Malware Analysis Report

2025-01-02 06:40

Sample ID 240515-tnf5jahb4v
Target 8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e
SHA256 8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e

Threat Level: Known bad

The file 8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Adds Run key to start application

Checks installed software on the system

Manipulates WinMonFS driver.

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Command and Scripting Interpreter: PowerShell

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 16:12

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 16:12

Reported

2024-05-15 16:14

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-491 = "India Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4580 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4580 wrote to memory of 988 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3344 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3344 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3344 wrote to memory of 3368 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3344 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\system32\cmd.exe
PID 3344 wrote to memory of 4360 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\system32\cmd.exe
PID 4360 wrote to memory of 4000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4360 wrote to memory of 4000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3344 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3344 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3344 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3344 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3344 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3344 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3344 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\rss\csrss.exe
PID 3344 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\rss\csrss.exe
PID 3344 wrote to memory of 2512 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\rss\csrss.exe
PID 2512 wrote to memory of 4552 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 4552 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 4552 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 4168 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 4168 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 4168 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 4564 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 4564 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 4564 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2512 wrote to memory of 2608 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2512 wrote to memory of 2608 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2248 wrote to memory of 3392 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 3392 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2248 wrote to memory of 3392 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3392 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3392 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3392 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe

"C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe

"C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 6b8e6520-5466-4607-ab71-ca4cc234a963.uuid.alldatadump.org udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 server4.alldatadump.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
BG 185.82.216.108:443 server4.alldatadump.org tcp
US 15.197.250.192:3478 stun.sipgate.net udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 192.250.197.15.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.108:443 server4.alldatadump.org tcp
US 8.8.8.8:53 2.181.190.20.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.108:443 server4.alldatadump.org tcp

Files

memory/4580-1-0x0000000004820000-0x0000000004C26000-memory.dmp

memory/4580-2-0x0000000004C30000-0x000000000551B000-memory.dmp

memory/4580-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/988-4-0x00000000744DE000-0x00000000744DF000-memory.dmp

memory/988-5-0x0000000002D60000-0x0000000002D96000-memory.dmp

memory/988-6-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/988-7-0x0000000005AB0000-0x00000000060D8000-memory.dmp

memory/988-8-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/988-9-0x00000000057C0000-0x00000000057E2000-memory.dmp

memory/988-10-0x0000000005860000-0x00000000058C6000-memory.dmp

memory/988-11-0x0000000005A00000-0x0000000005A66000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h0de334b.s0n.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/988-21-0x00000000060E0000-0x0000000006434000-memory.dmp

memory/988-22-0x00000000066F0000-0x000000000670E000-memory.dmp

memory/988-23-0x0000000006720000-0x000000000676C000-memory.dmp

memory/988-24-0x0000000006C50000-0x0000000006C94000-memory.dmp

memory/988-25-0x0000000007A40000-0x0000000007AB6000-memory.dmp

memory/988-26-0x0000000008140000-0x00000000087BA000-memory.dmp

memory/988-27-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

memory/988-29-0x0000000007C80000-0x0000000007CB2000-memory.dmp

memory/988-31-0x0000000070AB0000-0x0000000070E04000-memory.dmp

memory/988-30-0x0000000070370000-0x00000000703BC000-memory.dmp

memory/988-43-0x0000000007CE0000-0x0000000007D83000-memory.dmp

memory/988-42-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/988-44-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/988-45-0x0000000007DD0000-0x0000000007DDA000-memory.dmp

memory/988-41-0x0000000007CC0000-0x0000000007CDE000-memory.dmp

memory/4580-28-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/988-46-0x0000000007EE0000-0x0000000007F76000-memory.dmp

memory/988-47-0x0000000007DE0000-0x0000000007DF1000-memory.dmp

memory/988-48-0x0000000007E20000-0x0000000007E2E000-memory.dmp

memory/988-49-0x0000000007E40000-0x0000000007E54000-memory.dmp

memory/988-50-0x0000000007E80000-0x0000000007E9A000-memory.dmp

memory/988-51-0x0000000007E70000-0x0000000007E78000-memory.dmp

memory/988-54-0x00000000744D0000-0x0000000074C80000-memory.dmp

memory/4580-58-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4580-56-0x0000000004C30000-0x000000000551B000-memory.dmp

memory/4580-55-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3368-68-0x0000000005420000-0x0000000005774000-memory.dmp

memory/3368-69-0x0000000005AB0000-0x0000000005AFC000-memory.dmp

memory/3368-70-0x0000000070470000-0x00000000704BC000-memory.dmp

memory/3368-71-0x0000000070C10000-0x0000000070F64000-memory.dmp

memory/3368-81-0x0000000006A60000-0x0000000006B03000-memory.dmp

memory/3368-82-0x0000000006F70000-0x0000000006F81000-memory.dmp

memory/3368-83-0x0000000006FC0000-0x0000000006FD4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/440-96-0x0000000005790000-0x0000000005AE4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b9c7db63c46d7743a1cef49371a431c8
SHA1 2b021692dc2783e82282dbdc48646bb0f56296e4
SHA256 b0a7ef903952f5989098bd072e4fadb88d3046770aee04fe2869fa245dc542d5
SHA512 6ddbe1704515a607bef79fce0fe610f30c72b72e5757b903ac4dcc1b7e54f13e090624ccd322d64e1a7836700781e6cfa915158c11be2c83fc21708314614577

memory/440-98-0x0000000070470000-0x00000000704BC000-memory.dmp

memory/440-99-0x00000000708B0000-0x0000000070C04000-memory.dmp

memory/3344-100-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3348-120-0x0000000005BA0000-0x0000000005EF4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 bbe80b4052f48f7e53ff6c5519131759
SHA1 e578368efcc2a4cd1ff40ab69ea569a57ad4587d
SHA256 f1f8091c500f5e8b908f2c7c5b6f274bd030c0033848089ad4067405d4866e53
SHA512 dccbae16184ba6dae9b20273495d672ea765b7150bf6a148511d3109b874c797cbf90a017077aeb939cda13e599de6e81cbf4d67829575fdc13fa7fe9211ab42

memory/3348-123-0x00000000705F0000-0x0000000070944000-memory.dmp

memory/3348-122-0x0000000070470000-0x00000000704BC000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 6f5c85848a8c2bdb70eefc88a4ea0463
SHA1 4763d9bcacd111087e7e0aea404db6a42ed82860
SHA256 8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e
SHA512 1ece9aa2ea8bacec5c1679fad710520e9b86eaa62d1769047fd79fa00f30b81ed21979ca1bbec28d56259c3894cae60ed5bb8222899c2542f36f8bd5f8fd4321

memory/4552-144-0x0000000005BF0000-0x0000000005F44000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8507a0a5cc7b82485c23145bd5bc4933
SHA1 3d95115715b58bb32a597046f3fef41c93cd1b67
SHA256 914cd960eaf80c4f06232e1a03bcf96ce059f03641a4a888c44c1cf91e901172
SHA512 e1e127536142f24704fcfe55eff8a9a7d4f48a7d36b1456125873d94888b64ca916db6991fedc63627a27291768262cbe7074b40fc61fcb9d6a922049d66e4ba

memory/4552-150-0x0000000006330000-0x000000000637C000-memory.dmp

memory/3344-151-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4552-153-0x0000000070B70000-0x0000000070EC4000-memory.dmp

memory/4552-152-0x00000000703D0000-0x000000007041C000-memory.dmp

memory/4552-163-0x0000000007550000-0x00000000075F3000-memory.dmp

memory/4552-164-0x00000000060C0000-0x00000000060D1000-memory.dmp

memory/4552-165-0x0000000006100000-0x0000000006114000-memory.dmp

memory/4168-167-0x0000000005E00000-0x0000000006154000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 91d1d44773c232a486d180cc325a4580
SHA1 07a7a823ba3432588e0d5bbad3515823c0753910
SHA256 32b5c8e539b106ed4f97bb5fa9c367a06890a9756b7933c15d4c8053ff92d387
SHA512 f5e9341a4eb8dabd7bf0a97ac055f5d0d305aec454bf667841985449e2a0836fecec3f92821f9134631a13c372305b3121b8f3bfc52043f91d6fb31c568a6408

memory/4168-178-0x0000000006A00000-0x0000000006A4C000-memory.dmp

memory/4168-179-0x00000000702F0000-0x000000007033C000-memory.dmp

memory/4168-190-0x0000000007710000-0x00000000077B3000-memory.dmp

memory/4168-180-0x0000000070A90000-0x0000000070DE4000-memory.dmp

memory/4168-191-0x0000000007A10000-0x0000000007A21000-memory.dmp

memory/4168-192-0x0000000006290000-0x00000000062A4000-memory.dmp

memory/4564-203-0x0000000005C20000-0x0000000005F74000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 69c3907573f7013353e300ed53c3ef32
SHA1 cdb13d8ee56100074f7b8199f9b7f41868dae05a
SHA256 6d1df075d94ee7d53880e309d7c2ff5177c7b34922f24e35bf7c85a4e44d4ac7
SHA512 35926e12fed62a78bca3907e9732a44104fa0c442438ab5f3430eb2f7153106c52e9e2bdcfd96f2c9110a4994f841235cda7671223bbf8417712668f7cd43e2d

memory/2512-205-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4564-206-0x00000000702F0000-0x000000007033C000-memory.dmp

memory/4564-207-0x0000000070470000-0x00000000707C4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2512-224-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2248-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3992-231-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2248-233-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2512-235-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3992-236-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2512-238-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2512-241-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3992-242-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2512-244-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2512-247-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2512-250-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2512-253-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2512-256-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2512-259-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2512-262-0x0000000000400000-0x0000000002B0B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 16:12

Reported

2024-05-15 16:14

Platform

win11-20240419-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-401 = "Arabic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-162 = "Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1164 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1164 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1164 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 988 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 988 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 988 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 988 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\system32\cmd.exe
PID 988 wrote to memory of 1952 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\system32\cmd.exe
PID 1952 wrote to memory of 3944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1952 wrote to memory of 3944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 988 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 988 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 988 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 988 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 988 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 988 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 988 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\rss\csrss.exe
PID 988 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\rss\csrss.exe
PID 988 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe C:\Windows\rss\csrss.exe
PID 4576 wrote to memory of 2912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 2912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 2912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1436 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1436 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 1436 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4576 wrote to memory of 3776 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4576 wrote to memory of 3776 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2120 wrote to memory of 3524 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 3524 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2120 wrote to memory of 3524 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3524 wrote to memory of 4300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3524 wrote to memory of 4300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3524 wrote to memory of 4300 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe

"C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe

"C:\Users\Admin\AppData\Local\Temp\8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 307ddcfd-8e02-43b1-94e2-8b35189e0780.uuid.alldatadump.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server3.alldatadump.org udp
US 74.125.250.129:19302 stun2.l.google.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server3.alldatadump.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.108:443 server3.alldatadump.org tcp
BG 185.82.216.108:443 server3.alldatadump.org tcp

Files

memory/1164-1-0x00000000048A0000-0x0000000004C9D000-memory.dmp

memory/1164-2-0x0000000004CA0000-0x000000000558B000-memory.dmp

memory/1164-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2708-4-0x00000000740EE000-0x00000000740EF000-memory.dmp

memory/2708-5-0x0000000004F30000-0x0000000004F66000-memory.dmp

memory/2708-7-0x00000000740E0000-0x0000000074891000-memory.dmp

memory/2708-6-0x00000000055F0000-0x0000000005C1A000-memory.dmp

memory/2708-8-0x00000000740E0000-0x0000000074891000-memory.dmp

memory/2708-9-0x0000000005450000-0x0000000005472000-memory.dmp

memory/2708-10-0x0000000005D20000-0x0000000005D86000-memory.dmp

memory/2708-11-0x0000000005D90000-0x0000000005DF6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ihcfech1.kgn.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2708-20-0x0000000005F00000-0x0000000006257000-memory.dmp

memory/2708-21-0x0000000006400000-0x000000000641E000-memory.dmp

memory/2708-22-0x0000000006420000-0x000000000646C000-memory.dmp

memory/2708-23-0x0000000006960000-0x00000000069A6000-memory.dmp

memory/2708-26-0x0000000070350000-0x000000007039C000-memory.dmp

memory/2708-36-0x0000000007850000-0x000000000786E000-memory.dmp

memory/2708-25-0x00000000077F0000-0x0000000007824000-memory.dmp

memory/2708-27-0x0000000070520000-0x0000000070877000-memory.dmp

memory/2708-37-0x0000000007870000-0x0000000007914000-memory.dmp

memory/2708-38-0x00000000740E0000-0x0000000074891000-memory.dmp

memory/1164-24-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2708-39-0x00000000740E0000-0x0000000074891000-memory.dmp

memory/2708-41-0x00000000079A0000-0x00000000079BA000-memory.dmp

memory/2708-40-0x0000000007FE0000-0x000000000865A000-memory.dmp

memory/2708-42-0x00000000079E0000-0x00000000079EA000-memory.dmp

memory/2708-43-0x0000000007AA0000-0x0000000007B36000-memory.dmp

memory/2708-44-0x0000000007A10000-0x0000000007A21000-memory.dmp

memory/2708-45-0x0000000007A50000-0x0000000007A5E000-memory.dmp

memory/2708-46-0x0000000007A60000-0x0000000007A75000-memory.dmp

memory/2708-47-0x0000000007B60000-0x0000000007B7A000-memory.dmp

memory/2708-48-0x0000000007B40000-0x0000000007B48000-memory.dmp

memory/2708-51-0x00000000740E0000-0x0000000074891000-memory.dmp

memory/1164-53-0x00000000048A0000-0x0000000004C9D000-memory.dmp

memory/2304-62-0x0000000006280000-0x00000000065D7000-memory.dmp

memory/1164-64-0x0000000004CA0000-0x000000000558B000-memory.dmp

memory/1164-63-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2304-65-0x0000000070350000-0x000000007039C000-memory.dmp

memory/2304-66-0x00000000704F0000-0x0000000070847000-memory.dmp

memory/2304-75-0x00000000079F0000-0x0000000007A94000-memory.dmp

memory/2304-76-0x0000000007CF0000-0x0000000007D01000-memory.dmp

memory/2304-77-0x0000000007D40000-0x0000000007D55000-memory.dmp

memory/1164-79-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/988-78-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d20cbd63611a1e3e5613a1c9cbb0308a
SHA1 bfb57801897d4609e13eb470fb338c300630a58a
SHA256 526711fd8662bd3a9b3bd08484b81bf568cef835a1a4eff770f2f53f7251f0ba
SHA512 33f6870d9ba6e09716b81e2c407bffbd27821176fb1a6d7f7cf8fb09731303dc666971d3e3ff6587146c6edf5ab066e324f8497ff5973b0439dcbb5d46775978

memory/1488-92-0x0000000070350000-0x000000007039C000-memory.dmp

memory/1488-93-0x00000000704F0000-0x0000000070847000-memory.dmp

memory/2076-111-0x0000000005AA0000-0x0000000005DF7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 01bd74de6e854abc46622e29bfb684c6
SHA1 6c8e50e8ac876c5e1ff246df644d7af7716817db
SHA256 838604065c4fac13527675a2228d8051bb1fa3b83ca59b25b24a7b8a935fba79
SHA512 74d26631e6b0d003dc01b83a374633b6706e94e27d526c44083b868ce3d87b6a1d7988c8f4268a2b87631bf71baaf73dc5298ba6ed57d44266b360f2581e2d43

memory/2076-113-0x0000000070350000-0x000000007039C000-memory.dmp

memory/2076-114-0x00000000704D0000-0x0000000070827000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 6f5c85848a8c2bdb70eefc88a4ea0463
SHA1 4763d9bcacd111087e7e0aea404db6a42ed82860
SHA256 8e4a3edabb3b0b063e23cf12118f4420c7e7842d7c8ba096eeaaa2263154cd2e
SHA512 1ece9aa2ea8bacec5c1679fad710520e9b86eaa62d1769047fd79fa00f30b81ed21979ca1bbec28d56259c3894cae60ed5bb8222899c2542f36f8bd5f8fd4321

memory/988-130-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2912-140-0x0000000005B20000-0x0000000005E77000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4ec2e41156e28aac7678383e2a1e7879
SHA1 cb67839cadae7a8c97f5f816b38d75ed3e5df878
SHA256 50edd6c796fe95b5825ce5bdc26dbaca4b09ab7308e19c19617c6265fc5ad409
SHA512 aaad8d463c77ddceaf55d8799ddacbc8db6416d86219f9aad6870c2a9b94281222ebe400c68d3d59050efd8c3ad67349b0ce80f5273b5fc5e8182282b4ba238d

memory/2912-143-0x0000000070560000-0x00000000708B7000-memory.dmp

memory/2912-142-0x0000000070350000-0x000000007039C000-memory.dmp

memory/1504-162-0x00000000062C0000-0x0000000006617000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 345681f8e0d05d5199568dfaefffd7ba
SHA1 e14dc5bb1a5bb85b7b0c255f8f15fe88e9255242
SHA256 7b9717cc0386aba4d707bd04e64e60add1d5d8e2bc0bf5612207ada24cf24325
SHA512 91d2bb142df9de07f3a4527cf6be7fc90149aecbab9fa28686b435d075c05415eef7873a8438308a9f6dd1b951be133f331a379befa4fa8b94a6e03ed01a6f80

memory/1504-164-0x0000000006760000-0x00000000067AC000-memory.dmp

memory/1504-165-0x0000000070270000-0x00000000702BC000-memory.dmp

memory/1504-166-0x00000000703F0000-0x0000000070747000-memory.dmp

memory/1504-175-0x00000000079E0000-0x0000000007A84000-memory.dmp

memory/1504-176-0x0000000007BA0000-0x0000000007BB1000-memory.dmp

memory/1504-177-0x0000000006170000-0x0000000006185000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 464f3c10979ec9bdb6088d9eaa52fb98
SHA1 5035993701409d1c2d74dd1ae54ed8c7c573f4b7
SHA256 aeb504ff74ee61c8e7de59881f4511ecdf0d1e731ce102168da9ca110b20bc2d
SHA512 55e81d8af4f9855d9cb5cc1ed245a7c12c2d99579fad7874347845af68993d78d242e44c69b98bf9050116be525095b38bb00c5f014b8e05f1ddfe095bfa2577

memory/1436-188-0x0000000070270000-0x00000000702BC000-memory.dmp

memory/1436-189-0x00000000703F0000-0x0000000070747000-memory.dmp

memory/4576-199-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2120-211-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3520-215-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2120-217-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4576-214-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4576-220-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3520-221-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4576-224-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3520-229-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4576-228-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4576-232-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4576-236-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4576-240-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4576-244-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4576-248-0x0000000000400000-0x0000000002B0B000-memory.dmp