Malware Analysis Report

2025-01-02 06:41

Sample ID 240515-wt6cqada2z
Target 43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38
SHA256 43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38

Threat Level: Known bad

The file 43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Adds Run key to start application

Checks installed software on the system

Manipulates WinMonFS driver.

Drops file in System32 directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Modifies data under HKEY_USERS

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-15 18:13

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-15 18:13

Reported

2024-05-15 18:16

Platform

win11-20240508-en

Max time kernel

149s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1476 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1476 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1476 wrote to memory of 4236 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2112 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2112 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2112 wrote to memory of 4504 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2112 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\system32\cmd.exe
PID 2112 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\system32\cmd.exe
PID 4816 wrote to memory of 4548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4816 wrote to memory of 4548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2112 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2112 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2112 wrote to memory of 4172 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2112 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2112 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2112 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2112 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\rss\csrss.exe
PID 2112 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\rss\csrss.exe
PID 2112 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\rss\csrss.exe
PID 3424 wrote to memory of 1220 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 1220 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 1220 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 4576 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 4576 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 4576 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 2024 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 2024 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 2024 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3424 wrote to memory of 3804 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3424 wrote to memory of 3804 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1136 wrote to memory of 3120 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1136 wrote to memory of 3120 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1136 wrote to memory of 3120 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3120 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3120 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3120 wrote to memory of 1344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe

"C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe

"C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 4f0a9ccf-4844-403c-bfb8-44b079004caa.uuid.databaseupgrade.ru udp
US 8.8.8.8:53 stun.l.google.com udp
US 8.8.8.8:53 server5.databaseupgrade.ru udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun.l.google.com udp
BG 185.82.216.108:443 server5.databaseupgrade.ru tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.108:443 server5.databaseupgrade.ru tcp
US 52.111.227.14:443 tcp

Files

memory/1476-1-0x0000000004860000-0x0000000004C60000-memory.dmp

memory/1476-2-0x0000000004C60000-0x000000000554B000-memory.dmp

memory/1476-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4236-4-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

memory/4236-5-0x00000000033C0000-0x00000000033F6000-memory.dmp

memory/4236-7-0x0000000005B80000-0x00000000061AA000-memory.dmp

memory/4236-6-0x0000000074AD0000-0x0000000075281000-memory.dmp

memory/4236-8-0x00000000059A0000-0x00000000059C2000-memory.dmp

memory/4236-9-0x0000000074AD0000-0x0000000075281000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mbl10obc.gmz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4236-11-0x0000000006390000-0x00000000063F6000-memory.dmp

memory/4236-10-0x00000000062B0000-0x0000000006316000-memory.dmp

memory/4236-20-0x0000000006400000-0x0000000006757000-memory.dmp

memory/4236-21-0x0000000006860000-0x000000000687E000-memory.dmp

memory/4236-22-0x0000000006880000-0x00000000068CC000-memory.dmp

memory/4236-23-0x0000000006DB0000-0x0000000006DF6000-memory.dmp

memory/4236-25-0x0000000007C60000-0x0000000007C94000-memory.dmp

memory/4236-27-0x0000000070EC0000-0x0000000071217000-memory.dmp

memory/4236-26-0x0000000070D40000-0x0000000070D8C000-memory.dmp

memory/4236-37-0x0000000007CE0000-0x0000000007D84000-memory.dmp

memory/4236-36-0x0000000007CC0000-0x0000000007CDE000-memory.dmp

memory/4236-38-0x0000000074AD0000-0x0000000075281000-memory.dmp

memory/4236-39-0x0000000074AD0000-0x0000000075281000-memory.dmp

memory/1476-24-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4236-41-0x0000000007E00000-0x0000000007E1A000-memory.dmp

memory/4236-40-0x0000000008450000-0x0000000008ACA000-memory.dmp

memory/4236-42-0x0000000007E40000-0x0000000007E4A000-memory.dmp

memory/4236-43-0x0000000007F50000-0x0000000007FE6000-memory.dmp

memory/4236-44-0x0000000007E60000-0x0000000007E71000-memory.dmp

memory/4236-45-0x0000000007EB0000-0x0000000007EBE000-memory.dmp

memory/4236-46-0x0000000007EC0000-0x0000000007ED5000-memory.dmp

memory/4236-47-0x0000000007F10000-0x0000000007F2A000-memory.dmp

memory/4236-48-0x0000000007F30000-0x0000000007F38000-memory.dmp

memory/4236-51-0x0000000074AD0000-0x0000000075281000-memory.dmp

memory/1476-54-0x0000000004860000-0x0000000004C60000-memory.dmp

memory/1476-55-0x0000000004C60000-0x000000000554B000-memory.dmp

memory/1476-53-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/1476-64-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4504-65-0x0000000070D40000-0x0000000070D8C000-memory.dmp

memory/4504-66-0x0000000070EC0000-0x0000000071217000-memory.dmp

memory/4504-75-0x0000000007A40000-0x0000000007AE4000-memory.dmp

memory/4504-76-0x0000000007D60000-0x0000000007D71000-memory.dmp

memory/4504-77-0x0000000007DB0000-0x0000000007DC5000-memory.dmp

memory/2112-78-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/4172-90-0x00000000054E0000-0x0000000005837000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7bdd54760fe7ad2d7224b41e22d1d130
SHA1 56eb43357cbee074855e88dc7610c86be927c2b2
SHA256 bc93942bd30fd2cc72ae25055124874ee1bd344682aa25fb97fc2f2f6585bae6
SHA512 777f673dafd84592f7569b8d4a937b3d2eb0fb90a5bc95dad9f117ce1e4e1dd4809c9c55caae958423a09da136385409b2b3df355775eaaaa40cdbbb1a49c223

memory/4172-92-0x0000000070D40000-0x0000000070D8C000-memory.dmp

memory/4172-93-0x0000000070F50000-0x00000000712A7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5d12f440604768d6f5f3364a7c17e6c1
SHA1 6e31f442fd8b0837b915537bafac0aef565222fc
SHA256 fa53b222130dc4e070c0063facb6a91b15f7f9d8272ca23a755b51e23995fb4b
SHA512 a350e856278cba0eea5a9032889f8801bc91f21deb665058be7a595de32cfe039cb55eeca7cf48680c55e5959bfd431e25f2fb66c9d43a7e173f56913cddb3de

memory/2560-113-0x0000000070D40000-0x0000000070D8C000-memory.dmp

memory/2560-114-0x0000000070F50000-0x00000000712A7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 34e0adae7d41772930a323922e1620bf
SHA1 f26697afec27c400d7f0453cffd4e17cb3f66b94
SHA256 43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38
SHA512 46e08ffd26e0363a9e6346a72b837a515773c882d1afae37646725e0938930729ffa564133708e88e5b087fc855142ae45a5516a1d32412666011c766ef33864

memory/2112-127-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 66ea94b46cc276a5a7436dbae4d9afda
SHA1 ef9021487e1721009771715cc391ab5b0522e56f
SHA256 7209baa7c13102139cdc2780b9829540480d442595c60e0b38468baa34d9f61b
SHA512 88c7c609d7279f0f10c0404c12bffd1ec912fc4afdd9bcec886b04f6e616fe0b227a19a4aa601ef39027de11f04a7ac36fd0d3affe7560ff7a4f742523078838

memory/1220-140-0x0000000070D40000-0x0000000070D8C000-memory.dmp

memory/1220-141-0x0000000070F50000-0x00000000712A7000-memory.dmp

memory/3424-150-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4576-160-0x0000000005E30000-0x0000000006187000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 fd02dfa7c5f931c17579266a8bfb83eb
SHA1 9450ab021f106b5b8e391aea6211813a471bfd54
SHA256 04650892202c49db8a62563c352764bd255b96078f1ca58501a3c486a3fd1a54
SHA512 7c910943a8660d4adef53ed23b27e27be3e9e5036747cb6a3068520888dee456dac09c3fd4a11ae5e6e3cd25fea46ebf0b027900f2ffd412933345d662056d3b

memory/4576-162-0x0000000006900000-0x000000000694C000-memory.dmp

memory/4576-163-0x0000000070C60000-0x0000000070CAC000-memory.dmp

memory/4576-164-0x0000000070EB0000-0x0000000071207000-memory.dmp

memory/4576-173-0x0000000007620000-0x00000000076C4000-memory.dmp

memory/4576-175-0x0000000007980000-0x0000000007991000-memory.dmp

memory/4576-176-0x00000000061C0000-0x00000000061D5000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e500ba6fcf1132986bb578570818d2a8
SHA1 e997eac04aa31b10f8158ace7bce460e18a39762
SHA256 70b3ca29d9c3c7a60bc76df1d93dc0065ad1a8b23a381582c22ffd1761479726
SHA512 0b3703cbc4e5a0a1a4df9cb6a4e785692c492e867ba2579434efb05e121ef866ed7f18dc6819e632aa32944eb1635e17a68e6c140ba913ced10a31f5363984d8

memory/2024-187-0x0000000070C60000-0x0000000070CAC000-memory.dmp

memory/2024-188-0x0000000070EB0000-0x0000000071207000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3424-203-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1136-208-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4504-211-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1136-213-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3424-214-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4504-217-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3424-216-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3424-219-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4504-222-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3424-223-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3424-226-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3424-228-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3424-231-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3424-235-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3424-238-0x0000000000400000-0x0000000002B0B000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-15 18:13

Reported

2024-05-15 18:16

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-571 = "China Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 840 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 840 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 840 wrote to memory of 4664 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\system32\cmd.exe
PID 4104 wrote to memory of 3216 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\system32\cmd.exe
PID 3216 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3216 wrote to memory of 1200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4104 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 4868 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 4380 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4104 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\rss\csrss.exe
PID 4104 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\rss\csrss.exe
PID 4104 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe C:\Windows\rss\csrss.exe
PID 316 wrote to memory of 3140 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 316 wrote to memory of 3140 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 316 wrote to memory of 3140 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 316 wrote to memory of 4016 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 316 wrote to memory of 4016 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 316 wrote to memory of 4016 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 316 wrote to memory of 1508 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 316 wrote to memory of 1508 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 316 wrote to memory of 1508 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 316 wrote to memory of 4464 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 316 wrote to memory of 4464 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 5012 wrote to memory of 1620 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 1620 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5012 wrote to memory of 1620 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1620 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1620 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1620 wrote to memory of 2944 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe

"C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe

"C:\Users\Admin\AppData\Local\Temp\43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 cc223c2e-1664-4f24-85d7-d202ee1d31ab.uuid.databaseupgrade.ru udp
US 8.8.8.8:53 stun.l.google.com udp
US 8.8.8.8:53 server12.databaseupgrade.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun.l.google.com udp
BG 185.82.216.108:443 server12.databaseupgrade.ru tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.108:443 server12.databaseupgrade.ru tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
BG 185.82.216.108:443 server12.databaseupgrade.ru tcp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp

Files

memory/840-1-0x0000000004800000-0x0000000004BFF000-memory.dmp

memory/840-2-0x0000000004C00000-0x00000000054EB000-memory.dmp

memory/840-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4664-4-0x0000000073FFE000-0x0000000073FFF000-memory.dmp

memory/4664-5-0x00000000027A0000-0x00000000027D6000-memory.dmp

memory/4664-6-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/4664-7-0x0000000005030000-0x0000000005658000-memory.dmp

memory/4664-8-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/840-9-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4664-12-0x0000000004FC0000-0x0000000004FE2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zjapypgz.rgj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4664-17-0x0000000005740000-0x00000000057A6000-memory.dmp

memory/4664-16-0x00000000056D0000-0x0000000005736000-memory.dmp

memory/4664-22-0x00000000057B0000-0x0000000005B04000-memory.dmp

memory/4664-23-0x0000000005D00000-0x0000000005D1E000-memory.dmp

memory/4664-24-0x0000000005DF0000-0x0000000005E3C000-memory.dmp

memory/4664-25-0x0000000006320000-0x0000000006364000-memory.dmp

memory/4664-26-0x00000000070B0000-0x0000000007126000-memory.dmp

memory/4664-27-0x00000000077B0000-0x0000000007E2A000-memory.dmp

memory/4664-28-0x0000000007150000-0x000000000716A000-memory.dmp

memory/4664-29-0x0000000007310000-0x0000000007342000-memory.dmp

memory/4664-30-0x000000006FE90000-0x000000006FEDC000-memory.dmp

memory/4664-32-0x0000000070440000-0x0000000070794000-memory.dmp

memory/4664-31-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/4664-42-0x0000000007350000-0x000000000736E000-memory.dmp

memory/4664-43-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/4664-44-0x0000000007370000-0x0000000007413000-memory.dmp

memory/4664-45-0x0000000007460000-0x000000000746A000-memory.dmp

memory/4664-47-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/4664-46-0x0000000007570000-0x0000000007606000-memory.dmp

memory/4664-48-0x0000000007470000-0x0000000007481000-memory.dmp

memory/4664-49-0x00000000074B0000-0x00000000074BE000-memory.dmp

memory/4664-50-0x00000000074D0000-0x00000000074E4000-memory.dmp

memory/4664-51-0x0000000007510000-0x000000000752A000-memory.dmp

memory/4664-52-0x0000000007500000-0x0000000007508000-memory.dmp

memory/4664-55-0x0000000073FF0000-0x00000000747A0000-memory.dmp

memory/840-57-0x0000000004800000-0x0000000004BFF000-memory.dmp

memory/840-58-0x0000000004C00000-0x00000000054EB000-memory.dmp

memory/840-60-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/840-59-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4464-70-0x0000000005C90000-0x0000000005FE4000-memory.dmp

memory/4464-71-0x000000006FE90000-0x000000006FEDC000-memory.dmp

memory/4464-72-0x0000000070010000-0x0000000070364000-memory.dmp

memory/4464-82-0x00000000072A0000-0x0000000007343000-memory.dmp

memory/4464-83-0x00000000075B0000-0x00000000075C1000-memory.dmp

memory/4104-84-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4464-85-0x0000000007600000-0x0000000007614000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/4868-89-0x0000000006210000-0x0000000006564000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 65db537509dd9c193006ba32168bc643
SHA1 190b23e10c7615f10cea32b17b2d3c607cacfb77
SHA256 f0c39ee3154f3f706afc7cc7a9939a5612f2668b6098bedcf5ef3e48fb9ce4a6
SHA512 5036687f07e147cb2fa99c21db2b1b76b101668f447aec6f6549b7ffa20edda03d8f2bcf006286cb4c1fcff82d8d9c2cb90e3a68d81921d9d5dce7b459a7e5ab

memory/4868-101-0x0000000070630000-0x0000000070984000-memory.dmp

memory/4868-100-0x000000006FE90000-0x000000006FEDC000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ac672cd0530d6caa2ccb3cca19571b06
SHA1 756be33a4eefdf390d40890956658551700b4ebf
SHA256 6aa60283f79de8d05ea2612d8ef7cedb480ebb7c6a1245176461cdce919effa3
SHA512 3a41e104f3d3a6e83afff162551d83463e9133333f7b064ab18d175a88d1fd08d1fe61dd2090c5b9b0dc4dd3b90ec5e1c1b489e6c4a746820f3212e425b41472

memory/4380-123-0x000000006FE90000-0x000000006FEDC000-memory.dmp

memory/4380-124-0x0000000070010000-0x0000000070364000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 34e0adae7d41772930a323922e1620bf
SHA1 f26697afec27c400d7f0453cffd4e17cb3f66b94
SHA256 43097af0c0016b469656706ee080e73a4edb6f2cd2f5e14e63381dc03175dc38
SHA512 46e08ffd26e0363a9e6346a72b837a515773c882d1afae37646725e0938930729ffa564133708e88e5b087fc855142ae45a5516a1d32412666011c766ef33864

memory/4104-140-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/3140-151-0x00000000060D0000-0x0000000006424000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4f1400169f9a63bc876c1007b04e7e0b
SHA1 0a00d1e20211ce64f05726cd293f29f5ab4e0888
SHA256 ce7e9ac35b030a5ed4456fb84cc6e34a31bc70d2ea656cad7a582d7979ae77e3
SHA512 9aec11818f01ca4c4034b3563b39548afa9b81a9af7c492832b1797c21ce7d370c63a6ab8d3dd5ff0fcc0d6f5631e3f9bb643fdcdbc52f7343e055ac766877eb

memory/3140-154-0x000000006FE90000-0x000000006FEDC000-memory.dmp

memory/3140-155-0x0000000070030000-0x0000000070384000-memory.dmp

memory/316-153-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/4016-175-0x0000000005A50000-0x0000000005DA4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 771142472bc9e7e37d3b068d31acd057
SHA1 16459123608eb0ebe462d7019ca22f25957288af
SHA256 8477195e697673d3b895df760ec945f6b73ce97a51e4a2df6909eaa792691cc2
SHA512 46154e0c10a6b3689717120e9df60f7ac659dfa1eee48239813046168f8120d95b5414ae085b36f8035bbcc580b7a2ecf6a3d1ac305721adb610ec49737c869b

memory/4016-177-0x0000000006470000-0x00000000064BC000-memory.dmp

memory/4016-179-0x000000006FDB0000-0x000000006FDFC000-memory.dmp

memory/4016-180-0x000000006FF30000-0x0000000070284000-memory.dmp

memory/4016-190-0x0000000007120000-0x00000000071C3000-memory.dmp

memory/4016-191-0x0000000007460000-0x0000000007471000-memory.dmp

memory/4016-192-0x0000000005930000-0x0000000005944000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6cf69b31a003cde94c764534fb3a17e4
SHA1 d55b519c4a2900953044688c3f8277de39c726a9
SHA256 5631570b9ca1b7fae9e32569833e18c31c5dd40dd596298c51d43810e96d4751
SHA512 528f4702738756ef3859e277cfcab32a5b216aad9fe00cb7d552e3c252307c3638590a0c92e6e1c2bae460708433ecacbf0c289bbaca3c0e9f9b71489596f59b

memory/1508-204-0x000000006FDB0000-0x000000006FDFC000-memory.dmp

memory/1508-205-0x000000006FF30000-0x0000000070284000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/316-222-0x0000000000400000-0x0000000002B0B000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/5012-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/932-231-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/5012-233-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/316-234-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/932-238-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/316-237-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/316-242-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/932-245-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/316-246-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/316-250-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/316-253-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/932-257-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/316-258-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/316-262-0x0000000000400000-0x0000000002B0B000-memory.dmp

memory/316-266-0x0000000000400000-0x0000000002B0B000-memory.dmp