Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
16-05-2024 04:25
Static task
static1
Behavioral task
behavioral1
Sample
05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe
Resource
win10v2004-20240508-en
General
-
Target
05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe
-
Size
4.1MB
-
MD5
9b5c65a422aecaefb9b91b91f784b6be
-
SHA1
16c39d97134485b143564bd1c768b1f6698acdbb
-
SHA256
05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062
-
SHA512
495f9ef1746ce09fb3037500c06f3ddc39f9ab8ac11c7ad1f9f76eff84a00e22b4dc6c04893751562535ec853d157445affb345a4f08024971f62cee61dd8985
-
SSDEEP
98304:Z96GAmuNBigEkoqfZTwC6uGlBZNljS4jcw:ZI9hoq9wC6uGlB/xgw
Malware Config
Signatures
-
Glupteba payload 18 IoCs
resource yara_rule behavioral2/memory/4596-2-0x0000000002E40000-0x000000000372B000-memory.dmp family_glupteba behavioral2/memory/4596-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4596-120-0x0000000002E40000-0x000000000372B000-memory.dmp family_glupteba behavioral2/memory/4596-146-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4848-192-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-200-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-213-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-217-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-221-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-225-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-229-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-233-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-237-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-241-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-245-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-249-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-253-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2640-257-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3000 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 2640 csrss.exe 2544 injector.exe 2508 windefender.exe 4824 windefender.exe -
resource yara_rule behavioral2/files/0x000200000002a9e7-203.dat upx behavioral2/memory/2508-205-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4824-208-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2508-210-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4824-215-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4824-223-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe File created C:\Windows\rss\csrss.exe 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2144 sc.exe -
pid Process 4304 powershell.exe 896 powershell.exe 2520 powershell.exe 2700 powershell.exe 1112 powershell.exe 2504 powershell.exe 1432 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4084 schtasks.exe 4704 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-411 = "E. Africa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2871 = "Magallanes Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-682 = "E. Australia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2504 powershell.exe 2504 powershell.exe 4596 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4596 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 1432 powershell.exe 1432 powershell.exe 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 4304 powershell.exe 4304 powershell.exe 896 powershell.exe 896 powershell.exe 2520 powershell.exe 2520 powershell.exe 2700 powershell.exe 2700 powershell.exe 1112 powershell.exe 1112 powershell.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2640 csrss.exe 2640 csrss.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2640 csrss.exe 2640 csrss.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2640 csrss.exe 2640 csrss.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe 2544 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 2504 powershell.exe Token: SeDebugPrivilege 4596 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Token: SeImpersonatePrivilege 4596 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe Token: SeDebugPrivilege 1432 powershell.exe Token: SeDebugPrivilege 4304 powershell.exe Token: SeDebugPrivilege 896 powershell.exe Token: SeDebugPrivilege 2520 powershell.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeDebugPrivilege 1112 powershell.exe Token: SeSystemEnvironmentPrivilege 2640 csrss.exe Token: SeSecurityPrivilege 2144 sc.exe Token: SeSecurityPrivilege 2144 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4596 wrote to memory of 2504 4596 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 78 PID 4596 wrote to memory of 2504 4596 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 78 PID 4596 wrote to memory of 2504 4596 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 78 PID 4848 wrote to memory of 1432 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 83 PID 4848 wrote to memory of 1432 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 83 PID 4848 wrote to memory of 1432 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 83 PID 4848 wrote to memory of 4824 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 111 PID 4848 wrote to memory of 4824 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 111 PID 4824 wrote to memory of 3000 4824 cmd.exe 87 PID 4824 wrote to memory of 3000 4824 cmd.exe 87 PID 4848 wrote to memory of 4304 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 88 PID 4848 wrote to memory of 4304 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 88 PID 4848 wrote to memory of 4304 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 88 PID 4848 wrote to memory of 896 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 90 PID 4848 wrote to memory of 896 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 90 PID 4848 wrote to memory of 896 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 90 PID 4848 wrote to memory of 2640 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 92 PID 4848 wrote to memory of 2640 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 92 PID 4848 wrote to memory of 2640 4848 05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe 92 PID 2640 wrote to memory of 2520 2640 csrss.exe 93 PID 2640 wrote to memory of 2520 2640 csrss.exe 93 PID 2640 wrote to memory of 2520 2640 csrss.exe 93 PID 2640 wrote to memory of 2700 2640 csrss.exe 99 PID 2640 wrote to memory of 2700 2640 csrss.exe 99 PID 2640 wrote to memory of 2700 2640 csrss.exe 99 PID 2640 wrote to memory of 1112 2640 csrss.exe 101 PID 2640 wrote to memory of 1112 2640 csrss.exe 101 PID 2640 wrote to memory of 1112 2640 csrss.exe 101 PID 2640 wrote to memory of 2544 2640 csrss.exe 103 PID 2640 wrote to memory of 2544 2640 csrss.exe 103 PID 2508 wrote to memory of 1908 2508 windefender.exe 109 PID 2508 wrote to memory of 1908 2508 windefender.exe 109 PID 2508 wrote to memory of 1908 2508 windefender.exe 109 PID 1908 wrote to memory of 2144 1908 cmd.exe 110 PID 1908 wrote to memory of 2144 1908 cmd.exe 110 PID 1908 wrote to memory of 2144 1908 cmd.exe 110 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe"C:\Users\Admin\AppData\Local\Temp\05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe"C:\Users\Admin\AppData\Local\Temp\05e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3000
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4084
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2372
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2544
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4704
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2144
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4824
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5b2864583496707d84d9f9515557aabd6
SHA1921d90f677edbfa01e41cf37fa85e638dd25f5d3
SHA2563774131c7f8db650c8e8fe3742a0f9530ca1dc5d06d2fada36f79b49dc20e0d7
SHA512db11cd5b562570ed8ad7894d03ae44ec320a7e03bc1bcbc70c5822ec2faf1b4def4c214b05aec742e89b9622a14513f1bc1a84b8b71583e40dfd4e44ad854e18
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5de827d5748159754a4792b302d65c21f
SHA1599a23b9ccbd2e8ec37d40640dfcd9b349cb0fa4
SHA256b3e5ac88a39ade7d070b51a2ab79ee6509f17e7cf65dfc471a0bdff059e41e4e
SHA5124ac3ed4e46120e29b7e48b9830e2caa56342329d89b4f21915b6569cea45771fb86d117cb426acafaada89cdfafe4cdc512d761330d6d70756f2e15c59ac76e9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5903f322d286f95418437990d0ebef794
SHA13fe3ebcc5638a9f383cea4073738fa85e9cdff17
SHA2565f7424d21281a94f51bb0d4b4bf413875f1a3afcaafe8dfce3aa8ba6f3fd4e12
SHA512dab5b970a650d3cd2436ef79ab88d19c8eea3e911d6e777ef593fda0e1ebb03985a1654b8c6091d545215e1ca404bc4947bb8985189b691a4b1e9bfe1a52d2e8
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a331c6cbbebf507dd47438da6930c60b
SHA1606754c5c0cc75e940f9b95ee15be1e3a040594f
SHA2566d6fb86480467a0facaf99f5fec370f3859d585088d9974b96fba5c8571c1e46
SHA5127c4084328dacaa17199acea9f6879581b634994313efe808e91d89ceaff218aa5724e3039137adae1514b5d5100c10c4f8fc2298590d7184feeacc34a32307a4
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5df93e42e27be24a3e5d40111d295852f
SHA120825c82b481d61fa99e7105f3b0d5d01d7947a8
SHA256847a524af94d3a360e556a91e4a3ecfb554af67e764b4095bd54fcf5446c2180
SHA51295759f89aa3502ea59e8e6798fcc8d28617d0d3f1cd065d4433acec4fc97e3198adf1a5ac1997f6b6050b25a189e5881f038b9b6e36b8044e09ac39d2b47cd33
-
Filesize
4.1MB
MD59b5c65a422aecaefb9b91b91f784b6be
SHA116c39d97134485b143564bd1c768b1f6698acdbb
SHA25605e3fc3b5bfc90cc123e56eca24f71ecaaa0831371fc8345b46e9091a7c0b062
SHA512495f9ef1746ce09fb3037500c06f3ddc39f9ab8ac11c7ad1f9f76eff84a00e22b4dc6c04893751562535ec853d157445affb345a4f08024971f62cee61dd8985
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec