Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 04:23
Static task
static1
Behavioral task
behavioral1
Sample
cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe
Resource
win10v2004-20240508-en
General
-
Target
cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe
-
Size
4.1MB
-
MD5
e9cb107d85302cd026b447dbbe321336
-
SHA1
6b6eea20cc1e8b5023d9787582b3a3b8c001f1ae
-
SHA256
cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a
-
SHA512
827e69fb2c00f7153c485835cc37af6416b68a799628795867a2b7d7cfad4762403ded4e7b5f25644b7f6d7b0f75f3b4d4312f1bf850804c18a7205fc092f5c2
-
SSDEEP
98304:p96GAmuNBigEkoqfZTwC6uGlBZNljS4jcV:pI9hoq9wC6uGlB/xgV
Malware Config
Signatures
-
Glupteba payload 19 IoCs
resource yara_rule behavioral1/memory/4820-2-0x0000000002D70000-0x000000000365B000-memory.dmp family_glupteba behavioral1/memory/4820-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/3184-56-0x0000000002D50000-0x000000000363B000-memory.dmp family_glupteba behavioral1/memory/4820-84-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4820-129-0x0000000002D70000-0x000000000365B000-memory.dmp family_glupteba behavioral1/memory/3184-134-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-214-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-225-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-227-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-230-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-234-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-237-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-239-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-242-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-246-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-249-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-251-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-254-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4836-258-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1828 netsh.exe -
Executes dropped EXE 4 IoCs
pid Process 4836 csrss.exe 2152 injector.exe 4284 windefender.exe 2480 windefender.exe -
resource yara_rule behavioral1/files/0x0008000000023571-218.dat upx behavioral1/memory/4284-220-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2480-222-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4284-224-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2480-228-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2480-233-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\rss cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe File created C:\Windows\rss\csrss.exe cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2776 sc.exe -
pid Process 376 powershell.exe 1000 powershell.exe 2772 powershell.exe 4004 powershell.exe 2500 powershell.exe 2464 powershell.exe 3588 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4004 schtasks.exe 3572 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-172 = "Central Standard Time (Mexico)" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1000 powershell.exe 1000 powershell.exe 1000 powershell.exe 4820 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 4820 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 2772 powershell.exe 2772 powershell.exe 2772 powershell.exe 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 4004 powershell.exe 4004 powershell.exe 4004 powershell.exe 2500 powershell.exe 2500 powershell.exe 2500 powershell.exe 2464 powershell.exe 2464 powershell.exe 2464 powershell.exe 3588 powershell.exe 3588 powershell.exe 3588 powershell.exe 376 powershell.exe 376 powershell.exe 376 powershell.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 4836 csrss.exe 4836 csrss.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 4836 csrss.exe 4836 csrss.exe 2152 injector.exe 2152 injector.exe 4836 csrss.exe 4836 csrss.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe 2152 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1000 powershell.exe Token: SeDebugPrivilege 4820 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Token: SeImpersonatePrivilege 4820 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe Token: SeDebugPrivilege 2772 powershell.exe Token: SeDebugPrivilege 4004 powershell.exe Token: SeDebugPrivilege 2500 powershell.exe Token: SeDebugPrivilege 2464 powershell.exe Token: SeDebugPrivilege 3588 powershell.exe Token: SeDebugPrivilege 376 powershell.exe Token: SeSystemEnvironmentPrivilege 4836 csrss.exe Token: SeSecurityPrivilege 2776 sc.exe Token: SeSecurityPrivilege 2776 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4820 wrote to memory of 1000 4820 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 94 PID 4820 wrote to memory of 1000 4820 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 94 PID 4820 wrote to memory of 1000 4820 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 94 PID 3184 wrote to memory of 2772 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 104 PID 3184 wrote to memory of 2772 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 104 PID 3184 wrote to memory of 2772 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 104 PID 3184 wrote to memory of 2748 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 107 PID 3184 wrote to memory of 2748 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 107 PID 2748 wrote to memory of 1828 2748 cmd.exe 109 PID 2748 wrote to memory of 1828 2748 cmd.exe 109 PID 3184 wrote to memory of 4004 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 110 PID 3184 wrote to memory of 4004 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 110 PID 3184 wrote to memory of 4004 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 110 PID 3184 wrote to memory of 2500 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 113 PID 3184 wrote to memory of 2500 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 113 PID 3184 wrote to memory of 2500 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 113 PID 3184 wrote to memory of 4836 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 115 PID 3184 wrote to memory of 4836 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 115 PID 3184 wrote to memory of 4836 3184 cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe 115 PID 4836 wrote to memory of 2464 4836 csrss.exe 116 PID 4836 wrote to memory of 2464 4836 csrss.exe 116 PID 4836 wrote to memory of 2464 4836 csrss.exe 116 PID 4836 wrote to memory of 3588 4836 csrss.exe 121 PID 4836 wrote to memory of 3588 4836 csrss.exe 121 PID 4836 wrote to memory of 3588 4836 csrss.exe 121 PID 4836 wrote to memory of 376 4836 csrss.exe 124 PID 4836 wrote to memory of 376 4836 csrss.exe 124 PID 4836 wrote to memory of 376 4836 csrss.exe 124 PID 4836 wrote to memory of 2152 4836 csrss.exe 126 PID 4836 wrote to memory of 2152 4836 csrss.exe 126 PID 4284 wrote to memory of 1276 4284 windefender.exe 133 PID 4284 wrote to memory of 1276 4284 windefender.exe 133 PID 4284 wrote to memory of 1276 4284 windefender.exe 133 PID 1276 wrote to memory of 2776 1276 cmd.exe 134 PID 1276 wrote to memory of 2776 1276 cmd.exe 134 PID 1276 wrote to memory of 2776 1276 cmd.exe 134 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe"C:\Users\Admin\AppData\Local\Temp\cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Users\Admin\AppData\Local\Temp\cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe"C:\Users\Admin\AppData\Local\Temp\cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2772
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1828
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2500
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4004
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3256
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2152
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3572
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4020,i,7012731823941922179,12386606396608877869,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:81⤵PID:4260
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2480
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD591e33055ab733199e9509e041f176d1a
SHA1800e5e83a49d6b9b28e6799a804cb16eefe04473
SHA256b6cf88e3a68c565568d050182cd2a318bce3dc4ecc22d570517cee7d2c4c4554
SHA5125ad116bab696b73adb53bbd95c638edb3476d458882c8b5371cc40db688f8bc7400da3a845b0a93408a01f3486cee11237f9d566f31bda34efabda833f37300e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD53ba81e23f32bd7b5d752a8368727061e
SHA1a996ce875e2a77bc9465d2309c893e79cbcd3ae8
SHA256a01086ea5b10aae0bf9aee31d817db7f78e0523b057c22acd605b969b415f62c
SHA512efa028207aa69e67fd395d1be9d283a882f1a5001006093710b7e613614fa777877d0b6cec28ef5a26d588c4c2ff08e6fa2fc229589fc74817b60bb085df682b
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5dd50c58c3d073292f002e3b8c1b765fd
SHA1ef696f8d390717ba6a43c45400206f6e384f8dc2
SHA256a5e00ea935f50793dc5c9466ccb38d4bbb930be74471a93a14999c8dc1f25bd3
SHA512d18f3f99a3e5a491e0c696c2477b67f7a836aaef67969c39db987e08358b495800f156c21d34eba43e593301eefca59d8902901c20e81af481841d6b65225f1e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD57a43d454357c3b3273f405d8ed8332c1
SHA19f3290add67f55f5c51d0e923b0dc388c3aed472
SHA25633c98744e8f6405328d6145029f51081c88f6f4cae8e4d1da634ec7dbaacbb08
SHA5125512f1d7efcc838d1d4d8f06c10652434d500af10599d55138dd1c64eaadce0d1961cfe6a3a233b0f784ffa58243f52b08994de00213a70e8462b43304d55f4e
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5d0604d919ec7cf223ed306cdd76193e0
SHA14e0da8f933f4f150d04631cf7c8d70a3536a3b8b
SHA256e72893c84ab1ae774ef5970ad9bb0c3c335b2e670e3a463502e101ae28def863
SHA512c29bfd6ff94fde79b805f10724410340900c85e148af2cfab472d5cbd24c6e67d7c3b04d00e0d137186a6b372676234e7a23facebb81603cd76251aa32678839
-
Filesize
4.1MB
MD5e9cb107d85302cd026b447dbbe321336
SHA16b6eea20cc1e8b5023d9787582b3a3b8c001f1ae
SHA256cf7cf7abeb70e253aaaf9d9e106ceb7cfdb25076836ef91dd1aed3598d9e523a
SHA512827e69fb2c00f7153c485835cc37af6416b68a799628795867a2b7d7cfad4762403ded4e7b5f25644b7f6d7b0f75f3b4d4312f1bf850804c18a7205fc092f5c2
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec