151c04b8c1d095cb886

memory/4280-190-0x0000000070AB0000-0x0000000070E07000-memory.dmp

memory/4280-189-0x0000000070860000-0x00000000708AC000-memory.dmp

memory/4320-200-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1692-212-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4320-211-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2952-215-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1692-217-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4320-219-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2952-220-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4320-222-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2952-226-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4320-225-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4320-228-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4320-231-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4320-234-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4320-237-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4320-240-0x0000000000400000-0x0000000002B0B000-memory.dmp