Malware Analysis Report

2025-01-02 06:26

Sample ID 240516-e1b9sacb67
Target 531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f
SHA256 531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f

Threat Level: Known bad

The file 531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Adds Run key to start application

Manipulates WinMonFS driver.

Checks installed software on the system

Drops file in System32 directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Modifies data under HKEY_USERS

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 04:24

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 04:24

Reported

2024-05-16 04:26

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4168 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4168 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4168 wrote to memory of 4580 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\system32\cmd.exe
PID 4484 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\system32\cmd.exe
PID 2492 wrote to memory of 832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2492 wrote to memory of 832 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4484 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 2880 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4484 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\rss\csrss.exe
PID 4484 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\rss\csrss.exe
PID 4484 wrote to memory of 1216 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\rss\csrss.exe
PID 1216 wrote to memory of 1244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 1244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 1244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 2400 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 2400 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 2400 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 3128 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 3128 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 3128 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1216 wrote to memory of 4292 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1216 wrote to memory of 4292 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2268 wrote to memory of 2504 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2268 wrote to memory of 2504 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2268 wrote to memory of 2504 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2504 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2504 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2504 wrote to memory of 4824 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe

"C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe

"C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 88.221.83.234:443 www.bing.com tcp
US 8.8.8.8:53 234.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BE 88.221.83.234:443 www.bing.com tcp
US 8.8.8.8:53 ae2bd5b5-a2ef-4a92-8165-5da180ad58f1.uuid.databaseupgrade.ru udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 stun.stunprotocol.org udp
US 8.8.8.8:53 server1.databaseupgrade.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server1.databaseupgrade.ru tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 21.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
N/A 127.0.0.1:3478 udp
BG 185.82.216.108:443 server1.databaseupgrade.ru tcp
N/A 127.0.0.1:3478 udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 stun1.l.google.com udp
US 74.125.250.129:19302 stun1.l.google.com udp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.108:443 server1.databaseupgrade.ru tcp
US 8.8.8.8:53 11.73.50.20.in-addr.arpa udp

Files

memory/4168-1-0x0000000002A10000-0x0000000002E0B000-memory.dmp

memory/4168-2-0x0000000002E10000-0x00000000036FB000-memory.dmp

memory/4168-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4580-4-0x00000000747DE000-0x00000000747DF000-memory.dmp

memory/4580-5-0x0000000005010000-0x0000000005046000-memory.dmp

memory/4580-7-0x00000000057A0000-0x0000000005DC8000-memory.dmp

memory/4580-6-0x00000000747D0000-0x0000000074F80000-memory.dmp

memory/4580-8-0x00000000747D0000-0x0000000074F80000-memory.dmp

memory/4580-9-0x0000000005640000-0x0000000005662000-memory.dmp

memory/4580-10-0x0000000005F40000-0x0000000005FA6000-memory.dmp

memory/4580-11-0x0000000005FB0000-0x0000000006016000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ho0fgv5f.sqd.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4580-21-0x0000000006120000-0x0000000006474000-memory.dmp

memory/4580-23-0x0000000006620000-0x000000000666C000-memory.dmp

memory/4580-22-0x00000000065E0000-0x00000000065FE000-memory.dmp

memory/4580-24-0x0000000006B70000-0x0000000006BB4000-memory.dmp

memory/4580-25-0x0000000007700000-0x0000000007776000-memory.dmp

memory/4580-26-0x0000000007E00000-0x000000000847A000-memory.dmp

memory/4580-27-0x00000000077B0000-0x00000000077CA000-memory.dmp

memory/4580-30-0x00000000707F0000-0x0000000070B44000-memory.dmp

memory/4580-42-0x0000000007BD0000-0x0000000007C73000-memory.dmp

memory/4580-41-0x00000000747D0000-0x0000000074F80000-memory.dmp

memory/4580-40-0x0000000007BB0000-0x0000000007BCE000-memory.dmp

memory/4580-29-0x0000000070670000-0x00000000706BC000-memory.dmp

memory/4580-43-0x0000000007CC0000-0x0000000007CCA000-memory.dmp

memory/4580-28-0x0000000007B70000-0x0000000007BA2000-memory.dmp

memory/4580-44-0x00000000747D0000-0x0000000074F80000-memory.dmp

memory/4580-45-0x0000000008480000-0x0000000008516000-memory.dmp

memory/4580-46-0x00000000747D0000-0x0000000074F80000-memory.dmp

memory/4580-47-0x0000000007CE0000-0x0000000007CF1000-memory.dmp

memory/4580-48-0x0000000007D20000-0x0000000007D2E000-memory.dmp

memory/4580-49-0x0000000007D30000-0x0000000007D44000-memory.dmp

memory/4580-50-0x0000000007D80000-0x0000000007D9A000-memory.dmp

memory/4580-51-0x0000000007D70000-0x0000000007D78000-memory.dmp

memory/4580-54-0x00000000747D0000-0x0000000074F80000-memory.dmp

memory/4484-56-0x00000000029A0000-0x0000000002DA6000-memory.dmp

memory/4168-57-0x0000000002A10000-0x0000000002E0B000-memory.dmp

memory/4484-58-0x0000000002DB0000-0x000000000369B000-memory.dmp

memory/4092-59-0x0000000005CE0000-0x0000000006034000-memory.dmp

memory/4092-69-0x0000000070670000-0x00000000706BC000-memory.dmp

memory/4092-70-0x0000000070DF0000-0x0000000071144000-memory.dmp

memory/4092-80-0x0000000007500000-0x00000000075A3000-memory.dmp

memory/4168-81-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4168-82-0x0000000002E10000-0x00000000036FB000-memory.dmp

memory/4092-83-0x0000000007830000-0x0000000007841000-memory.dmp

memory/4092-84-0x00000000078A0000-0x00000000078B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 58742d0d327acb39d53409dd300ec576
SHA1 315170ea43fed8629864b4b8c7874d76f06e94d5
SHA256 fcab4d992a11e3beff7819d8adddb6449c22fac6a0703593299660510ef86a45
SHA512 71216dcfd3aba16bdd6fbd1aefd4cf8d5a730cde70af0b1fbea001ee265c24f3d35027139c671f53d1cfb28a48e7905a09510a1ca02885c4ced579d0656c881b

memory/4932-99-0x0000000070DF0000-0x0000000071144000-memory.dmp

memory/4932-98-0x0000000070670000-0x00000000706BC000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0b352beb83e8da957a0f545846821a15
SHA1 a2340faa9168dea07ec380fcc5e2eb5d8144ed60
SHA256 b48b862090de79f631a963f6fb0298641d552f1495579333b6350a60df2c5d6c
SHA512 6745a06f4a331d39d21cea681bf12b5ce2c96c382acabd25417340128e05c7d61e90d95fea2bc2fcbbcb7c7bc57d424d47091f4d93770433af41eeeffc85be05

memory/2880-120-0x0000000070670000-0x00000000706BC000-memory.dmp

memory/2880-121-0x0000000070DF0000-0x0000000071144000-memory.dmp

memory/4484-131-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 ba49a793688f2bda96b759608bb621e6
SHA1 1ede6cf35f51391e0ada19ab1476194008b91fd3
SHA256 531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f
SHA512 37dd616cad979b6388ff6a26857bf5e044c4f861a203972090cb9d3df8ee509848b01f4d018d43a2a896ff7ad47b5e31ca3ef4577f98edb9388a176469850455

memory/4484-136-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1244-148-0x0000000005F40000-0x0000000006294000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d300f7d1d095fb9a3a7fa7fc4c1d98c0
SHA1 00dab8c8cc32ed700b288b8f8ccb9c64b490cfd1
SHA256 79c972a0679fcbd6e32270cbd0af6a7387dd808ec5e5ad40b2ccf156cee3e85c
SHA512 2e80d9cd166480eaf5058018527cee8c50c6e579c0972a2d0bdb2c12ebcf0522fb8dcd347e1e15f304a6da5e3a3360a5bd54628bae49325e6fbbe93a5fa788d2

memory/1244-150-0x0000000070670000-0x00000000706BC000-memory.dmp

memory/1244-151-0x0000000070E20000-0x0000000071174000-memory.dmp

memory/2400-172-0x0000000006260000-0x00000000065B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 084398b582ef542ad6a465f3a9e18331
SHA1 18f8284f4f32a6a8214c8a19d4a9de142cbbe172
SHA256 c60303a859d38ebd8d2fb85762b2e4efa74b82d3c64da0850019b8850314173a
SHA512 a94354661021cc600c3a0c672cfc2f6dc070ef66cfefd7f330bc9d5b7ab5a927f893b127dfc8959993f1876104be9cf2695a0f14e78fe055f72acee2fbd791fb

memory/2400-174-0x0000000006850000-0x000000000689C000-memory.dmp

memory/2400-175-0x0000000070590000-0x00000000705DC000-memory.dmp

memory/2400-176-0x0000000070710000-0x0000000070A64000-memory.dmp

memory/2400-186-0x0000000007A30000-0x0000000007AD3000-memory.dmp

memory/2400-187-0x00000000065C0000-0x00000000065D1000-memory.dmp

memory/2400-188-0x0000000006610000-0x0000000006624000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1216-197-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2268-202-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2256-204-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2268-206-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1216-208-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1216-210-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2256-211-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1216-212-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2256-216-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1216-215-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1216-218-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1216-222-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1216-225-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1216-227-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1216-230-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1216-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1216-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1216-239-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 04:24

Reported

2024-05-16 04:26

Platform

win11-20240508-en

Max time kernel

149s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1408 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1408 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1408 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3428 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3428 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3428 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3428 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\system32\cmd.exe
PID 3428 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\system32\cmd.exe
PID 5024 wrote to memory of 4352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5024 wrote to memory of 4352 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3428 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3428 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3428 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3428 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3428 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3428 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3428 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\rss\csrss.exe
PID 3428 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\rss\csrss.exe
PID 3428 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe C:\Windows\rss\csrss.exe
PID 1556 wrote to memory of 3116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1556 wrote to memory of 3116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1556 wrote to memory of 3116 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1556 wrote to memory of 4848 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1556 wrote to memory of 4848 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1556 wrote to memory of 4848 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1556 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1556 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1556 wrote to memory of 3784 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1556 wrote to memory of 1904 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1556 wrote to memory of 1904 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1488 wrote to memory of 2256 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1488 wrote to memory of 2256 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1488 wrote to memory of 2256 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2256 wrote to memory of 3172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2256 wrote to memory of 3172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2256 wrote to memory of 3172 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe

"C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe

"C:\Users\Admin\AppData\Local\Temp\531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 da818adb-ee32-4e14-8f9f-a21d8485c0c2.uuid.databaseupgrade.ru udp
US 8.8.8.8:53 server1.databaseupgrade.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun2.l.google.com udp
BG 185.82.216.108:443 server1.databaseupgrade.ru tcp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server1.databaseupgrade.ru tcp
BG 185.82.216.108:443 server1.databaseupgrade.ru tcp
IE 52.111.236.22:443 tcp

Files

memory/1408-1-0x0000000002A50000-0x0000000002E58000-memory.dmp

memory/1408-2-0x0000000002E60000-0x000000000374B000-memory.dmp

memory/1408-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1800-4-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

memory/1800-5-0x0000000004E60000-0x0000000004E96000-memory.dmp

memory/1800-6-0x0000000074D80000-0x0000000075531000-memory.dmp

memory/1800-7-0x0000000005690000-0x0000000005CBA000-memory.dmp

memory/1800-8-0x0000000005560000-0x0000000005582000-memory.dmp

memory/1800-9-0x0000000005D30000-0x0000000005D96000-memory.dmp

memory/1800-10-0x0000000005DA0000-0x0000000005E06000-memory.dmp

memory/1800-11-0x0000000005E10000-0x0000000006167000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lskmtyhi.vsi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1800-20-0x0000000006300000-0x000000000631E000-memory.dmp

memory/1800-21-0x00000000063A0000-0x00000000063EC000-memory.dmp

memory/1800-22-0x00000000068A0000-0x00000000068E6000-memory.dmp

memory/1800-24-0x0000000070FF0000-0x000000007103C000-memory.dmp

memory/1800-23-0x0000000007710000-0x0000000007744000-memory.dmp

memory/1800-25-0x0000000074D80000-0x0000000075531000-memory.dmp

memory/1800-35-0x0000000007770000-0x000000000778E000-memory.dmp

memory/1800-36-0x0000000007790000-0x0000000007834000-memory.dmp

memory/1800-26-0x0000000071240000-0x0000000071597000-memory.dmp

memory/1800-37-0x0000000074D80000-0x0000000075531000-memory.dmp

memory/1800-39-0x00000000078C0000-0x00000000078DA000-memory.dmp

memory/1800-38-0x0000000007F00000-0x000000000857A000-memory.dmp

memory/1800-40-0x0000000007900000-0x000000000790A000-memory.dmp

memory/1800-41-0x00000000079C0000-0x0000000007A56000-memory.dmp

memory/1800-42-0x0000000007930000-0x0000000007941000-memory.dmp

memory/1800-43-0x0000000007970000-0x000000000797E000-memory.dmp

memory/1800-44-0x0000000007980000-0x0000000007995000-memory.dmp

memory/1800-45-0x0000000007A80000-0x0000000007A9A000-memory.dmp

memory/1800-46-0x0000000007A60000-0x0000000007A68000-memory.dmp

memory/1800-49-0x0000000074D80000-0x0000000075531000-memory.dmp

memory/3428-51-0x0000000002A70000-0x0000000002E74000-memory.dmp

memory/3068-60-0x00000000064C0000-0x0000000006817000-memory.dmp

memory/3068-61-0x0000000070FF0000-0x000000007103C000-memory.dmp

memory/3068-62-0x0000000071170000-0x00000000714C7000-memory.dmp

memory/3068-71-0x0000000007920000-0x00000000079C4000-memory.dmp

memory/3068-72-0x0000000007E50000-0x0000000007E61000-memory.dmp

memory/3068-73-0x0000000007EA0000-0x0000000007EB5000-memory.dmp

memory/1408-75-0x0000000002A50000-0x0000000002E58000-memory.dmp

memory/1408-76-0x0000000002E60000-0x000000000374B000-memory.dmp

memory/1408-74-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 508f5b3d6436e16260f601a5a84ef927
SHA1 41836b9bc06c5cb9a7b8da33fad8e0af25af12ee
SHA256 3c79ec166eb6fe127a6c15ddb34a8462cd395384313ff0b06321bc4d5815ba93
SHA512 f0e28ec4371e65062cde8105b4935c24fcafdf3e6c4271898c2a655bbcbe21be598d61131f67ca1bffd89458965893ea8f3f9510b8f68be9193996ad197d0e47

memory/4056-89-0x0000000070FF0000-0x000000007103C000-memory.dmp

memory/4056-90-0x0000000071170000-0x00000000714C7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c93b2bf9c2349fa0d563547a8856a7e1
SHA1 8c3571f82c3b1aee01faefeb6c70fddddc0fff44
SHA256 ee905c8fdbf1b87059975f322bb00540b5a551d9d115c42d637e7f3674745bc1
SHA512 e11893ae61232c5032a7d32e910a3658ce3f27b05937fec5b9afeab7934ba293a1ba669974a7116db2fcbcb70b47a4041f2e57f1d4e628b57d926074c68a6b8f

memory/4676-109-0x0000000070FF0000-0x000000007103C000-memory.dmp

memory/4676-110-0x0000000071240000-0x0000000071597000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 ba49a793688f2bda96b759608bb621e6
SHA1 1ede6cf35f51391e0ada19ab1476194008b91fd3
SHA256 531922390b051ccefe8e7594c491ee301770ac2c3802dda2478b8ea0a5b1ac2f
SHA512 37dd616cad979b6388ff6a26857bf5e044c4f861a203972090cb9d3df8ee509848b01f4d018d43a2a896ff7ad47b5e31ca3ef4577f98edb9388a176469850455

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3d89493b0d0960147991684a4bf91cc6
SHA1 b2a959c82d7ac0cd2bb7fc5ae43e503b222730a4
SHA256 647da5f690ab5bf97928ad86932258a47e57b6eb324c7a48b8eb83be6b10170b
SHA512 804dc4969fa4a9336421c35f7d81ca49074977fc5e5b957d1c2f99e55ae1fe629e8e65af71e41328dfa7be40d47db2e9c6712eaa551a7b597faad2d3f6ba4934

memory/3428-134-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3116-135-0x0000000070FF0000-0x000000007103C000-memory.dmp

memory/3116-136-0x0000000071240000-0x0000000071597000-memory.dmp

memory/4848-154-0x0000000005F80000-0x00000000062D7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2dc8f4a9c53ea6c0ed37fa3a5a7d0af6
SHA1 9a84fa90a726a647d3cb2edfcb1b8e02505a535e
SHA256 e164baa29adf32f2e63ec5509206150fc1c1ed5601ea127f11aa4fcc83c05312
SHA512 a9e7a51c25d4f30d79c9aae656fd04112ca0dc6340bac6ef21aa52c53ee4b09446905fcf5c85002ff14eb959013e7ae7f6d5319f6178d07c42be8846d681b36d

memory/4848-157-0x00000000064D0000-0x000000000651C000-memory.dmp

memory/4848-158-0x0000000070F10000-0x0000000070F5C000-memory.dmp

memory/4848-159-0x0000000071090000-0x00000000713E7000-memory.dmp

memory/4848-168-0x0000000007700000-0x00000000077A4000-memory.dmp

memory/4848-169-0x00000000062E0000-0x00000000062F1000-memory.dmp

memory/4848-170-0x0000000006320000-0x0000000006335000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 104de14e1bac3310b3062ffc73563420
SHA1 55087158c0b3f0479ab86cc59370e166e29e2828
SHA256 1586a8ab6d92818a0299a22de552261abdc16c662b9c11ed209a7e0c314c1836
SHA512 4174d76e77079d6fc876c971d1982099c1de8136251c284196cc095a9ea47ba4f59c05ac965b3dc906e4957fcbbfd39d51d3ab8210ee27a7336532df2cc985ce

memory/3784-181-0x0000000070F10000-0x0000000070F5C000-memory.dmp

memory/3784-182-0x0000000071090000-0x00000000713E7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1556-198-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3428-200-0x0000000002A70000-0x0000000002E74000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1488-204-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1488-208-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1556-210-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1556-213-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3836-214-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1556-217-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3836-221-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1556-223-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1556-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1556-229-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1556-235-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1556-239-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1556-242-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1556-245-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1556-251-0x0000000000400000-0x0000000000D1C000-memory.dmp