Malware Analysis Report

2025-01-02 06:41

Sample ID 240515-wr81tscg91
Target f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae
SHA256 f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae

Threat Level: Known bad

The file f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Checks installed software on the system

Adds Run key to start application

Manipulates WinMonFS driver.

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Command and Scripting Interpreter: PowerShell

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 18:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 18:10

Reported

2024-05-15 18:13

Platform

win10v2004-20240508-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-562 = "SE Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-572 = "China Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-301 = "Romance Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2312 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2312 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 4368 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\system32\cmd.exe
PID 2620 wrote to memory of 2284 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\system32\cmd.exe
PID 2284 wrote to memory of 536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2284 wrote to memory of 536 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2620 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 4860 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 1548 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2620 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\rss\csrss.exe
PID 2620 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\rss\csrss.exe
PID 2620 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\rss\csrss.exe
PID 2860 wrote to memory of 3044 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 3044 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 3044 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 3492 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 3492 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 3492 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 1836 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 1836 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 1836 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2860 wrote to memory of 4344 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2860 wrote to memory of 4344 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 772 wrote to memory of 3812 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 772 wrote to memory of 3812 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 772 wrote to memory of 3812 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3812 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3812 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3812 wrote to memory of 4616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe

"C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1300,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe

"C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 b3c5cf43-cc00-42fd-a120-9c3697026e86.uuid.statscreate.org udp
US 8.8.8.8:53 stun.stunprotocol.org udp
US 8.8.8.8:53 server11.statscreate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
N/A 127.0.0.1:3478 udp
BG 185.82.216.96:443 server11.statscreate.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
BG 185.82.216.96:443 server11.statscreate.org tcp
US 8.8.8.8:53 stun.sipgate.net udp
US 3.33.249.248:3478 stun.sipgate.net udp
US 8.8.8.8:53 248.249.33.3.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BG 185.82.216.96:443 server11.statscreate.org tcp

Files

memory/2312-1-0x00000000047B0000-0x0000000004BB4000-memory.dmp

memory/2312-2-0x0000000004BC0000-0x00000000054AB000-memory.dmp

memory/2312-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/5092-4-0x0000000074C3E000-0x0000000074C3F000-memory.dmp

memory/5092-5-0x0000000002D50000-0x0000000002D86000-memory.dmp

memory/5092-8-0x0000000005500000-0x0000000005B28000-memory.dmp

memory/5092-6-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/5092-9-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/2312-7-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/5092-10-0x0000000005360000-0x0000000005382000-memory.dmp

memory/5092-11-0x0000000005B30000-0x0000000005B96000-memory.dmp

memory/5092-12-0x0000000005BA0000-0x0000000005C06000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5qoxt3bu.5lh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5092-18-0x0000000005D30000-0x0000000006084000-memory.dmp

memory/5092-23-0x0000000006330000-0x000000000634E000-memory.dmp

memory/5092-24-0x0000000006350000-0x000000000639C000-memory.dmp

memory/5092-25-0x00000000074B0000-0x00000000074F4000-memory.dmp

memory/5092-26-0x0000000007660000-0x00000000076D6000-memory.dmp

memory/5092-27-0x0000000007D60000-0x00000000083DA000-memory.dmp

memory/5092-28-0x0000000007700000-0x000000000771A000-memory.dmp

memory/5092-29-0x00000000078B0000-0x00000000078E2000-memory.dmp

memory/5092-31-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/5092-30-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

memory/5092-32-0x0000000071250000-0x00000000715A4000-memory.dmp

memory/5092-43-0x0000000007910000-0x00000000079B3000-memory.dmp

memory/5092-42-0x00000000078F0000-0x000000000790E000-memory.dmp

memory/5092-44-0x0000000007A00000-0x0000000007A0A000-memory.dmp

memory/5092-45-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/5092-46-0x0000000007B20000-0x0000000007BB6000-memory.dmp

memory/5092-47-0x0000000007A40000-0x0000000007A51000-memory.dmp

memory/5092-48-0x0000000007A90000-0x0000000007A9E000-memory.dmp

memory/5092-49-0x0000000007AA0000-0x0000000007AB4000-memory.dmp

memory/5092-50-0x0000000007AE0000-0x0000000007AFA000-memory.dmp

memory/5092-51-0x0000000007AD0000-0x0000000007AD8000-memory.dmp

memory/5092-54-0x0000000074C30000-0x00000000753E0000-memory.dmp

memory/2312-57-0x00000000047B0000-0x0000000004BB4000-memory.dmp

memory/2312-56-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2312-58-0x0000000004BC0000-0x00000000054AB000-memory.dmp

memory/2312-59-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4368-65-0x0000000005490000-0x00000000057E4000-memory.dmp

memory/4368-70-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

memory/4368-71-0x0000000071270000-0x00000000715C4000-memory.dmp

memory/4368-81-0x0000000006D90000-0x0000000006E33000-memory.dmp

memory/2620-82-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4368-83-0x00000000070B0000-0x00000000070C1000-memory.dmp

memory/4368-84-0x0000000007100000-0x0000000007114000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4860-95-0x0000000005B10000-0x0000000005E64000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 923e1a22dc23ae4e31d8428076382183
SHA1 e71f564aa45f50a12170e1a6e1552ea17095aec6
SHA256 56751488bf4c3d7b61266e33dbf55647b6a9dfbae47cbeac8c32f63f556afc85
SHA512 5b9789fcf111eb20e13c8b0f69b1932685e16927bfd4aafd1e9ad48f5f8f5e1f658b482c6572cb0047a8b975e04a965d49336de86974ac099bd89d77a41619b4

memory/4860-100-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

memory/4860-101-0x00000000711F0000-0x0000000071544000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 010e32918e6478815aeda1e38e257b79
SHA1 4d150e6dd35972e07425ef8306d9c10f4e088011
SHA256 e4fee199dbb2f8f996730d7b2d766edb65a4c5c817b8145ce9cde8fba8015b8d
SHA512 75f51dd3de89e02a60ebea354342f6a887a0728511684d6acf082db3de39400a95b782b11b946fcf53f01c8d3e7365b80180c5ad0180ecebf2bd67a0cd9131b9

memory/1548-122-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

memory/1548-123-0x0000000071250000-0x00000000715A4000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 c339e6362e442d227eb5672db7dae1ff
SHA1 7f2c2b09a7702a770d176b70e756f1d2519a6a7b
SHA256 f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae
SHA512 e731f2fabb282a9a2b575c66b3fb0d9bab809838f9fb0b36d10d39df39452344ca8fdf21e78feb79b2446183df5aaa2325b5b702f6d2f629fa7aae85678071ef

memory/2620-139-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3044-150-0x0000000005D70000-0x00000000060C4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8d7a32f20c97c5637ea3e5365bdd8b83
SHA1 06d496cfae5da5ce3d03492dcbf87bac95dbe5fa
SHA256 f90b74e6fddba3b341871d0bd7c973da6a9e583a1e1fee0172a82f3c8131273a
SHA512 b00b81e517c935a66a53262b3cd47dffb4863a521263959e78a207f0868a40f40c5565c5f2f99f31b153aa62d0561152f421573eec2850b09b9934def7d36cee

memory/3044-153-0x0000000070C50000-0x0000000070FA4000-memory.dmp

memory/3044-152-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

memory/2860-164-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3492-166-0x0000000005A20000-0x0000000005D74000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d69a28d98a5128a283f45a389f909d6e
SHA1 bb0d8449cff599524a906124d0d1716f5a6f61fb
SHA256 efc324bdcfdf1f8eb0cd1a943c10bea7fad66df60532a6df74fce36b085a0970
SHA512 da494cc3a8029dcf444db96eb6566a5fa10300d7f9afcad9e3b74138e102de51684d61659e89f42da01ba4f6383c8ec0fca3d63f39611215150ed5dbac1da159

memory/3492-177-0x00000000063A0000-0x00000000063EC000-memory.dmp

memory/3492-179-0x0000000071180000-0x00000000714D4000-memory.dmp

memory/3492-178-0x00000000709F0000-0x0000000070A3C000-memory.dmp

memory/3492-190-0x0000000007350000-0x00000000073F3000-memory.dmp

memory/3492-191-0x00000000076B0000-0x00000000076C1000-memory.dmp

memory/3492-192-0x0000000005EE0000-0x0000000005EF4000-memory.dmp

memory/1836-203-0x00000000059F0000-0x0000000005D44000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 bf7409a20d7fee8fc7b0832621ecefd1
SHA1 beb7bae39f18f528dc4d44269bb72d2a38117e06
SHA256 5a5327d95ff150fdb42f0f829ce0640a37fa0f7fbb897c1ec01b9c4d940a979e
SHA512 1e8de6c691c4aa4473906a068cc682f9e8d55cbace05924c9d2a79285f703fd8ec77ba3725e76d90d0ef335bbbc2fa06b1132952dfa6c512e046033515c6cd89

memory/1836-205-0x00000000709F0000-0x0000000070A3C000-memory.dmp

memory/1836-206-0x0000000070B70000-0x0000000070EC4000-memory.dmp

memory/2860-218-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/772-229-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2860-228-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2284-233-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/772-235-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2860-238-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2284-240-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2860-242-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2860-245-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2284-247-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2860-249-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2860-254-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2860-258-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2860-261-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2860-265-0x0000000000400000-0x0000000002B0B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 18:10

Reported

2024-05-15 18:13

Platform

win11-20240426-en

Max time kernel

20s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1552 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1552 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1552 wrote to memory of 1464 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 2876 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\system32\cmd.exe
PID 2180 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\system32\cmd.exe
PID 2292 wrote to memory of 2472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2292 wrote to memory of 2472 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2180 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 3120 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2180 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe

"C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe

"C:\Users\Admin\AppData\Local\Temp\f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 860906f1-31d6-4d68-bed4-11e9f16810fb.uuid.statscreate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server9.statscreate.org udp
BG 185.82.216.96:443 server9.statscreate.org tcp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun3.l.google.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.96:443 server9.statscreate.org tcp
US 52.111.229.43:443 tcp
BG 185.82.216.96:443 server9.statscreate.org tcp

Files

memory/1552-2-0x0000000004D50000-0x000000000563B000-memory.dmp

memory/1552-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1552-1-0x0000000004950000-0x0000000004D4D000-memory.dmp

memory/1464-4-0x000000007478E000-0x000000007478F000-memory.dmp

memory/1464-5-0x0000000004DB0000-0x0000000004DE6000-memory.dmp

memory/1464-7-0x0000000005570000-0x0000000005B9A000-memory.dmp

memory/1464-8-0x0000000074780000-0x0000000074F31000-memory.dmp

memory/1464-6-0x0000000074780000-0x0000000074F31000-memory.dmp

memory/1464-11-0x0000000005D10000-0x0000000005D76000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gjyc3wia.kqd.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1464-20-0x0000000005DA0000-0x00000000060F7000-memory.dmp

memory/1464-10-0x0000000005CA0000-0x0000000005D06000-memory.dmp

memory/1464-9-0x0000000005390000-0x00000000053B2000-memory.dmp

memory/1464-21-0x0000000006240000-0x000000000625E000-memory.dmp

memory/1464-22-0x0000000006290000-0x00000000062DC000-memory.dmp

memory/1464-23-0x00000000067C0000-0x0000000006806000-memory.dmp

memory/1464-27-0x0000000070B70000-0x0000000070EC7000-memory.dmp

memory/1464-37-0x00000000076E0000-0x0000000007784000-memory.dmp

memory/1464-38-0x0000000074780000-0x0000000074F31000-memory.dmp

memory/1464-36-0x00000000076C0000-0x00000000076DE000-memory.dmp

memory/1464-26-0x0000000074780000-0x0000000074F31000-memory.dmp

memory/1464-40-0x0000000007810000-0x000000000782A000-memory.dmp

memory/1464-39-0x0000000007E50000-0x00000000084CA000-memory.dmp

memory/1464-41-0x0000000007850000-0x000000000785A000-memory.dmp

memory/1464-25-0x00000000709F0000-0x0000000070A3C000-memory.dmp

memory/1464-42-0x0000000007960000-0x00000000079F6000-memory.dmp

memory/1464-24-0x0000000007680000-0x00000000076B4000-memory.dmp

memory/1464-43-0x0000000007870000-0x0000000007881000-memory.dmp

memory/1464-44-0x00000000078C0000-0x00000000078CE000-memory.dmp

memory/1464-46-0x0000000007920000-0x000000000793A000-memory.dmp

memory/1464-45-0x00000000078D0000-0x00000000078E5000-memory.dmp

memory/1464-47-0x0000000007940000-0x0000000007948000-memory.dmp

memory/1464-50-0x0000000074780000-0x0000000074F31000-memory.dmp

memory/1552-54-0x0000000004D50000-0x000000000563B000-memory.dmp

memory/1552-51-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1552-53-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2876-63-0x0000000005FB0000-0x0000000006307000-memory.dmp

memory/2876-64-0x0000000006540000-0x000000000658C000-memory.dmp

memory/2876-66-0x0000000070C80000-0x0000000070FD7000-memory.dmp

memory/2876-75-0x0000000007700000-0x00000000077A4000-memory.dmp

memory/2876-65-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/2876-76-0x0000000007A30000-0x0000000007A41000-memory.dmp

memory/2876-77-0x0000000007A80000-0x0000000007A95000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 794afa1ef03d8d2aba1e2ed10861ab65
SHA1 260dd9e4d45ec7868f80eb226dc1c9e563249810
SHA256 5a460f72123964831d4cf15c5d0bbd9bfd4d4c22a596e7b63f07caa9e68ba96d
SHA512 e0dced2a52866012a6da83dbf1c693c3604f3fc3d4d784a4955575e6b79d56f234843c825603ecf743fc1e7672b7cbed4abfb9453c48e215b56d5d3dfcf934f4

memory/3120-89-0x00000000057D0000-0x0000000005B27000-memory.dmp

memory/3120-92-0x0000000071440000-0x0000000071797000-memory.dmp

memory/3120-91-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/2980-110-0x0000000005CC0000-0x0000000006017000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 29041a3b52d6ec766057120f0407a68d
SHA1 3d0eb9eb6543d25f1ff30e3e73a6dd45bdcf14d5
SHA256 eca6c7422f88233c7fa2cbee33cdb4a3ad16ed756776ac6def151f8392479902
SHA512 d737c719833aa45a52fa10741ce7bc98fe7dc6da4572db82f8469025ff8201c2daa14a274bc212fe51c76ddd786c96c5593da47755b134a4291bb453fe7a5843

memory/2980-112-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/2980-113-0x0000000070D50000-0x00000000710A7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 c339e6362e442d227eb5672db7dae1ff
SHA1 7f2c2b09a7702a770d176b70e756f1d2519a6a7b
SHA256 f7c27bb96adb270afef18ea2b156149e4f23758a3ba0456d5663d129bfe9b3ae
SHA512 e731f2fabb282a9a2b575c66b3fb0d9bab809838f9fb0b36d10d39df39452344ca8fdf21e78feb79b2446183df5aaa2325b5b702f6d2f629fa7aae85678071ef

C:\Windows\rss\csrss.exe

MD5 4ee1d74acca14f140778165c2c9dad59
SHA1 b577cab5e24dfe11164e5dd8210bb9914672ba47
SHA256 b2ccb25f40e23b25db296b0d5a5c4145c7af805d90766ecac2f3dfaace8feecb
SHA512 72bd95e2294054955e4c842dad8b499a349ce28c1f776f1bb4d4e9353fef3f2efb258fdb0085901097e7eeec3a57a3f72c41f18b446baebfa2c6a5d7038f511a

memory/2180-122-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3460-137-0x00000000057E0000-0x0000000005B37000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 88019017738a3a2ea2cdad4a2b8ecd13
SHA1 83abbce536c50f3c3997c7f98be470760b759d9f
SHA256 26751dc5d45f0ba7f2a8366661d7424f3abea297f0df73138fb82c627dba2b59
SHA512 76767448d1303e8873887c887c47e9f2f1473b325bd2d210e437ae8746a6f02df5bc96f0745f546a3aeb19060eb292f46527828155286ea845bbf3b86959a1dd

memory/3460-139-0x0000000006330000-0x000000000637C000-memory.dmp

memory/3460-150-0x00000000070B0000-0x0000000007154000-memory.dmp

memory/3460-141-0x0000000070C90000-0x0000000070FE7000-memory.dmp

memory/3460-140-0x0000000070A60000-0x0000000070AAC000-memory.dmp

memory/3460-151-0x0000000007420000-0x0000000007431000-memory.dmp

memory/3460-152-0x0000000005B60000-0x0000000005B75000-memory.dmp

memory/2948-162-0x0000000005710000-0x0000000005A67000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 fd78f895855f2d9da21e5cdd35cd4754
SHA1 909f7eefa9bf0f483c3f277859c7452165569dd3
SHA256 218dcba1359460088add0964c3500d57649c94b7ad85d19228f9f6b59be91227
SHA512 cc0c3f18b801ed5bdfa9c005f74b216d343167c04d731d92f5273ce2788f0c518c7bc11464d16137563d868d450b7319e4270a15781ac736ef9febb296d3cb21

memory/2948-164-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

memory/2948-166-0x0000000070BD0000-0x0000000070F27000-memory.dmp

memory/2948-175-0x0000000006F00000-0x0000000006FA4000-memory.dmp

memory/2948-165-0x0000000070980000-0x00000000709CC000-memory.dmp

memory/2948-176-0x0000000007220000-0x0000000007231000-memory.dmp

memory/2948-177-0x0000000005680000-0x0000000005695000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f1bf29ac8509435c23c35c1555b13887
SHA1 5968888e43be2ee97b1c0eb00d823289df93b6fb
SHA256 f1d56be7748255191055d7933cadf054379278124db719ace50b9da352c966ff
SHA512 008880eb819f5bf2194cff6958ccc4c138c59a1c09d25f23e8188acc5be15b0533e45078e0a214aba7fef32efdec27ac064c722c02d4a5111ed1b8f0a2e22de1

memory/4124-189-0x0000000070BD0000-0x0000000070F27000-memory.dmp

memory/4124-188-0x0000000070980000-0x00000000709CC000-memory.dmp

memory/2180-198-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1304-205-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2256-211-0x0000000000400000-0x00000000008DF000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

C:\Windows\windefender.exe

MD5 a43d1181c5c818d7d78e782ec1828903
SHA1 ce87b6b09f2b30c85a2420d7e1471a0c2db55475
SHA256 57b26db83b472d3aa74fdc739ae2a2aab69513a334cc9850d2adc81053093cf4
SHA512 5985d550e97d5a383a3b121dd3c42ef032f3815afa7ac6ff35c0935fb143c51c5ac0406b0dd854c1936aff98d8da964ba1c390187b81380ee891ac8708cdd6d4

memory/2256-215-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3596-216-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1304-213-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1304-218-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1304-221-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1304-224-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3596-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1304-227-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1304-230-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1304-233-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1304-236-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1304-239-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1304-242-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1304-245-0x0000000000400000-0x0000000002B0B000-memory.dmp