Malware Analysis Report

2025-01-02 06:28

Sample ID 240516-lwacysfd35
Target 09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5
SHA256 09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5

Threat Level: Known bad

The file 09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Adds Run key to start application

Checks installed software on the system

Manipulates WinMonFS driver.

Drops file in System32 directory

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Command and Scripting Interpreter: PowerShell

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 09:52

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 09:52

Reported

2024-05-16 09:55

Platform

win11-20240508-en

Max time kernel

150s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3152 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3152 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3152 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 896 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 896 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 896 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 896 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\system32\cmd.exe
PID 896 wrote to memory of 2320 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\system32\cmd.exe
PID 2320 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2320 wrote to memory of 2648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 896 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 896 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 896 wrote to memory of 684 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 896 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 896 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 896 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 896 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\rss\csrss.exe
PID 896 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\rss\csrss.exe
PID 896 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\rss\csrss.exe
PID 4640 wrote to memory of 4252 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 4252 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 4252 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 3772 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 3772 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 3772 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 2908 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 2908 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 2908 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4640 wrote to memory of 8 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4640 wrote to memory of 8 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3296 wrote to memory of 2000 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3296 wrote to memory of 2000 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3296 wrote to memory of 2000 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2000 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2000 wrote to memory of 2704 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe

"C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe

"C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 1f11b4f9-ecb2-4771-85ef-826a665841cb.uuid.datadumpcloud.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server1.datadumpcloud.org udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun4.l.google.com udp
BG 185.82.216.104:443 server1.datadumpcloud.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.104:443 server1.datadumpcloud.org tcp
BG 185.82.216.104:443 server1.datadumpcloud.org tcp
BG 185.82.216.104:443 server1.datadumpcloud.org tcp

Files

memory/3152-1-0x0000000002A20000-0x0000000002E1A000-memory.dmp

memory/3152-2-0x0000000002E20000-0x000000000370B000-memory.dmp

memory/3152-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2248-4-0x000000007489E000-0x000000007489F000-memory.dmp

memory/2248-5-0x0000000004FF0000-0x0000000005026000-memory.dmp

memory/2248-7-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2248-6-0x0000000005660000-0x0000000005C8A000-memory.dmp

memory/2248-11-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2248-10-0x0000000005F30000-0x0000000005F96000-memory.dmp

memory/2248-9-0x0000000005EC0000-0x0000000005F26000-memory.dmp

memory/2248-8-0x00000000055E0000-0x0000000005602000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eftxaney.5er.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2248-20-0x0000000005FA0000-0x00000000062F7000-memory.dmp

memory/2248-21-0x0000000006490000-0x00000000064AE000-memory.dmp

memory/2248-22-0x00000000064D0000-0x000000000651C000-memory.dmp

memory/2248-23-0x0000000006A10000-0x0000000006A56000-memory.dmp

memory/2248-24-0x00000000078C0000-0x00000000078F4000-memory.dmp

memory/2248-25-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/2248-27-0x0000000070CD0000-0x0000000071027000-memory.dmp

memory/2248-26-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2248-36-0x0000000007900000-0x000000000791E000-memory.dmp

memory/2248-37-0x0000000007920000-0x00000000079C4000-memory.dmp

memory/2248-38-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2248-39-0x0000000008090000-0x000000000870A000-memory.dmp

memory/2248-40-0x0000000007A50000-0x0000000007A6A000-memory.dmp

memory/2248-41-0x0000000007A90000-0x0000000007A9A000-memory.dmp

memory/2248-42-0x0000000007BA0000-0x0000000007C36000-memory.dmp

memory/2248-43-0x0000000007AB0000-0x0000000007AC1000-memory.dmp

memory/2248-44-0x0000000007B00000-0x0000000007B0E000-memory.dmp

memory/2248-45-0x0000000007B10000-0x0000000007B25000-memory.dmp

memory/2248-46-0x0000000007B60000-0x0000000007B7A000-memory.dmp

memory/2248-47-0x0000000007B80000-0x0000000007B88000-memory.dmp

memory/2248-50-0x0000000074890000-0x0000000075041000-memory.dmp

memory/896-52-0x0000000002A40000-0x0000000002E45000-memory.dmp

memory/3596-61-0x00000000056D0000-0x0000000005A27000-memory.dmp

memory/3596-62-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/3596-63-0x0000000070C80000-0x0000000070FD7000-memory.dmp

memory/3596-72-0x0000000006E00000-0x0000000006EA4000-memory.dmp

memory/3596-73-0x0000000007140000-0x0000000007151000-memory.dmp

memory/3152-75-0x0000000002A20000-0x0000000002E1A000-memory.dmp

memory/3152-74-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3596-76-0x0000000007170000-0x0000000007185000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/684-80-0x0000000005C10000-0x0000000005F67000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2e68e6206c5f6dc7bfd5c6b6a39b05a9
SHA1 b2127770de26dc811a9d47cf8a655bf96201827b
SHA256 21c9ababbad0154ab4ed787ceab78d1d753582e5dda7a61f107271d34af83053
SHA512 679bbf690453958e6533032f1f25e45dca4f5c045313cb708def844c412d939b38dff414ea24d12b7b79da866d0af8f595c5f72548cda20cf1973dffb56d8f28

memory/684-90-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/684-91-0x0000000070D50000-0x00000000710A7000-memory.dmp

memory/3152-100-0x0000000002E20000-0x000000000370B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 eec5046234f5bd4c9b3f3bb654739e30
SHA1 efc73cd7fef04696364a99102abdf607ac257ec6
SHA256 e9cc3046bd4f92659a8f3523df3a378d7c42ec3098c88f1fc2b5fc1d6b9681e5
SHA512 f2b98acba5e589821915b48fb711d6dfefa7eb7d2c0abb0072f1af156ab3d0e4d5cacd693d7a9eb4f6914f995ee3611caccb73871d392df3fe89bc499eef0fbd

memory/2560-111-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/2560-112-0x0000000070C80000-0x0000000070FD7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 a31b1d2582d9f6a1fc56a8343095a919
SHA1 68994f7f0cb73ff36d22635f950818e41cbb5c3a
SHA256 09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5
SHA512 3606db1fa155bc5698279183b8a35fdaf0b93f438b37b76bdcc5ff0238babf2411030a7bc7659cd10aa4bf7e76b93c7e8b715a6b9c1ffdb37fd3312bb95dd7cc

memory/896-125-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4252-136-0x0000000005E00000-0x0000000006157000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e98ba16e9df8308b3e9dfa6c0a5aa18b
SHA1 d4bd7d6c0b677f068907b54890023a75f765abf1
SHA256 c61ca67b8daefa6375999125a7bf918cf8604fb5c5d439a0a61eaf4cfbf7203c
SHA512 24101c1bb1ba5c0e6afe098da763985c1ffa027963c689183187bed01c647e68e18af7a9ffe5550910e9a7615a4d103f3b431bb95b4fff504a6de743469c56cc

memory/4252-138-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/4252-139-0x0000000070D70000-0x00000000710C7000-memory.dmp

memory/3772-155-0x00000000062D0000-0x0000000006627000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 24bcbbec29c2b1182bdcdd6da5b71613
SHA1 765cd24a79e1efe5e08951f36f9f2b574f2e1da3
SHA256 3bf3b292da37be2e6c4132f0e9fb83553a54b39876dd35dafe18a110e178b180
SHA512 f179eb4217516b82c49b9944b0764343b768beee4c6c1586d505a9de6e3532066182be42bf833e2b881ecea3fe98752cc9fcf37d492b6a079d3e05438c5f0f26

memory/3772-160-0x0000000006DF0000-0x0000000006E3C000-memory.dmp

memory/3772-161-0x0000000070A20000-0x0000000070A6C000-memory.dmp

memory/3772-162-0x0000000070C70000-0x0000000070FC7000-memory.dmp

memory/3772-171-0x0000000007AD0000-0x0000000007B74000-memory.dmp

memory/3772-172-0x0000000007E40000-0x0000000007E51000-memory.dmp

memory/3772-173-0x0000000006650000-0x0000000006665000-memory.dmp

memory/2908-183-0x0000000005F00000-0x0000000006257000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 cdc75bea277afc95ecb2941dd8d9eaa7
SHA1 6ad9450a035d0a12a21fa1831a4a9fb827183c0c
SHA256 ed8dfc558618b324de105c48b52c60c5dfe9af5e5758720a2276636f767db22a
SHA512 24d5309ed8fbb71ff8f638ee031ddb1c4f47701a095bbcc21353c16d7d64f59a04a521c899c91d10f594f1fbec62b80b71d0e609229d7a8708185b760c413c87

memory/2908-185-0x0000000070A20000-0x0000000070A6C000-memory.dmp

memory/2908-186-0x0000000070BA0000-0x0000000070EF7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4640-201-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3296-206-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3296-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4640-211-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4640-213-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/5028-214-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4640-216-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/5028-220-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4640-219-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4640-224-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4640-225-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4640-228-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4640-231-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4640-236-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4640-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4640-240-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 09:52

Reported

2024-05-16 09:55

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-301 = "Romance Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-572 = "China Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-281 = "Central Europe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1916 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1916 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1916 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4356 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4356 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4356 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4356 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\system32\cmd.exe
PID 4356 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\system32\cmd.exe
PID 4348 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4348 wrote to memory of 4912 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4356 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4356 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4356 wrote to memory of 4544 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4356 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4356 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4356 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4356 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\rss\csrss.exe
PID 4356 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\rss\csrss.exe
PID 4356 wrote to memory of 1420 N/A C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe C:\Windows\rss\csrss.exe
PID 1420 wrote to memory of 4396 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 4396 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 4396 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 5112 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 5112 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 5112 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 1552 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 1552 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 1552 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1420 wrote to memory of 1672 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1420 wrote to memory of 1672 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 316 wrote to memory of 4112 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 316 wrote to memory of 4112 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 316 wrote to memory of 4112 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4112 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4112 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4112 wrote to memory of 744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe

"C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3764,i,13544508926340531097,6671217806016090640,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe

"C:\Users\Admin\AppData\Local\Temp\09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
BE 2.17.107.99:443 www.bing.com tcp
US 8.8.8.8:53 99.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 f684425b-37ec-4ec6-a75b-06bdf2381769.uuid.datadumpcloud.org udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 stun3.l.google.com udp
US 8.8.8.8:53 server14.datadumpcloud.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun3.l.google.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.104:443 server14.datadumpcloud.org tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.104:443 server14.datadumpcloud.org tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
BG 185.82.216.104:443 server14.datadumpcloud.org tcp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp

Files

memory/1916-1-0x0000000002950000-0x0000000002D51000-memory.dmp

memory/1916-2-0x0000000002D60000-0x000000000364B000-memory.dmp

memory/1916-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3240-4-0x000000007461E000-0x000000007461F000-memory.dmp

memory/3240-5-0x0000000002860000-0x0000000002896000-memory.dmp

memory/3240-6-0x0000000074610000-0x0000000074DC0000-memory.dmp

memory/3240-7-0x0000000005170000-0x0000000005798000-memory.dmp

memory/3240-8-0x0000000074610000-0x0000000074DC0000-memory.dmp

memory/3240-9-0x0000000004E80000-0x0000000004EA2000-memory.dmp

memory/3240-10-0x00000000057A0000-0x0000000005806000-memory.dmp

memory/3240-11-0x0000000005810000-0x0000000005876000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h2utbjnb.erz.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3240-21-0x0000000005980000-0x0000000005CD4000-memory.dmp

memory/3240-22-0x0000000005E50000-0x0000000005E6E000-memory.dmp

memory/3240-23-0x0000000006060000-0x00000000060AC000-memory.dmp

memory/3240-24-0x0000000006390000-0x00000000063D4000-memory.dmp

memory/3240-25-0x0000000007190000-0x0000000007206000-memory.dmp

memory/3240-26-0x0000000007890000-0x0000000007F0A000-memory.dmp

memory/3240-27-0x0000000007210000-0x000000000722A000-memory.dmp

memory/3240-28-0x00000000073D0000-0x0000000007402000-memory.dmp

memory/3240-30-0x0000000070630000-0x0000000070984000-memory.dmp

memory/3240-41-0x0000000007410000-0x000000000742E000-memory.dmp

memory/3240-42-0x0000000007430000-0x00000000074D3000-memory.dmp

memory/3240-43-0x0000000074610000-0x0000000074DC0000-memory.dmp

memory/3240-31-0x0000000074610000-0x0000000074DC0000-memory.dmp

memory/3240-29-0x00000000704B0000-0x00000000704FC000-memory.dmp

memory/3240-44-0x0000000007520000-0x000000000752A000-memory.dmp

memory/3240-45-0x00000000075E0000-0x0000000007676000-memory.dmp

memory/3240-46-0x0000000007540000-0x0000000007551000-memory.dmp

memory/3240-47-0x0000000007580000-0x000000000758E000-memory.dmp

memory/3240-48-0x0000000007590000-0x00000000075A4000-memory.dmp

memory/3240-49-0x0000000007680000-0x000000000769A000-memory.dmp

memory/3240-50-0x00000000075D0000-0x00000000075D8000-memory.dmp

memory/3240-53-0x0000000074610000-0x0000000074DC0000-memory.dmp

memory/4356-56-0x0000000002DF0000-0x00000000036DB000-memory.dmp

memory/4356-55-0x00000000029E0000-0x0000000002DE4000-memory.dmp

memory/4160-57-0x0000000005E70000-0x00000000061C4000-memory.dmp

memory/4160-67-0x00000000704B0000-0x00000000704FC000-memory.dmp

memory/4160-68-0x0000000070C50000-0x0000000070FA4000-memory.dmp

memory/4160-78-0x00000000076B0000-0x0000000007753000-memory.dmp

memory/1916-79-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4160-80-0x00000000079E0000-0x00000000079F1000-memory.dmp

memory/4160-81-0x0000000007A30000-0x0000000007A44000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4544-85-0x0000000005EC0000-0x0000000006214000-memory.dmp

memory/1916-95-0x0000000002950000-0x0000000002D51000-memory.dmp

memory/1916-96-0x0000000002D60000-0x000000000364B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5175b934588df162f75141c3e51caebc
SHA1 eda48d9e28e29ba331005735a136e36a430bd7f2
SHA256 9d28e1613e7fdfe5ce45a7176dbfc0002cb60717362df52296dad5ddb6a3d480
SHA512 eeef4eead46bc6d7642d2690089629b1ca511f8b698e693ec67d915dd4deddd4174210fb63ee14a62a3ed4f6173f081d241651196ec669e834a4849b90994f48

memory/4544-98-0x00000000704B0000-0x00000000704FC000-memory.dmp

memory/4544-99-0x0000000070C30000-0x0000000070F84000-memory.dmp

memory/4356-119-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a4d7ece2363ef5b8409ff3f35992a78d
SHA1 324e8754cc0c83748c4d7242e05e55a62a1d0070
SHA256 f0a3130baedb2a6be7b61fd4e396d791bc2e1054052c8cea4ddaa7ba002a8bcf
SHA512 260aab2097b3379420209238382bc5e79efa8e54f7cd8692b7d91437c41fa455b138fc27e7b134a1793fb55221d0a0f452447d1e47d9e8ba5c411dd80f5d5d41

memory/348-121-0x00000000704B0000-0x00000000704FC000-memory.dmp

memory/348-122-0x0000000070C30000-0x0000000070F84000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 a31b1d2582d9f6a1fc56a8343095a919
SHA1 68994f7f0cb73ff36d22635f950818e41cbb5c3a
SHA256 09d82f3d8ba46d25124fd17d2161e9ae107eebf1ce9121814a0cef737b5e6bc5
SHA512 3606db1fa155bc5698279183b8a35fdaf0b93f438b37b76bdcc5ff0238babf2411030a7bc7659cd10aa4bf7e76b93c7e8b715a6b9c1ffdb37fd3312bb95dd7cc

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 55682c2a7e753ad396ca1c54822601a4
SHA1 79e7dd7cf200b3c925853ea812bcdfd9c8eb870b
SHA256 a6c46908ac1ed61be6a0f18a52a9670f638ae88da6b669302f731ad66a88fb6f
SHA512 24e997951dc53e18443f27b3a921a0b546e1f0fe71030cd2efa37913e6bd7d758140217e4f4330124eacd636fc51c573a7136bf7223a6788d7f21e44f6d6f9b7

memory/4396-150-0x0000000070C30000-0x0000000070F84000-memory.dmp

memory/4396-149-0x00000000704B0000-0x00000000704FC000-memory.dmp

memory/5112-170-0x0000000005C20000-0x0000000005F74000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 21196da285d5178f9d13ec22e7e83290
SHA1 913f4153cd74b75d6eb80825870a656ff9afa739
SHA256 79a83aac15167b8939fe1ed7308d6fea56f9a6c5f325a998edd91036370d501b
SHA512 9b727a49afb053eae0e34fe92bcaa169f2715229717c1e5a61993da64c4ecf2cea10ce37eb043b4b17a6f03191d83b21a6682b417a4e2773555352c2e90dccf0

memory/5112-172-0x0000000006220000-0x000000000626C000-memory.dmp

memory/5112-174-0x0000000070550000-0x00000000708A4000-memory.dmp

memory/5112-173-0x00000000703D0000-0x000000007041C000-memory.dmp

memory/5112-184-0x0000000007410000-0x00000000074B3000-memory.dmp

memory/5112-185-0x0000000007780000-0x0000000007791000-memory.dmp

memory/5112-186-0x0000000005FC0000-0x0000000005FD4000-memory.dmp

memory/1552-188-0x0000000006220000-0x0000000006574000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 368d6396299be231a8450946a615a78e
SHA1 c9ae8fb5955afd1a63d46604a668b9fc8956fcd7
SHA256 cdc82e254ab01094fec24e6dba447aae62e69eee6e4b44da8a39f39f5e842f6b
SHA512 d259e9a2daaa58e4ddbe849e5fed24c9c70c9001ed30098ebc72d2c9713184e65f96a38c66e7a2a6cae6a1159951d88b079e32d3a6c41427e015267e952524ef

memory/1552-200-0x0000000070B60000-0x0000000070EB4000-memory.dmp

memory/1552-199-0x00000000703D0000-0x000000007041C000-memory.dmp

memory/4356-211-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1420-218-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4356-219-0x00000000029E0000-0x0000000002DE4000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/316-224-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/316-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1420-230-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4628-232-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1420-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1420-238-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4628-240-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1420-242-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1420-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1420-250-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1420-254-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1420-258-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1420-262-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1420-266-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1420-270-0x0000000000400000-0x0000000000D1C000-memory.dmp