Malware Analysis Report

2024-12-08 02:05

Sample ID 240516-lt2z7aeh2w
Target f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7
SHA256 f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7

Threat Level: Known bad

The file f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Adds Run key to start application

Manipulates WinMonFS driver.

Checks installed software on the system

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Launches sc.exe

Command and Scripting Interpreter: PowerShell

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 09:50

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 09:50

Reported

2024-05-16 09:52

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-122 = "SA Pacific Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4000 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4000 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4000 wrote to memory of 2036 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 1748 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\system32\cmd.exe
PID 1676 wrote to memory of 4420 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\system32\cmd.exe
PID 4420 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4420 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1676 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 3964 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1676 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\rss\csrss.exe
PID 1676 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\rss\csrss.exe
PID 1676 wrote to memory of 2012 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\rss\csrss.exe
PID 2012 wrote to memory of 4612 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 4612 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 4612 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 3728 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 3728 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 3728 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2520 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2520 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 2520 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2012 wrote to memory of 3356 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2012 wrote to memory of 3356 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2460 wrote to memory of 2808 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2808 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2808 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2808 wrote to memory of 3700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2808 wrote to memory of 3700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2808 wrote to memory of 3700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe

"C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe

"C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 2.17.107.131:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 131.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
BE 2.17.107.131:443 www.bing.com tcp
US 8.8.8.8:53 7c952f8f-e92c-4e0d-a987-931e75b07c4c.uuid.alldatadump.org udp
US 8.8.8.8:53 stun.l.google.com udp
US 8.8.8.8:53 server14.alldatadump.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun.l.google.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server14.alldatadump.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.133.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BG 185.82.216.108:443 server14.alldatadump.org tcp
IE 52.111.236.23:443 tcp
BG 185.82.216.108:443 server14.alldatadump.org tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.108:443 server14.alldatadump.org tcp

Files

memory/4000-1-0x0000000002990000-0x0000000002D91000-memory.dmp

memory/4000-2-0x0000000002DA0000-0x000000000368B000-memory.dmp

memory/4000-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2036-4-0x000000007408E000-0x000000007408F000-memory.dmp

memory/2036-5-0x0000000004E00000-0x0000000004E36000-memory.dmp

memory/2036-6-0x00000000054C0000-0x0000000005AE8000-memory.dmp

memory/2036-7-0x0000000074080000-0x0000000074830000-memory.dmp

memory/2036-8-0x0000000074080000-0x0000000074830000-memory.dmp

memory/2036-9-0x0000000005430000-0x0000000005452000-memory.dmp

memory/2036-10-0x0000000005D20000-0x0000000005D86000-memory.dmp

memory/2036-11-0x0000000005D90000-0x0000000005DF6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jqe1t24j.ju4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2036-21-0x0000000005E00000-0x0000000006154000-memory.dmp

memory/2036-22-0x00000000063E0000-0x00000000063FE000-memory.dmp

memory/2036-23-0x0000000006400000-0x000000000644C000-memory.dmp

memory/2036-24-0x0000000006980000-0x00000000069C4000-memory.dmp

memory/2036-25-0x0000000007520000-0x0000000007596000-memory.dmp

memory/2036-26-0x0000000007C20000-0x000000000829A000-memory.dmp

memory/2036-27-0x00000000075A0000-0x00000000075BA000-memory.dmp

memory/2036-28-0x0000000074080000-0x0000000074830000-memory.dmp

memory/2036-31-0x00000000706A0000-0x00000000709F4000-memory.dmp

memory/2036-30-0x000000006FF20000-0x000000006FF6C000-memory.dmp

memory/2036-41-0x0000000007990000-0x00000000079AE000-memory.dmp

memory/2036-42-0x00000000079B0000-0x0000000007A53000-memory.dmp

memory/2036-29-0x0000000007950000-0x0000000007982000-memory.dmp

memory/2036-43-0x0000000074080000-0x0000000074830000-memory.dmp

memory/2036-44-0x0000000007AA0000-0x0000000007AAA000-memory.dmp

memory/2036-45-0x0000000007B70000-0x0000000007C06000-memory.dmp

memory/2036-46-0x0000000007AD0000-0x0000000007AE1000-memory.dmp

memory/2036-47-0x0000000007B10000-0x0000000007B1E000-memory.dmp

memory/2036-48-0x0000000007B20000-0x0000000007B34000-memory.dmp

memory/2036-49-0x00000000082A0000-0x00000000082BA000-memory.dmp

memory/2036-50-0x0000000007B50000-0x0000000007B58000-memory.dmp

memory/2036-53-0x0000000074080000-0x0000000074830000-memory.dmp

memory/4000-55-0x0000000002DA0000-0x000000000368B000-memory.dmp

memory/4000-54-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1676-57-0x0000000002930000-0x0000000002D32000-memory.dmp

memory/1676-58-0x0000000002D40000-0x000000000362B000-memory.dmp

memory/1748-68-0x00000000054F0000-0x0000000005844000-memory.dmp

memory/1748-69-0x0000000005B90000-0x0000000005BDC000-memory.dmp

memory/1748-70-0x0000000070020000-0x000000007006C000-memory.dmp

memory/1748-71-0x00000000701E0000-0x0000000070534000-memory.dmp

memory/1748-81-0x0000000006D40000-0x0000000006DE3000-memory.dmp

memory/1748-82-0x0000000007050000-0x0000000007061000-memory.dmp

memory/1748-83-0x00000000070A0000-0x00000000070B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/3964-92-0x0000000005D80000-0x00000000060D4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4769fbc33c333bde11c117be8ade3072
SHA1 27bc4b0b847b8850ea7686a079a570bf32323fe5
SHA256 0a1b8b9be94e5877a32255057d5c8082fc604e33beebc3e57f4fe8fb233c76e9
SHA512 48f1a0e59244c5e78e6c35537a3f7d6aa62a66a6300a9cd1727254bb9fb961bf0adf36afb49173e3083abcd12750400fe5b8d2783f220ddd1df82de9db4b387d

memory/3964-98-0x0000000070020000-0x000000007006C000-memory.dmp

memory/3964-99-0x00000000707C0000-0x0000000070B14000-memory.dmp

memory/668-119-0x0000000005920000-0x0000000005C74000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 17889edc3145e60a7bbf770cc4ee232e
SHA1 55c433f01ddc8ed1c2f882c8290a52b9c2767bb0
SHA256 f438c5f9739ae7ff36fbd2fb429ed8307f079823ed7fa19acbc72f7c1d45b48b
SHA512 9ee5d8c96280b1fc9307faece2524722819bc4d6ec0113084a96d492e96700aeecafaaf4c147fa11a32d74c4f7450a1ccdd6676948a3e266c4078d2a85ea449d

memory/668-121-0x0000000070020000-0x000000007006C000-memory.dmp

memory/668-122-0x00000000701A0000-0x00000000704F4000-memory.dmp

memory/1676-136-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 fb9cf7d877427716649a6c00c39b4e03
SHA1 1a8bc5e39e9160e0549bd4481a274c98f3d3feef
SHA256 f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7
SHA512 2cb21c3ba7cb9ae84e21db719b5054e43d3fe264922fdddbc095e1f6f4a809aab504b1e2837b93150cd3bdd545355fb090031ab43b2ee6b8ac27792594053ae4

memory/4612-148-0x0000000005720000-0x0000000005A74000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4a3098407976a18eb90c7c281b27bc00
SHA1 e159bfa8857100bd35fc2b77f77204f6678ea52d
SHA256 70fb053092c5a4540abf4f9e384c98c6d04869c069f2d5b37715a1599c890a75
SHA512 bc17e1eaca9734773ca6f1fe7c10690dc6559de031a2c74dbf7b1a400619373e843550f644117af7280aaaa3d3d18addb30dac8b86dbea8ed65efd8cc9f1e61a

memory/4612-150-0x0000000005F90000-0x0000000005FDC000-memory.dmp

memory/4612-162-0x0000000006E60000-0x0000000006F03000-memory.dmp

memory/4612-152-0x0000000070100000-0x0000000070454000-memory.dmp

memory/4612-151-0x000000006FF80000-0x000000006FFCC000-memory.dmp

memory/4612-163-0x00000000071B0000-0x00000000071C1000-memory.dmp

memory/4612-164-0x0000000004E50000-0x0000000004E64000-memory.dmp

memory/3728-171-0x0000000005660000-0x00000000059B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 76fb868c89f0ae6d27f700d0d8b660b9
SHA1 1166fad784597dbff41f4071f33d6b0f8cdce3d8
SHA256 0390d8a099384de350b4d6018e622e9de399cd82d742be79a5bfda3f5413e8bd
SHA512 944475bb45990a6bb4e6d93baa9582b04565480bdcd2f1ff096c3ae4f12c728fab111e4da9ec308eeebbcbba45c4e09b73daa22b8793dc645eb5c6458f72d30e

memory/3728-177-0x0000000006020000-0x000000000606C000-memory.dmp

memory/3728-178-0x000000006FEA0000-0x000000006FEEC000-memory.dmp

memory/3728-179-0x0000000070630000-0x0000000070984000-memory.dmp

memory/3728-189-0x0000000006F70000-0x0000000007013000-memory.dmp

memory/3728-190-0x0000000007350000-0x0000000007361000-memory.dmp

memory/3728-191-0x0000000005B40000-0x0000000005B54000-memory.dmp

memory/2520-202-0x00000000063C0000-0x0000000006714000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 83814e26fa923a9b7252924c8530eeff
SHA1 3d8df1d963cfb096c7d768047eb6998379056fd5
SHA256 4bf8264260efdd8a671e259a7c298a259c0b22d8a075e6bab3ae2be0c94fedb5
SHA512 c234c7333bd6912a0e4ad442a33115e43710a6c6e3bf198db43a590b0a0440907968d15e1e2dbeb87a28f08655db3b79d24d8b1286113b975b596f651f0ce8ee

memory/2520-204-0x000000006FEA0000-0x000000006FEEC000-memory.dmp

memory/2520-205-0x0000000070020000-0x0000000070374000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2012-221-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2460-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2460-229-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4124-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2012-230-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4124-232-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2012-231-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2012-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4124-235-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2012-236-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2012-238-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2012-239-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2012-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2012-244-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2012-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2012-247-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2012-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2012-252-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 09:50

Reported

2024-05-16 09:53

Platform

win11-20240419-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-132 = "US Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-332 = "E. Europe Standard Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3396 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3396 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3396 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\system32\cmd.exe
PID 1156 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\system32\cmd.exe
PID 3892 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3892 wrote to memory of 2020 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1156 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1156 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\rss\csrss.exe
PID 1156 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\rss\csrss.exe
PID 1156 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe C:\Windows\rss\csrss.exe
PID 3024 wrote to memory of 872 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3024 wrote to memory of 872 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3024 wrote to memory of 872 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3024 wrote to memory of 1536 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3024 wrote to memory of 1536 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3024 wrote to memory of 1536 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3024 wrote to memory of 1272 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3024 wrote to memory of 1272 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3024 wrote to memory of 1272 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3024 wrote to memory of 2656 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3024 wrote to memory of 2656 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4904 wrote to memory of 2912 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4904 wrote to memory of 2912 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4904 wrote to memory of 2912 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2912 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2912 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2912 wrote to memory of 1692 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe

"C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe

"C:\Users\Admin\AppData\Local\Temp\f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 2fcc3e63-70e4-4a31-966f-8180f96075b4.uuid.alldatadump.org udp
US 8.8.8.8:53 server10.alldatadump.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
N/A 127.0.0.1:3478 udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server10.alldatadump.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
BG 185.82.216.108:443 server10.alldatadump.org tcp
US 74.125.250.129:19302 stun4.l.google.com udp
BG 185.82.216.108:443 server10.alldatadump.org tcp

Files

memory/3396-1-0x0000000002A20000-0x0000000002E25000-memory.dmp

memory/3396-2-0x0000000002E30000-0x000000000371B000-memory.dmp

memory/3396-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4280-4-0x00000000746DE000-0x00000000746DF000-memory.dmp

memory/4280-5-0x0000000005350000-0x0000000005386000-memory.dmp

memory/4280-6-0x0000000005A50000-0x000000000607A000-memory.dmp

memory/4280-7-0x00000000746D0000-0x0000000074E81000-memory.dmp

memory/4280-8-0x0000000005940000-0x0000000005962000-memory.dmp

memory/4280-11-0x00000000062A0000-0x0000000006306000-memory.dmp

memory/4280-10-0x0000000006230000-0x0000000006296000-memory.dmp

memory/4280-9-0x00000000746D0000-0x0000000074E81000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qszedpc4.5qs.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4280-20-0x0000000006310000-0x0000000006667000-memory.dmp

memory/4280-21-0x00000000067F0000-0x000000000680E000-memory.dmp

memory/4280-22-0x0000000006890000-0x00000000068DC000-memory.dmp

memory/4280-23-0x0000000006D70000-0x0000000006DB6000-memory.dmp

memory/4280-24-0x0000000007C00000-0x0000000007C34000-memory.dmp

memory/4280-26-0x0000000070B50000-0x0000000070EA7000-memory.dmp

memory/4280-25-0x0000000070940000-0x000000007098C000-memory.dmp

memory/4280-37-0x0000000007C80000-0x0000000007D24000-memory.dmp

memory/4280-36-0x00000000746D0000-0x0000000074E81000-memory.dmp

memory/4280-38-0x00000000746D0000-0x0000000074E81000-memory.dmp

memory/4280-35-0x0000000007C60000-0x0000000007C7E000-memory.dmp

memory/4280-40-0x0000000007DA0000-0x0000000007DBA000-memory.dmp

memory/4280-39-0x00000000083F0000-0x0000000008A6A000-memory.dmp

memory/4280-41-0x0000000007DE0000-0x0000000007DEA000-memory.dmp

memory/4280-42-0x0000000007EF0000-0x0000000007F86000-memory.dmp

memory/4280-43-0x0000000007E20000-0x0000000007E31000-memory.dmp

memory/4280-44-0x0000000007E50000-0x0000000007E5E000-memory.dmp

memory/4280-45-0x0000000007E60000-0x0000000007E75000-memory.dmp

memory/4280-46-0x0000000007EB0000-0x0000000007ECA000-memory.dmp

memory/4280-47-0x0000000007ED0000-0x0000000007ED8000-memory.dmp

memory/4280-50-0x00000000746D0000-0x0000000074E81000-memory.dmp

memory/3396-52-0x0000000002A20000-0x0000000002E25000-memory.dmp

memory/1156-53-0x0000000002A20000-0x0000000002E27000-memory.dmp

memory/1064-62-0x00000000063E0000-0x0000000006737000-memory.dmp

memory/1064-63-0x0000000070940000-0x000000007098C000-memory.dmp

memory/1064-64-0x0000000070AE0000-0x0000000070E37000-memory.dmp

memory/1064-73-0x0000000007AD0000-0x0000000007B74000-memory.dmp

memory/1064-74-0x0000000007DF0000-0x0000000007E01000-memory.dmp

memory/3396-75-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3396-76-0x0000000002E30000-0x000000000371B000-memory.dmp

memory/1064-77-0x0000000007E40000-0x0000000007E55000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/3580-89-0x0000000005A50000-0x0000000005DA7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9f1cb491e7a3bdef8b82398d99f7a5cd
SHA1 cdb877d12ca255b48163404fbbb85d15fd729c62
SHA256 c1d5fdeae63a5af4b5fcb83931af7e22e53d77c6a31764aa5e4cfa4f5c735ff3
SHA512 9ce47437a15c93b7463a7c6f2abe376225007c4a3c7218770dc33565034d35ee958d2e89c1e5160a773de4e8daf280f9c2632faf38ce84f9af5a3e853253f131

memory/3580-91-0x0000000070940000-0x000000007098C000-memory.dmp

memory/3580-92-0x0000000070AC0000-0x0000000070E17000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3226f1970c5aa2867668b88a9cee76a8
SHA1 60a4d69501f410bdf0cf9ac91245d3bec538f901
SHA256 72b0a410a5ed2d6a26416c18878ef9f4a9c35d71c518e75b8f84d7a553740788
SHA512 fe5ebeef2cb57643cb83ad76bad7bd257d7d602045657d78a96f1aca20c0da4e87dd34c77ea62d9ebb7db2b714e1d94f9b3ccede904a6013ee19fe18f6a557ec

memory/2000-111-0x0000000070940000-0x000000007098C000-memory.dmp

memory/2000-112-0x0000000070B50000-0x0000000070EA7000-memory.dmp

memory/1156-122-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 fb9cf7d877427716649a6c00c39b4e03
SHA1 1a8bc5e39e9160e0549bd4481a274c98f3d3feef
SHA256 f435ce76640a6820de2cb8ce2af78f7f30b51f342e7157a6b0a9814e390f34b7
SHA512 2cb21c3ba7cb9ae84e21db719b5054e43d3fe264922fdddbc095e1f6f4a809aab504b1e2837b93150cd3bdd545355fb090031ab43b2ee6b8ac27792594053ae4

memory/872-137-0x0000000005B90000-0x0000000005EE7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 abf81427b0f95d62f599a27c70645e26
SHA1 c087fed670e308b08f81f9ba74bc3529e90c96dc
SHA256 f8aef374233867024936143336bd0aa3e2fb078ff2ae630192d69ee6500e1afe
SHA512 4f47e2d4c2945dad6de7949d0fd92d98ba7e6e88ee769f68b29c8bad804889b0347d35cba51ab2c2ef8339b98ff6d5a63c816c46e5cb8b01d4d6bd510760181c

memory/872-139-0x0000000070940000-0x000000007098C000-memory.dmp

memory/872-140-0x0000000070B70000-0x0000000070EC7000-memory.dmp

memory/1536-158-0x00000000064C0000-0x0000000006817000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5ee0919780357d4556fd56085389734d
SHA1 4583daaabdd51b996619d8376ac616ed79ef70df
SHA256 33377aa79c467fbf7fb6ec31e34c94511225e88b6dfb64c5a69c34ffc28cb0b1
SHA512 ed7edf545f58b14d6f12de36223fab9cc4515984d7e697a3ebc9253778a3fb18499a58b1296957989933fc4361c58875e955e2163b425387340b5142420841a8

memory/1536-160-0x0000000006A00000-0x0000000006A4C000-memory.dmp

memory/1536-161-0x0000000070860000-0x00000000708AC000-memory.dmp

memory/1536-162-0x00000000709E0000-0x0000000070D37000-memory.dmp

memory/1536-171-0x0000000007C40000-0x0000000007CE4000-memory.dmp

memory/1536-172-0x0000000007F90000-0x0000000007FA1000-memory.dmp

memory/1536-173-0x0000000006480000-0x0000000006495000-memory.dmp

memory/1272-183-0x0000000006290000-0x00000000065E7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 188f9a915121d635b6db425de20c7a0e
SHA1 d9a5f1e683e7430a5c6f70e278183357fc595141
SHA256 c3a95dcd44dd122c5fc731de8562da250242e90294b8aa4bc4fcd17e2656a6fe
SHA512 30c9bd70c472dd242a1f925f2a1945b438ea6836b3fb711fc331996a8deec83ffa43b2f0f6dab1551b69d8beab88623457b4f17d1a5d3444937d6cd7e517aee6

memory/1272-186-0x0000000070A00000-0x0000000070D57000-memory.dmp

memory/1272-185-0x0000000070860000-0x00000000708AC000-memory.dmp

memory/1156-196-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3024-203-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1156-204-0x0000000002A20000-0x0000000002E27000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4904-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4304-213-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4904-215-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3024-216-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4304-220-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3024-219-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3024-223-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4304-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3024-227-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3024-231-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3024-236-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3024-239-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3024-243-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3024-247-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3024-252-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3024-255-0x0000000000400000-0x0000000000D1C000-memory.dmp