Malware Analysis Report

2025-01-02 06:40

Sample ID 240515-ws9nrach6z
Target 089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7
SHA256 089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7

Threat Level: Known bad

The file 089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Checks installed software on the system

Manipulates WinMonFS driver.

Adds Run key to start application

Drops file in System32 directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 18:12

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 18:12

Reported

2024-05-15 18:14

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4792 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4792 wrote to memory of 3896 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\system32\cmd.exe
PID 3216 wrote to memory of 3504 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\system32\cmd.exe
PID 3504 wrote to memory of 1032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3504 wrote to memory of 1032 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3216 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3216 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\rss\csrss.exe
PID 3216 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\rss\csrss.exe
PID 3216 wrote to memory of 3568 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\rss\csrss.exe
PID 3568 wrote to memory of 1656 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3568 wrote to memory of 1656 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3568 wrote to memory of 1656 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3568 wrote to memory of 3920 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3568 wrote to memory of 3920 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3568 wrote to memory of 3920 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3568 wrote to memory of 2784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3568 wrote to memory of 2784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3568 wrote to memory of 2784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3568 wrote to memory of 2528 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3568 wrote to memory of 2528 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4892 wrote to memory of 848 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4892 wrote to memory of 848 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4892 wrote to memory of 848 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 848 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 848 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 848 wrote to memory of 2596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe

"C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe

"C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 75.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 138.201.86.20.in-addr.arpa udp
NL 23.62.61.75:443 www.bing.com tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 7146ab0c-839f-47c3-a817-86fcca0776dd.uuid.statscreate.org udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 stun1.l.google.com udp
US 8.8.8.8:53 server16.statscreate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun1.l.google.com udp
BG 185.82.216.96:443 server16.statscreate.org tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 233.135.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BG 185.82.216.96:443 server16.statscreate.org tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4792-1-0x00000000047D0000-0x0000000004BD2000-memory.dmp

memory/4792-2-0x0000000004BE0000-0x00000000054CB000-memory.dmp

memory/4792-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3896-4-0x000000007498E000-0x000000007498F000-memory.dmp

memory/3896-5-0x00000000045D0000-0x0000000004606000-memory.dmp

memory/3896-7-0x0000000004C40000-0x0000000005268000-memory.dmp

memory/3896-6-0x0000000074980000-0x0000000075130000-memory.dmp

memory/3896-8-0x0000000074980000-0x0000000075130000-memory.dmp

memory/3896-11-0x0000000005530000-0x0000000005596000-memory.dmp

memory/3896-10-0x0000000005390000-0x00000000053F6000-memory.dmp

memory/3896-9-0x00000000052F0000-0x0000000005312000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fo4yd1ur.qme.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3896-21-0x00000000055A0000-0x00000000058F4000-memory.dmp

memory/3896-22-0x0000000005B80000-0x0000000005B9E000-memory.dmp

memory/3896-23-0x0000000005BB0000-0x0000000005BFC000-memory.dmp

memory/3896-24-0x0000000006120000-0x0000000006164000-memory.dmp

memory/3896-25-0x0000000006EB0000-0x0000000006F26000-memory.dmp

memory/3896-26-0x00000000075B0000-0x0000000007C2A000-memory.dmp

memory/3896-27-0x0000000006F30000-0x0000000006F4A000-memory.dmp

memory/3896-30-0x0000000070820000-0x000000007086C000-memory.dmp

memory/3896-29-0x00000000070F0000-0x0000000007122000-memory.dmp

memory/3896-37-0x0000000074980000-0x0000000075130000-memory.dmp

memory/3896-44-0x0000000074980000-0x0000000075130000-memory.dmp

memory/3896-31-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/3896-43-0x0000000007150000-0x00000000071F3000-memory.dmp

memory/3896-42-0x0000000007130000-0x000000000714E000-memory.dmp

memory/3896-45-0x0000000007240000-0x000000000724A000-memory.dmp

memory/4792-28-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3896-46-0x0000000007300000-0x0000000007396000-memory.dmp

memory/3896-47-0x0000000007260000-0x0000000007271000-memory.dmp

memory/3896-48-0x00000000072A0000-0x00000000072AE000-memory.dmp

memory/3896-50-0x00000000073A0000-0x00000000073BA000-memory.dmp

memory/3896-51-0x00000000072E0000-0x00000000072E8000-memory.dmp

memory/3896-49-0x00000000072B0000-0x00000000072C4000-memory.dmp

memory/3896-54-0x0000000074980000-0x0000000075130000-memory.dmp

memory/4792-56-0x00000000047D0000-0x0000000004BD2000-memory.dmp

memory/4792-57-0x0000000004BE0000-0x00000000054CB000-memory.dmp

memory/1496-67-0x0000000070820000-0x000000007086C000-memory.dmp

memory/1496-68-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/1496-78-0x0000000006CE0000-0x0000000006D83000-memory.dmp

memory/1496-79-0x0000000006FF0000-0x0000000007001000-memory.dmp

memory/1496-80-0x0000000007040000-0x0000000007054000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7b2129175dad75678071714cd1a66c74
SHA1 8128b064e3a3bd369469fbc347ee38f35d733e3f
SHA256 3a59b6ea292295b58d6493b34a7e3a3ecabd0cef90dbc44d8d43fb08bd2776ce
SHA512 7d82a6349afb57e3d0dfc44a1e0bab432dca4522e2a8e1126cd727b52f6ac858f213cf6b003b806fe2b2977bb8f8b91d17cfb8aead8a15177dd17aaac6de5574

memory/4792-94-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4720-95-0x0000000070820000-0x000000007086C000-memory.dmp

memory/4720-96-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/2900-116-0x0000000005EE0000-0x0000000006234000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 aaf5388fe2ac4d48a2d2a9c4ced2adbc
SHA1 95cdb7c14e90d4a30ec209c5c950c6e0bdeee0b8
SHA256 525bbd2a93e8f8d594cbc20b96dff54015ede9633a16a751282089d93cc8c6cc
SHA512 4d6232b8fab132d4c913244499870f3fc6a214e41982f43b884fcd8c5af7ae988759cdbab5b63c3561ae29ed022dd45cca9c24576553662206ae4f395e35cbed

memory/2900-119-0x0000000070C20000-0x0000000070F74000-memory.dmp

memory/2900-118-0x0000000070820000-0x000000007086C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 2f4187b5d3fed824939197f7d1c850be
SHA1 be00943c6561d69e6805ae728dd4a3a75ff30b8a
SHA256 089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7
SHA512 03ea33b028c44fd08a69fad0473d7a74ffa1e1fc7362483b55a051f48771910a64eb415f76e6761021564e18deb9b9fe9a223bea8d51f7281b5383fd71a2d94a

memory/4792-136-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3216-135-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 80260757c523783e73603b97527559b1
SHA1 921723c937a6f502e053b95a00c7f0e27d8e116e
SHA256 71e019c15d6c9dfdd5b3a78316a2bd52a3b26559d0b448a26b563329e8f540a6
SHA512 5f0ebca4365526b334100546235398c4002a6581e156cdda554d92fa2d6040bdee812406540e5325fdc45db5766d8184ed059382f745d47606e2f9ae16978df4

memory/1656-147-0x0000000070820000-0x000000007086C000-memory.dmp

memory/1656-148-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/3920-169-0x0000000005AB0000-0x0000000005E04000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 97025861a698e4e21fe67684581b5c9c
SHA1 a26d1a5d8c6dc5bb45cc55897978d3a3711b0798
SHA256 1c99c033b4bae8c499b85d4d99c4c10b16516c9697d2d71bd0af4ecb566fcd04
SHA512 b7ea0d32995bffdd87199df49a2812a5be9b46a8962e49e40103a9447d3bf5212ea426c63a5575c37acdad463682fed5f784497e92b57b18c669ed9dd1af4ec0

memory/3920-171-0x0000000006080000-0x00000000060CC000-memory.dmp

memory/3920-172-0x0000000070740000-0x000000007078C000-memory.dmp

memory/3920-173-0x00000000708C0000-0x0000000070C14000-memory.dmp

memory/3920-183-0x0000000007230000-0x00000000072D3000-memory.dmp

memory/3920-184-0x0000000007570000-0x0000000007581000-memory.dmp

memory/3920-185-0x0000000005E30000-0x0000000005E44000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1eb96ad47f97aff487d179f06c604505
SHA1 097cdafb54ec1f54068dad573b522c8ee444f01e
SHA256 5ac15fe165d4edf2a649f0efc4d4a2ad998dafa39273faa8131913980d1e8198
SHA512 4c01d14c96afda8c90256aacb773b9dd7387f9ecd1ca249fd7fca09cc33fa8f0142d9c3d45743436436973471dcd6c9d5ff63a7224e12594ebae576f2b994a3a

memory/2784-197-0x0000000070740000-0x000000007078C000-memory.dmp

memory/2784-198-0x00000000708C0000-0x0000000070C14000-memory.dmp

memory/3568-209-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3568-218-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4892-223-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4212-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4892-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3568-230-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4212-231-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3568-234-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3568-238-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4212-239-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3568-242-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3568-246-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3568-250-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4212-251-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3568-254-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3568-258-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3568-262-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3568-266-0x0000000000400000-0x0000000002B0B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 18:12

Reported

2024-05-15 18:14

Platform

win11-20240426-en

Max time kernel

149s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2772 = "Omsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1932 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1932 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\system32\cmd.exe
PID 1936 wrote to memory of 4936 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\system32\cmd.exe
PID 4936 wrote to memory of 5020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4936 wrote to memory of 5020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1936 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 3780 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1936 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\rss\csrss.exe
PID 1936 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\rss\csrss.exe
PID 1936 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe C:\Windows\rss\csrss.exe
PID 4440 wrote to memory of 4744 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 4744 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4440 wrote to memory of 4744 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4744 wrote to memory of 4888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4744 wrote to memory of 4888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4744 wrote to memory of 4888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe

"C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe

"C:\Users\Admin\AppData\Local\Temp\089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 04301aa3-5fa2-4183-a835-dbe47acc948a.uuid.statscreate.org udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 server11.statscreate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun4.l.google.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server11.statscreate.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.96:443 server11.statscreate.org tcp
BG 185.82.216.96:443 server11.statscreate.org tcp

Files

memory/1932-1-0x00000000049D0000-0x0000000004DD3000-memory.dmp

memory/1932-2-0x0000000004DE0000-0x00000000056CB000-memory.dmp

memory/1932-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1028-4-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

memory/1028-5-0x0000000005200000-0x0000000005236000-memory.dmp

memory/1028-7-0x00000000059C0000-0x0000000005FEA000-memory.dmp

memory/1028-6-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/1028-8-0x0000000005720000-0x0000000005742000-memory.dmp

memory/1028-11-0x00000000061A0000-0x0000000006206000-memory.dmp

memory/1028-10-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/1028-9-0x00000000058C0000-0x0000000005926000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5kpzgyxd.5yf.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1028-17-0x0000000006210000-0x0000000006567000-memory.dmp

memory/1028-21-0x00000000066B0000-0x00000000066CE000-memory.dmp

memory/1028-22-0x0000000006750000-0x000000000679C000-memory.dmp

memory/1028-23-0x0000000006B20000-0x0000000006B66000-memory.dmp

memory/1028-24-0x0000000007AE0000-0x0000000007B14000-memory.dmp

memory/1028-35-0x0000000007B20000-0x0000000007B3E000-memory.dmp

memory/1028-37-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/1028-36-0x0000000007B40000-0x0000000007BE4000-memory.dmp

memory/1028-26-0x00000000711C0000-0x0000000071517000-memory.dmp

memory/1028-25-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

memory/1028-38-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/1028-40-0x0000000007C70000-0x0000000007C8A000-memory.dmp

memory/1028-39-0x00000000082B0000-0x000000000892A000-memory.dmp

memory/1028-41-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

memory/1028-42-0x0000000007DC0000-0x0000000007E56000-memory.dmp

memory/1028-43-0x0000000007CD0000-0x0000000007CE1000-memory.dmp

memory/1028-44-0x0000000007D20000-0x0000000007D2E000-memory.dmp

memory/1028-45-0x0000000007D30000-0x0000000007D45000-memory.dmp

memory/1028-46-0x0000000007D80000-0x0000000007D9A000-memory.dmp

memory/1028-47-0x0000000007DA0000-0x0000000007DA8000-memory.dmp

memory/1028-50-0x0000000074D40000-0x00000000754F1000-memory.dmp

memory/1932-52-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1932-53-0x00000000049D0000-0x0000000004DD3000-memory.dmp

memory/5028-54-0x0000000005D60000-0x00000000060B7000-memory.dmp

memory/5028-64-0x0000000071200000-0x0000000071557000-memory.dmp

memory/5028-63-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

memory/5028-73-0x00000000074F0000-0x0000000007594000-memory.dmp

memory/5028-74-0x0000000007840000-0x0000000007851000-memory.dmp

memory/5028-75-0x0000000007890000-0x00000000078A5000-memory.dmp

memory/1932-76-0x0000000004DE0000-0x00000000056CB000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 54955c277592e027ad174844465247cd
SHA1 1d69bcead99a2456f7a1622645daa4035f4e7c4c
SHA256 3748d90fda2fceb9e5ea2a229c13f32657607d27c828f4af34a357bf821e179a
SHA512 4c43432c25e2fd7c0c4e06a4eb9652df2cb53841e27e0b9ad39f2c33dbbc2e01cadfe9d2dca805809f715538212519ea1185325749de12dc09f9d478e314ebe5

memory/2828-90-0x0000000071200000-0x0000000071557000-memory.dmp

memory/2828-89-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

memory/1932-101-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1936-100-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3780-111-0x0000000005BB0000-0x0000000005F07000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 141a886f512b34a06d9fdb20e07b1bca
SHA1 c1c5cc525b60f7575b7ec976bc7a035761f88f77
SHA256 df9f0cb8c3ef6c24bfa427d3492b8dd2793c81c8edb4978f1759930e74ad592e
SHA512 8889da2661f0e608d51579698af492d1e76be50d28a29ee95b2ed57638409f6cdf80e58d5f37ace59670ab6ba7281c90c81c9b505b88c13d0f6223d9d233e452

memory/3780-113-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

memory/3780-114-0x0000000071150000-0x00000000714A7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 2f4187b5d3fed824939197f7d1c850be
SHA1 be00943c6561d69e6805ae728dd4a3a75ff30b8a
SHA256 089044389e60fede8122f6f8bdc54b38185490cd554a56ef891e23a20253e0d7
SHA512 03ea33b028c44fd08a69fad0473d7a74ffa1e1fc7362483b55a051f48771910a64eb415f76e6761021564e18deb9b9fe9a223bea8d51f7281b5383fd71a2d94a

memory/1936-127-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1676-137-0x0000000005C70000-0x0000000005FC7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b70993e72eca3e35b349e212b093d0ca
SHA1 7b5cfc3a68ffd7192e383f37fef571edc7ea11df
SHA256 8dd61b80be8b0746ce4968104c61ce785cae87a42ac3033709daaaef841d542a
SHA512 77da8dd140fc6eec4adc2618505b19f41f001b9e7d4581aabf8d2163b956e8059eef56d4b649738bd76d77da9bba85939aaed5667e08e96b631174c16205278d

memory/1676-139-0x0000000070FB0000-0x0000000070FFC000-memory.dmp

memory/1676-140-0x0000000071130000-0x0000000071487000-memory.dmp

memory/2816-150-0x0000000005B10000-0x0000000005E67000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 aafa4fc5fa0e99deca9dd5fffd4322b7
SHA1 08fc186adab34e6763df2034d6ae3de67ed73c7a
SHA256 100b0ba6d786e19c5b0dea3fd272f7d011418998e032c6c53afe8210bf32621a
SHA512 ea68407f6f5a53bbe8b0cc6a3c70a0951db3fdf7c34ab7f2e10f0633f3c26c320e655a7fe754bc49f3585c294844121eb3f5439c8c279f3a0a442ce1823746ef

memory/2816-161-0x0000000006110000-0x000000000615C000-memory.dmp

memory/2816-162-0x0000000070ED0000-0x0000000070F1C000-memory.dmp

memory/2816-163-0x0000000071120000-0x0000000071477000-memory.dmp

memory/2816-172-0x00000000072F0000-0x0000000007394000-memory.dmp

memory/2816-173-0x00000000076A0000-0x00000000076B1000-memory.dmp

memory/2816-174-0x0000000005EA0000-0x0000000005EB5000-memory.dmp

memory/2300-184-0x0000000005A60000-0x0000000005DB7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 08a73738518c49de752721b4dcb0a454
SHA1 f0dabe4c58601bdac6138a048818a8aceaf74022
SHA256 0294d4e4397bfd1ac88d7381a9ef16ba9440750318df123ef4ac28538082222f
SHA512 0dd13aa66b32524d07b6e8f52fcf47c3aaff28622d7492f5a26b3b673f333fd8c6c478906c645a98ff4f190a56947f3ec777b1c291e2dc963999b45a4177903f

memory/1980-189-0x0000000075580000-0x0000000075591000-memory.dmp

memory/1980-188-0x00000000755A0000-0x00000000755BE000-memory.dmp

memory/1980-187-0x00000000755C0000-0x0000000075627000-memory.dmp

memory/2300-190-0x0000000070ED0000-0x0000000070F1C000-memory.dmp

memory/1980-186-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/2300-191-0x0000000071100000-0x0000000071457000-memory.dmp

memory/1980-206-0x0000000075530000-0x0000000075571000-memory.dmp

memory/1980-203-0x00000000755C0000-0x0000000075627000-memory.dmp

memory/1980-202-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4440-208-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4440-211-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4416-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1980-213-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4416-219-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1980-221-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4416-235-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1980-229-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1980-237-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1980-245-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1980-253-0x0000000000400000-0x0000000002B0B000-memory.dmp