Malware Analysis Report

2025-01-02 06:40

Sample ID 240515-wr1z8acg81
Target 8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a
SHA256 8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a

Threat Level: Known bad

The file 8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Adds Run key to start application

Checks installed software on the system

Manipulates WinMonFS driver.

Drops file in System32 directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Program crash

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 18:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 18:10

Reported

2024-05-15 18:12

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4780 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4780 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4780 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1080 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1080 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1080 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1080 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\system32\cmd.exe
PID 1080 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\system32\cmd.exe
PID 1720 wrote to memory of 3288 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1720 wrote to memory of 3288 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1080 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1080 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1080 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1080 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1080 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1080 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1080 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\rss\csrss.exe
PID 1080 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\rss\csrss.exe
PID 1080 wrote to memory of 2452 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\rss\csrss.exe
PID 2452 wrote to memory of 3600 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 3600 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 3600 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4732 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4732 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 4732 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2452 wrote to memory of 2296 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2452 wrote to memory of 2296 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 5084 wrote to memory of 3716 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5084 wrote to memory of 3716 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5084 wrote to memory of 3716 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3716 wrote to memory of 4460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3716 wrote to memory of 4460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3716 wrote to memory of 4460 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe

"C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3756,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe

"C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
NL 23.62.61.106:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 106.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 32.251.17.2.in-addr.arpa udp
US 8.8.8.8:53 12f17ad6-08ef-41fc-8d40-76c69d267dc5.uuid.theupdatetime.org udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 stun1.l.google.com udp
US 8.8.8.8:53 server4.theupdatetime.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun1.l.google.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server4.theupdatetime.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
BG 185.82.216.108:443 server4.theupdatetime.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4780-1-0x00000000048C0000-0x0000000004CC0000-memory.dmp

memory/4780-2-0x0000000004CC0000-0x00000000055AB000-memory.dmp

memory/4780-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/524-4-0x0000000074F8E000-0x0000000074F8F000-memory.dmp

memory/524-5-0x0000000004910000-0x0000000004946000-memory.dmp

memory/524-6-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/524-7-0x0000000005100000-0x0000000005728000-memory.dmp

memory/524-8-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/524-9-0x0000000005030000-0x0000000005052000-memory.dmp

memory/524-10-0x00000000057A0000-0x0000000005806000-memory.dmp

memory/524-11-0x00000000058C0000-0x0000000005926000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yymzishs.bhb.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/524-21-0x0000000005930000-0x0000000005C84000-memory.dmp

memory/524-22-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

memory/524-23-0x0000000005F10000-0x0000000005F5C000-memory.dmp

memory/524-24-0x0000000006420000-0x0000000006464000-memory.dmp

memory/524-25-0x0000000007250000-0x00000000072C6000-memory.dmp

memory/4780-26-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/524-27-0x0000000007950000-0x0000000007FCA000-memory.dmp

memory/524-28-0x0000000004C60000-0x0000000004C7A000-memory.dmp

memory/524-30-0x0000000070E20000-0x0000000070E6C000-memory.dmp

memory/524-29-0x0000000007450000-0x0000000007482000-memory.dmp

memory/524-32-0x0000000071520000-0x0000000071874000-memory.dmp

memory/524-31-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/524-42-0x0000000007490000-0x00000000074AE000-memory.dmp

memory/524-43-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/524-44-0x00000000074B0000-0x0000000007553000-memory.dmp

memory/524-45-0x00000000075A0000-0x00000000075AA000-memory.dmp

memory/524-46-0x00000000076B0000-0x0000000007746000-memory.dmp

memory/524-47-0x00000000075B0000-0x00000000075C1000-memory.dmp

memory/524-48-0x00000000075F0000-0x00000000075FE000-memory.dmp

memory/524-49-0x0000000007610000-0x0000000007624000-memory.dmp

memory/524-50-0x0000000007650000-0x000000000766A000-memory.dmp

memory/524-51-0x0000000007640000-0x0000000007648000-memory.dmp

memory/524-54-0x0000000074F80000-0x0000000075730000-memory.dmp

memory/4780-57-0x00000000048C0000-0x0000000004CC0000-memory.dmp

memory/4780-58-0x0000000004CC0000-0x00000000055AB000-memory.dmp

memory/4780-56-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4780-59-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4380-65-0x0000000005ED0000-0x0000000006224000-memory.dmp

memory/4380-70-0x0000000070E20000-0x0000000070E6C000-memory.dmp

memory/4380-71-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/4380-81-0x00000000076C0000-0x0000000007763000-memory.dmp

memory/4380-82-0x00000000079F0000-0x0000000007A01000-memory.dmp

memory/4380-83-0x0000000007A40000-0x0000000007A54000-memory.dmp

memory/1080-84-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b04bbde61cd95e48677eccc7c0448090
SHA1 2bc978501f35544c370dc47a5afdee6b9b132c3f
SHA256 94724245f5950ec6fecd2679a6d81cf7be06d65aaf6425e8cac2155d888d6ed8
SHA512 5391df46ca4d966bc42bbd37dc29eeec41416f3e718b82048b84d444c90bc5427a097b1c8634254ed1499fa5db31ff1ff366baa4b11c8d26ae957c8763c9957d

memory/1152-98-0x0000000070E20000-0x0000000070E6C000-memory.dmp

memory/1152-99-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/2824-111-0x0000000005D60000-0x00000000060B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 bcc4f8219b43816bef0055e0a03b3660
SHA1 f2692af8586bb4ab2e09c681eedace1b3ac4c672
SHA256 6a9a5d51db432df6eadf3c71bbc938a516bf7fd772e138bdaab967bd05e4a894
SHA512 6dd00535df22e503593fa076a8b81812b9f5ed81c8ec3cff37f8facc1b5af1eae839a63e97df4ca7208af3dd10af41659515d7127009f2c31165cdeb4dee062d

memory/2824-122-0x0000000070E20000-0x0000000070E6C000-memory.dmp

memory/2824-123-0x00000000715A0000-0x00000000718F4000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 6f3fed9266c233f373f10498cf57adbf
SHA1 d2f4dd496637cb4ef8fde258e9284bcc4bd5ce4e
SHA256 8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a
SHA512 5721f144afecc5522d6c0644a103299ef62153581f65281ce971eeb07393cab0cf63b7666597262e550338007386ff5f06c3ef211d519f619b34b5a00744a506

memory/1080-137-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 163d1c92681ac53c9226673b478c1e86
SHA1 9f0d15b7d4b2761710b073e43ca8060fa0f1b062
SHA256 fa1fcab42c7327032c4c1e451ccd894f1677966e1807074c7d43ae521faacc49
SHA512 37bacb8270485fafbf742c5e31be6ce9bcfbc11d13bfeae5806b2833d97784315c2455f983dc790e5997d4df1fb634d7b2601d7e4c80980c1d42c62ec8efaa82

memory/3600-151-0x0000000070E20000-0x0000000070E6C000-memory.dmp

memory/3600-152-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/4504-172-0x0000000006140000-0x0000000006494000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ffd02a3491b219a5be26fd047f853afb
SHA1 e479fc525e8ceba53f365776b1f1d92e0fd3dab7
SHA256 6f418112ea5f956e5d7f33fa2649f80d0631fb0d1a232a2dd656b77b9b6eff28
SHA512 f234ae02be5661ad28a2eb7685177f0504ee43f342c13e0219ace4f767ba76c27cc09e0fe5afddf777d1d190a2b3d26ad5e3f0f535ae5b86e06d033d8d299d21

memory/4504-174-0x0000000006C00000-0x0000000006C4C000-memory.dmp

memory/4504-175-0x0000000070D40000-0x0000000070D8C000-memory.dmp

memory/4504-186-0x0000000007900000-0x00000000079A3000-memory.dmp

memory/4504-176-0x0000000070EC0000-0x0000000071214000-memory.dmp

memory/4504-187-0x00000000064A0000-0x00000000064B1000-memory.dmp

memory/4504-189-0x00000000064E0000-0x00000000064F4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 cbcf2e2086459a989c037c002436f96d
SHA1 5329d35ef539dea97e14a171a4e8804602c58232
SHA256 a5ba05907f9e22e16e967dd8ac64fa426137aed3406f793781e3528fe06562ff
SHA512 ebe4cd5ec0a7a037ae12faca5468d9f4804254d9abdc535d179dfe7e7cfd175942e818b07ce19b8c6f2d940c6a60a20b5d10858b0c8e79ff5a7683e2e2994add

memory/4732-201-0x0000000070D40000-0x0000000070D8C000-memory.dmp

memory/4732-202-0x0000000070EC0000-0x0000000071214000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2452-218-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/5084-223-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/5084-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2452-228-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4212-231-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2452-230-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2452-233-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4212-237-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2452-236-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2452-240-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2452-242-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2452-245-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2452-248-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2452-252-0x0000000000400000-0x0000000002B0B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 18:10

Reported

2024-05-15 18:12

Platform

win11-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-692 = "Tasmania Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-12 = "Azores Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4620 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4620 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4620 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 2976 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\system32\cmd.exe
PID 1772 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\system32\cmd.exe
PID 4316 wrote to memory of 3908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4316 wrote to memory of 3908 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1772 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 3280 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\rss\csrss.exe
PID 1772 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\rss\csrss.exe
PID 1772 wrote to memory of 4232 N/A C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe C:\Windows\rss\csrss.exe
PID 4232 wrote to memory of 612 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4232 wrote to memory of 612 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4232 wrote to memory of 612 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4232 wrote to memory of 4904 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4232 wrote to memory of 4904 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4232 wrote to memory of 4904 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4232 wrote to memory of 224 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4232 wrote to memory of 224 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4232 wrote to memory of 224 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4232 wrote to memory of 4784 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4232 wrote to memory of 4784 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3184 wrote to memory of 3272 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3184 wrote to memory of 3272 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3184 wrote to memory of 3272 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3272 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3272 wrote to memory of 3960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe

"C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2800 -ip 2800

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 2124

C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe

"C:\Users\Admin\AppData\Local\Temp\8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 c8e03335-a6a7-413e-ae0b-cf304827fc71.uuid.theupdatetime.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server13.theupdatetime.org udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server13.theupdatetime.org tcp
N/A 127.0.0.1:3478 udp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.108:443 server13.theupdatetime.org tcp
US 52.111.229.43:443 tcp
US 15.197.250.192:3478 stun.sipgate.net udp
BG 185.82.216.108:443 server13.theupdatetime.org tcp
BG 185.82.216.108:443 server13.theupdatetime.org tcp

Files

memory/4620-1-0x0000000004970000-0x0000000004D72000-memory.dmp

memory/4620-2-0x0000000004D80000-0x000000000566B000-memory.dmp

memory/4620-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2800-4-0x00000000743AE000-0x00000000743AF000-memory.dmp

memory/2800-5-0x0000000002DF0000-0x0000000002E26000-memory.dmp

memory/2800-6-0x00000000058F0000-0x0000000005F1A000-memory.dmp

memory/2800-7-0x00000000743A0000-0x0000000074B51000-memory.dmp

memory/2800-8-0x00000000743A0000-0x0000000074B51000-memory.dmp

memory/2800-9-0x0000000005760000-0x0000000005782000-memory.dmp

memory/2800-10-0x0000000005F20000-0x0000000005F86000-memory.dmp

memory/2800-11-0x0000000006100000-0x0000000006166000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_knop2jof.qz0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2800-20-0x0000000006170000-0x00000000064C7000-memory.dmp

memory/2800-21-0x0000000006610000-0x000000000662E000-memory.dmp

memory/2800-22-0x0000000006640000-0x000000000668C000-memory.dmp

memory/2800-23-0x0000000006B70000-0x0000000006BB6000-memory.dmp

memory/2800-25-0x0000000007A30000-0x0000000007A64000-memory.dmp

memory/2800-27-0x0000000070790000-0x0000000070AE7000-memory.dmp

memory/2800-26-0x0000000070610000-0x000000007065C000-memory.dmp

memory/2800-36-0x0000000007A70000-0x0000000007A8E000-memory.dmp

memory/2800-37-0x0000000007A90000-0x0000000007B34000-memory.dmp

memory/2800-38-0x00000000743A0000-0x0000000074B51000-memory.dmp

memory/4620-24-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2800-40-0x0000000007BB0000-0x0000000007BCA000-memory.dmp

memory/2800-39-0x00000000081F0000-0x000000000886A000-memory.dmp

memory/2800-41-0x0000000007BF0000-0x0000000007BFA000-memory.dmp

memory/2800-42-0x00000000743A0000-0x0000000074B51000-memory.dmp

memory/4620-44-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4620-46-0x0000000004D80000-0x000000000566B000-memory.dmp

memory/4620-43-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2976-55-0x0000000006030000-0x0000000006387000-memory.dmp

memory/2976-56-0x0000000006430000-0x000000000647C000-memory.dmp

memory/2976-57-0x0000000070720000-0x000000007076C000-memory.dmp

memory/2976-58-0x00000000708A0000-0x0000000070BF7000-memory.dmp

memory/2976-67-0x00000000075F0000-0x0000000007694000-memory.dmp

memory/2976-68-0x0000000007A10000-0x0000000007AA6000-memory.dmp

memory/2976-69-0x0000000007930000-0x0000000007941000-memory.dmp

memory/2976-70-0x0000000007970000-0x000000000797E000-memory.dmp

memory/2976-71-0x0000000007980000-0x0000000007995000-memory.dmp

memory/2976-72-0x00000000079C0000-0x00000000079DA000-memory.dmp

memory/2976-73-0x00000000079E0000-0x00000000079E8000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 72b475825106eddaa048a77f44f37530
SHA1 13ff69a91586dc3295e6e449e446726c2ec29e5d
SHA256 4687e17c5f20c13c7825411cd6dd9914d8d9f6d8d2cc0e0d5a56e14d1eaf4f1b
SHA512 8072b054d72cc9cfed01e8e13921d7d2227069a75d5f2d09dba5971991bd96cdeb9fdf7df96ec708488bcb6e7461aa351a186236bcaf75dcdf539f01d7a05165

memory/2880-86-0x0000000070720000-0x000000007076C000-memory.dmp

memory/2880-87-0x00000000708A0000-0x0000000070BF7000-memory.dmp

memory/3280-102-0x0000000005CA0000-0x0000000005FF7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c6329fa767d3a581d9578971398a4460
SHA1 c671c93cefc4b780a88f2f70b36adee326a7375b
SHA256 76b83ce349f1500ed9e005c2379bacb10eaa81b8fcd3a2228e1a9b8f95f32e27
SHA512 fc0833e6afb5e8bd9795b55c854764ffeb3b858627907b3f8ec106f57cf9c39a9583b94c191a33737cdccc2ff23881155b0dff3bba24e3fc32201998fb159ca0

memory/3280-107-0x0000000070720000-0x000000007076C000-memory.dmp

memory/3280-108-0x0000000070970000-0x0000000070CC7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 6f3fed9266c233f373f10498cf57adbf
SHA1 d2f4dd496637cb4ef8fde258e9284bcc4bd5ce4e
SHA256 8a964049e4f25e7dc8870b69d432751bbe6ac43df78544ef43ef2198f60edf7a
SHA512 5721f144afecc5522d6c0644a103299ef62153581f65281ce971eeb07393cab0cf63b7666597262e550338007386ff5f06c3ef211d519f619b34b5a00744a506

memory/1772-121-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/612-132-0x0000000005DA0000-0x00000000060F7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 087ffd6a7dc81db4d7bea6d152ac95b3
SHA1 21c2562432fdbddfde80111f4b7d2694cd730c56
SHA256 612f9c88277d8d21b8841dc128f22f3f7f2a4da9dd04b83758d8a9804cf6b0b4
SHA512 0e368bd71c9a536bd861f2d1e3b914763e1b4291c72383ea017666e1a30885b2d68e34a6681c79fc28054bae2482bed89edfdfd781682c76d27b9842eef4cb73

memory/612-134-0x00000000068C0000-0x000000000690C000-memory.dmp

memory/612-135-0x0000000070680000-0x00000000706CC000-memory.dmp

memory/612-136-0x0000000070820000-0x0000000070B77000-memory.dmp

memory/612-145-0x0000000007590000-0x0000000007634000-memory.dmp

memory/612-146-0x0000000007930000-0x0000000007941000-memory.dmp

memory/612-147-0x00000000061A0000-0x00000000061B5000-memory.dmp

memory/4904-157-0x00000000061A0000-0x00000000064F7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b83df4fd773b9546e4271e765ee33e2c
SHA1 d3d8294639e2d815ade127bb19aff33138c98d4d
SHA256 fa649b4516ee4946be26433048fec950ffed757dd13c26ac5de23bfe2e3eaa4c
SHA512 c01b566d3e464eabfb954ce9c8e120fded70c941a36b8c168187767fb77c2c9e12eca69bd15b86bc23b03a45c8149aa1eddfe022d321ae5c2c51512a77fdd01b

memory/4904-159-0x0000000006BC0000-0x0000000006C0C000-memory.dmp

memory/4904-161-0x0000000070720000-0x0000000070A77000-memory.dmp

memory/4904-160-0x00000000705A0000-0x00000000705EC000-memory.dmp

memory/4904-170-0x00000000078D0000-0x0000000007974000-memory.dmp

memory/4904-171-0x0000000007BF0000-0x0000000007C01000-memory.dmp

memory/4904-172-0x0000000006120000-0x0000000006135000-memory.dmp

memory/224-182-0x00000000061F0000-0x0000000006547000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 570e9112d1ca96cf25da4b95df153fb6
SHA1 9e8d55bea653915925aa7c53b75419980f300733
SHA256 beed6f62556c9d48ed17f383e82b58c9bb1393d669c8f8964375fb15fdd32e2c
SHA512 4f2a47089c68ee3a8420ddb1ae56ac391eaceb2166f37143e603454661d0ee48f004d6ec62806f918855f60dd649b35618978b961343af88f002ce5fb7d8a9ac

memory/4232-184-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/224-185-0x00000000705A0000-0x00000000705EC000-memory.dmp

memory/224-186-0x0000000070740000-0x0000000070A97000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4232-201-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3184-205-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2732-209-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3184-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4232-211-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2732-212-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4232-213-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4232-215-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2732-216-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4232-217-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4232-219-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4232-221-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4232-223-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4232-225-0x0000000000400000-0x0000000002B0B000-memory.dmp