Malware Analysis Report

2025-01-02 06:27

Sample ID 240516-lwpsmseh8v
Target 4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba
SHA256 4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba

Threat Level: Known bad

The file 4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Checks installed software on the system

Manipulates WinMonFS driver.

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Command and Scripting Interpreter: PowerShell

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 09:53

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 09:53

Reported

2024-05-16 09:55

Platform

win11-20240508-en

Max time kernel

149s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3433428765-2473475212-4279855560-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-12 = "Azores Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-365 = "Middle East Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2432 = "Cuba Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 876 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 876 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 876 wrote to memory of 1720 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\system32\cmd.exe
PID 2456 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\system32\cmd.exe
PID 5024 wrote to memory of 5040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5024 wrote to memory of 5040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2456 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2456 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\rss\csrss.exe
PID 2456 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\rss\csrss.exe
PID 2456 wrote to memory of 420 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\rss\csrss.exe
PID 420 wrote to memory of 4752 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 420 wrote to memory of 4752 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 420 wrote to memory of 4752 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 420 wrote to memory of 2392 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 420 wrote to memory of 2392 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 420 wrote to memory of 2392 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 420 wrote to memory of 536 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 420 wrote to memory of 536 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 420 wrote to memory of 536 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 420 wrote to memory of 2924 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 420 wrote to memory of 2924 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1752 wrote to memory of 3472 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 3472 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1752 wrote to memory of 3472 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3472 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3472 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3472 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe

"C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe

"C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ccd912a4-82f2-47ef-8809-f3ac51aca552.uuid.datadumpcloud.org udp
US 8.8.8.8:53 stun.stunprotocol.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
BG 185.82.216.104:443 server2.datadumpcloud.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
N/A 127.0.0.1:3478 udp
BG 185.82.216.104:443 server2.datadumpcloud.org tcp
US 74.125.250.129:19302 stun2.l.google.com udp
BG 185.82.216.104:443 server2.datadumpcloud.org tcp

Files

memory/876-1-0x0000000002A40000-0x0000000002E43000-memory.dmp

memory/876-2-0x0000000002E50000-0x000000000373B000-memory.dmp

memory/876-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1720-4-0x00000000746EE000-0x00000000746EF000-memory.dmp

memory/1720-5-0x0000000004BA0000-0x0000000004BD6000-memory.dmp

memory/1720-7-0x00000000746E0000-0x0000000074E91000-memory.dmp

memory/1720-6-0x0000000005360000-0x000000000598A000-memory.dmp

memory/1720-8-0x0000000005160000-0x0000000005182000-memory.dmp

memory/1720-9-0x0000000005200000-0x0000000005266000-memory.dmp

memory/1720-10-0x00000000746E0000-0x0000000074E91000-memory.dmp

memory/1720-11-0x00000000052E0000-0x0000000005346000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i0ajnqd1.mlj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1720-20-0x0000000005B60000-0x0000000005EB7000-memory.dmp

memory/1720-21-0x0000000006010000-0x000000000602E000-memory.dmp

memory/1720-22-0x0000000006070000-0x00000000060BC000-memory.dmp

memory/1720-23-0x00000000065D0000-0x0000000006616000-memory.dmp

memory/1720-25-0x0000000070950000-0x000000007099C000-memory.dmp

memory/1720-26-0x0000000070AD0000-0x0000000070E27000-memory.dmp

memory/1720-24-0x0000000007450000-0x0000000007484000-memory.dmp

memory/1720-35-0x0000000007490000-0x00000000074AE000-memory.dmp

memory/1720-36-0x00000000074B0000-0x0000000007554000-memory.dmp

memory/1720-37-0x00000000746E0000-0x0000000074E91000-memory.dmp

memory/1720-40-0x00000000075E0000-0x00000000075FA000-memory.dmp

memory/1720-39-0x00000000746E0000-0x0000000074E91000-memory.dmp

memory/1720-38-0x0000000007C20000-0x000000000829A000-memory.dmp

memory/1720-41-0x0000000007640000-0x000000000764A000-memory.dmp

memory/1720-42-0x0000000007750000-0x00000000077E6000-memory.dmp

memory/1720-43-0x0000000007660000-0x0000000007671000-memory.dmp

memory/1720-44-0x00000000076B0000-0x00000000076BE000-memory.dmp

memory/1720-45-0x00000000076C0000-0x00000000076D5000-memory.dmp

memory/1720-46-0x0000000007710000-0x000000000772A000-memory.dmp

memory/1720-47-0x0000000007730000-0x0000000007738000-memory.dmp

memory/1720-50-0x00000000746E0000-0x0000000074E91000-memory.dmp

memory/876-52-0x0000000002A40000-0x0000000002E43000-memory.dmp

memory/2456-53-0x0000000002A40000-0x0000000002E3F000-memory.dmp

memory/836-62-0x0000000070950000-0x000000007099C000-memory.dmp

memory/836-63-0x0000000070AD0000-0x0000000070E27000-memory.dmp

memory/836-72-0x00000000075F0000-0x0000000007694000-memory.dmp

memory/836-73-0x0000000007940000-0x0000000007951000-memory.dmp

memory/876-75-0x0000000002E50000-0x000000000373B000-memory.dmp

memory/876-74-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/836-76-0x0000000007990000-0x00000000079A5000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/4808-85-0x0000000005F10000-0x0000000006267000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6c74fc1aa9d6f565f92016337e1a2c48
SHA1 4586c6758f9b81cc26b74e0c98036354b84795e9
SHA256 0aac27456a5ee36414eabcbecee99cb26a165735ae03cc34ff54f3f20ecc1c5f
SHA512 56aaecb512b30f1d7a462e46c723c3564070a2789f091924ea2d7b9372611c695eb497fda8151494c0af1ea5c2808617858a4465efe91e1e4e64a7652f1a35cf

memory/4808-90-0x0000000070950000-0x000000007099C000-memory.dmp

memory/4808-91-0x0000000070BA0000-0x0000000070EF7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 06c5f8dc067b59f57b79f0519b800b6d
SHA1 d64fde555ad50cc59c628a9bfe7d734475f96025
SHA256 43de36dcce3a34ec56ca91f25219a45ca2952caaf441e7f14d84db8cd00bde82
SHA512 398a0b34d8d4f223342dbe12155dd0a69c1a4256c624e67460e94895bd7817d3d72e057c9b94fad4a3473f2fe10ffe809478d25632b884dedee4f33588850522

memory/1920-111-0x0000000070AD0000-0x0000000070E27000-memory.dmp

memory/1920-110-0x0000000070950000-0x000000007099C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 4f190ad743b62026f93246a0fd077bc7
SHA1 75df2c920194dc463f31d24b6b7604661488028a
SHA256 4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba
SHA512 db6be7250a2732c54b1b35138f72c86ea47b1aff2cefb865c11fad1f88370aa54163410edc27cd1f8d78decf181f325c43f23d2ab8fb15642e65a8689f141620

memory/2456-124-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4752-135-0x0000000005AA0000-0x0000000005DF7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 17d68efe61c7815d35771919e52b1cf7
SHA1 bb5bbc171d21e2cc2e4161e4f64aa649ea52c720
SHA256 60de77c6f4780b89cbb87dc0434615d094bc8c2079cef3c2cfff5db4d098a91e
SHA512 6945d329630bf17ba909309ea0a119677d07e1e37be3df423a4a5ab66461691fc3fbd355d92b4218d9236a2109edf71961d3ff86463e6099d055048b332d5a7d

memory/4752-138-0x0000000070950000-0x000000007099C000-memory.dmp

memory/4752-139-0x0000000070AF0000-0x0000000070E47000-memory.dmp

memory/2392-157-0x0000000006300000-0x0000000006657000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b11fe83444c5f01570b9d4da6dcaccb2
SHA1 087dff71843fdffd9e59fc54365c428e99c55be8
SHA256 3e2e47f226b6f0359428491ba77e5a7f2fcf47796f21cf588f6e4bb2658c6789
SHA512 cf81cc701aaa25f0fe2895e531f7970db2d5b5f2827a1ffe04a7a2a5b25f416adbaef2024c5afedd7f49d465f3a89e72a797412da692e77987b18ae729d2fa98

memory/2392-159-0x0000000006E40000-0x0000000006E8C000-memory.dmp

memory/2392-160-0x0000000070870000-0x00000000708BC000-memory.dmp

memory/2392-161-0x0000000070AC0000-0x0000000070E17000-memory.dmp

memory/2392-170-0x0000000007B00000-0x0000000007BA4000-memory.dmp

memory/2392-171-0x0000000006660000-0x0000000006671000-memory.dmp

memory/2392-172-0x00000000066A0000-0x00000000066B5000-memory.dmp

memory/536-182-0x00000000055B0000-0x0000000005907000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 01130a15015817329affb3d2b3458684
SHA1 74416f00604ab7cab618b9c9668ec85fcba2112d
SHA256 cf654a529bedc70750d622a8ac647a243517ca4df422a17021a0eeacea71f95f
SHA512 2fc45703e360bfa0668696e1ddb10c8ccde93797b68f079a3c6af9cb51bcf20b007dd036cd4065456acb6a9170f54baf5a890bc7de634ec10d2fdff03b8f3bb5

memory/536-185-0x00000000709F0000-0x0000000070D47000-memory.dmp

memory/536-184-0x0000000070870000-0x00000000708BC000-memory.dmp

memory/420-195-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1752-205-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4268-208-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1752-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/420-212-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/420-214-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4268-215-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/420-217-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4268-220-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/420-219-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/420-222-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/420-227-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/420-229-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/420-231-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/420-236-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/420-239-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/420-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/420-243-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 09:53

Reported

2024-05-16 09:55

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-341 = "Egypt Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-381 = "South Africa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-841 = "Argentina Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4496 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4496 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4496 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 4384 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\system32\cmd.exe
PID 2588 wrote to memory of 3212 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\system32\cmd.exe
PID 3212 wrote to memory of 3968 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3212 wrote to memory of 3968 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2588 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 4068 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 3976 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2588 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\rss\csrss.exe
PID 2588 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\rss\csrss.exe
PID 2588 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe C:\Windows\rss\csrss.exe
PID 2248 wrote to memory of 5012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 5012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 5012 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 3396 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 3396 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 3396 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 4304 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 4304 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 4304 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2248 wrote to memory of 2392 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2248 wrote to memory of 2392 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3208 wrote to memory of 1680 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3208 wrote to memory of 1680 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3208 wrote to memory of 1680 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1680 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1680 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1680 wrote to memory of 5100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe

"C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe

"C:\Users\Admin\AppData\Local\Temp\4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.250:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 250.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
BE 88.221.83.250:443 www.bing.com tcp
US 8.8.8.8:53 8412d593-0500-46fc-a627-65adcf20d8b4.uuid.datadumpcloud.org udp
US 8.8.8.8:53 server7.datadumpcloud.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 stun.ipfire.org udp
DE 81.3.27.44:3478 stun.ipfire.org udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.104:443 server7.datadumpcloud.org tcp
US 8.8.8.8:53 44.27.3.81.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BG 185.82.216.104:443 server7.datadumpcloud.org tcp
US 52.111.227.11:443 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
BG 185.82.216.104:443 server7.datadumpcloud.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
N/A 127.0.0.1:31465 tcp

Files

memory/4496-1-0x0000000002980000-0x0000000002D80000-memory.dmp

memory/4496-2-0x0000000002D80000-0x000000000366B000-memory.dmp

memory/4496-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1052-4-0x000000007491E000-0x000000007491F000-memory.dmp

memory/1052-5-0x0000000002BB0000-0x0000000002BE6000-memory.dmp

memory/1052-6-0x0000000005270000-0x0000000005898000-memory.dmp

memory/1052-7-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/1052-8-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/1052-9-0x0000000005900000-0x0000000005922000-memory.dmp

memory/1052-10-0x0000000005A20000-0x0000000005A86000-memory.dmp

memory/1052-11-0x0000000005B40000-0x0000000005BA6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5wgjs2ka.pzl.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1052-17-0x0000000005BB0000-0x0000000005F04000-memory.dmp

memory/1052-22-0x0000000006180000-0x000000000619E000-memory.dmp

memory/1052-23-0x0000000006450000-0x000000000649C000-memory.dmp

memory/1052-24-0x00000000066C0000-0x0000000006704000-memory.dmp

memory/1052-25-0x00000000074A0000-0x0000000007516000-memory.dmp

memory/1052-26-0x0000000007BA0000-0x000000000821A000-memory.dmp

memory/1052-27-0x0000000007540000-0x000000000755A000-memory.dmp

memory/1052-29-0x00000000707B0000-0x00000000707FC000-memory.dmp

memory/1052-28-0x00000000076F0000-0x0000000007722000-memory.dmp

memory/1052-31-0x0000000070F10000-0x0000000071264000-memory.dmp

memory/1052-30-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/1052-42-0x0000000007750000-0x00000000077F3000-memory.dmp

memory/1052-41-0x0000000007730000-0x000000000774E000-memory.dmp

memory/1052-43-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/1052-44-0x0000000007840000-0x000000000784A000-memory.dmp

memory/1052-45-0x0000000007900000-0x0000000007996000-memory.dmp

memory/1052-46-0x0000000007860000-0x0000000007871000-memory.dmp

memory/1052-47-0x00000000078A0000-0x00000000078AE000-memory.dmp

memory/1052-48-0x00000000078B0000-0x00000000078C4000-memory.dmp

memory/1052-49-0x00000000079A0000-0x00000000079BA000-memory.dmp

memory/1052-50-0x00000000078E0000-0x00000000078E8000-memory.dmp

memory/1052-53-0x0000000074910000-0x00000000750C0000-memory.dmp

memory/2588-55-0x0000000002920000-0x0000000002D20000-memory.dmp

memory/4384-65-0x00000000061A0000-0x00000000064F4000-memory.dmp

memory/4384-66-0x00000000707B0000-0x00000000707FC000-memory.dmp

memory/4384-67-0x0000000070EF0000-0x0000000071244000-memory.dmp

memory/4384-77-0x0000000007990000-0x0000000007A33000-memory.dmp

memory/4384-78-0x0000000007CA0000-0x0000000007CB1000-memory.dmp

memory/4384-79-0x0000000007CF0000-0x0000000007D04000-memory.dmp

memory/4496-80-0x0000000002980000-0x0000000002D80000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4068-90-0x0000000005B30000-0x0000000005E84000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 61ad9ce8962e7f2160dccafbfc8d2e05
SHA1 e0166cc16677a1e615ebefa441074817ee43d85e
SHA256 a2a44b895bfc45a3fb56c124588a539e7706623acc4e80c1f5d1af75253e5a83
SHA512 9d352d5bd5374e188b718b4b21f45061c394db34e91c34f68bb9b31a09d1ed55d1b90b7ddba44f2b0197c4c11b9d1599cf2b5147952bbe3f60b3bc9cd58f6739

memory/4068-95-0x00000000707B0000-0x00000000707FC000-memory.dmp

memory/4068-96-0x0000000070F30000-0x0000000071284000-memory.dmp

memory/4496-107-0x0000000002D80000-0x000000000366B000-memory.dmp

memory/4496-106-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3b5e97b5939a8058ffbe262df8561f94
SHA1 cd878a682679f080ebd568d651f4bcc104a5a8f9
SHA256 039c6349ae7df91bb51af39682adb0ff469236566771c3df95f4af209fb88bf6
SHA512 7d98c680de15454b141ccbbe3fd2c64e7053ec6c7fbd2088023ad753e35a56b07244de814a577f448197e7d6a7fabc36318a4f5896f248059ac3adc96410bb1c

memory/3976-119-0x00000000707B0000-0x00000000707FC000-memory.dmp

memory/3976-120-0x0000000070F30000-0x0000000071284000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 4f190ad743b62026f93246a0fd077bc7
SHA1 75df2c920194dc463f31d24b6b7604661488028a
SHA256 4bf6453497ae708469692891f30e9d3ebca6b13068e741e9a782ae41ce15a9ba
SHA512 db6be7250a2732c54b1b35138f72c86ea47b1aff2cefb865c11fad1f88370aa54163410edc27cd1f8d78decf181f325c43f23d2ab8fb15642e65a8689f141620

memory/5012-145-0x0000000006260000-0x00000000065B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4ca29141d445211bdf08673ffac1bed1
SHA1 1a97f37317d21c37f993417347dbf7eae6ad908a
SHA256 268b6c6094fd3e912deb6a5648d1c8bd8a6f908450ac5f55570c06e3d7f8e4ea
SHA512 fc0ff4d7213aeb8ed12be38cf58cd388415b2f376a07a86f8ec377cc11e93c424c166722e7435cd16d81ef991aa7d80701cdfc8868f4370dfac2e2e48c3af65d

memory/5012-147-0x00000000707B0000-0x00000000707FC000-memory.dmp

memory/5012-148-0x0000000070930000-0x0000000070C84000-memory.dmp

memory/3396-168-0x0000000005AA0000-0x0000000005DF4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9fc7c7edee40ec9407f5eb0226ea7d48
SHA1 77e902fb80cd10555bb025f753f8270b3c5ccf5f
SHA256 940e75a3e991fbf23d680dbcb6ee4a82882f60051a05b2ce2fbc42551d360dd7
SHA512 f6a1898cfa5b9dcf3775c06351711c1bb78368a5b2d8176a19476a3109c50a462039bdd953fc5745110738197c320b8f421fcb2d30d751837fa4a249d8ab96ba

memory/3396-170-0x00000000060E0000-0x000000000612C000-memory.dmp

memory/3396-171-0x00000000706D0000-0x000000007071C000-memory.dmp

memory/3396-182-0x00000000072F0000-0x0000000007393000-memory.dmp

memory/3396-172-0x0000000070880000-0x0000000070BD4000-memory.dmp

memory/3396-183-0x00000000074B0000-0x00000000074C1000-memory.dmp

memory/3396-184-0x0000000005E20000-0x0000000005E34000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 fd84ec89600560cb2b2b4c5f17fed36a
SHA1 cc56fb04fac4926bd1e8386e46afd70e505b9398
SHA256 ebf1de9eff14428a4d373dc1ab886dddbdb984e5602be4ecaadae06f46320a58
SHA512 5b4622a7e9082b2811016fd18b9603760f212f7e5451e7dbfb2f973846d32c2e8b5d56fe2fcd55f5c0ad127c347226588178abfb0b2cd763cc4c0eca2a94f07a

memory/4304-195-0x0000000005F60000-0x00000000062B4000-memory.dmp

memory/4304-199-0x0000000070870000-0x0000000070BC4000-memory.dmp

memory/4304-198-0x00000000706D0000-0x000000007071C000-memory.dmp

memory/2588-197-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2248-216-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2588-218-0x0000000002920000-0x0000000002D20000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3208-223-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4584-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3208-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2248-229-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4584-231-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2248-233-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2248-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4584-239-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2248-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2248-245-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2248-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2248-253-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2248-257-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2248-261-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2248-265-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2248-269-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2248-273-0x0000000000400000-0x0000000000D1C000-memory.dmp