Analysis
-
max time kernel
38s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 10:24
Static task
static1
Behavioral task
behavioral1
Sample
d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe
Resource
win10v2004-20240508-en
General
-
Target
d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe
-
Size
4.1MB
-
MD5
d32b9d6134c9c22d54de56687bcd7a0b
-
SHA1
76787efd4bf960188b435f6287de1f29988557c9
-
SHA256
d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9
-
SHA512
ca8a9f5f1cd97496aeaccd0aa9a96859e7377ecc202ae9d8da167d68c09f89f6643fa6dfa5ff7814931133b582a8cc3414fa4c81a3c4f50dc48ecae3ecce4096
-
SSDEEP
98304:dBH5QtHgtXZGwxAeX68LG3wNCsYjHyiS0gsLIyJOWEFSdaDQG3a9ntN:dBZQtHgtXlxHq4G3ixkyiJTOnSQDy9nD
Malware Config
Signatures
-
Glupteba payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/4036-2-0x0000000002D70000-0x000000000365B000-memory.dmp family_glupteba behavioral1/memory/4036-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4036-81-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4036-116-0x0000000002D70000-0x000000000365B000-memory.dmp family_glupteba behavioral1/memory/4352-134-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4992-208-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4992-216-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid Process 1908 netsh.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exeinjector.exepid Process 4992 csrss.exe 3400 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
csrss.exed869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exedescription ioc Process File opened (read-only) \??\VBoxMiniRdrDN d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe -
Drops file in Windows directory 2 IoCs
Processes:
d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exedescription ioc Process File opened for modification C:\Windows\rss d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe File created C:\Windows\rss\csrss.exe d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid Process 3548 powershell.exe 4972 powershell.exe 4360 powershell.exe 4492 powershell.exe 2956 powershell.exe 5096 powershell.exe 4500 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid Process 1280 schtasks.exe 2284 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
powershell.exed869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exepowershell.exed869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid Process 4492 powershell.exe 4492 powershell.exe 4036 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 4036 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 2956 powershell.exe 2956 powershell.exe 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 5096 powershell.exe 5096 powershell.exe 4500 powershell.exe 4500 powershell.exe 3548 powershell.exe 3548 powershell.exe 4972 powershell.exe 4972 powershell.exe 4360 powershell.exe 4360 powershell.exe 3400 injector.exe 3400 injector.exe 3400 injector.exe 3400 injector.exe 3400 injector.exe 3400 injector.exe 4992 csrss.exe 4992 csrss.exe 3400 injector.exe 3400 injector.exe 3400 injector.exe 3400 injector.exe 3400 injector.exe 3400 injector.exe 4992 csrss.exe 4992 csrss.exe 3400 injector.exe 3400 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exed869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exedescription pid Process Token: SeDebugPrivilege 4492 powershell.exe Token: SeDebugPrivilege 4036 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Token: SeImpersonatePrivilege 4036 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe Token: SeDebugPrivilege 2956 powershell.exe Token: SeDebugPrivilege 5096 powershell.exe Token: SeDebugPrivilege 4500 powershell.exe Token: SeDebugPrivilege 3548 powershell.exe Token: SeDebugPrivilege 4972 powershell.exe Token: SeDebugPrivilege 4360 powershell.exe Token: SeSystemEnvironmentPrivilege 4992 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exed869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.execmd.execsrss.exedescription pid Process procid_target PID 4036 wrote to memory of 4492 4036 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 87 PID 4036 wrote to memory of 4492 4036 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 87 PID 4036 wrote to memory of 4492 4036 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 87 PID 4352 wrote to memory of 2956 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 96 PID 4352 wrote to memory of 2956 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 96 PID 4352 wrote to memory of 2956 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 96 PID 4352 wrote to memory of 4412 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 100 PID 4352 wrote to memory of 4412 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 100 PID 4412 wrote to memory of 1908 4412 cmd.exe 102 PID 4412 wrote to memory of 1908 4412 cmd.exe 102 PID 4352 wrote to memory of 5096 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 103 PID 4352 wrote to memory of 5096 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 103 PID 4352 wrote to memory of 5096 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 103 PID 4352 wrote to memory of 4500 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 106 PID 4352 wrote to memory of 4500 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 106 PID 4352 wrote to memory of 4500 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 106 PID 4352 wrote to memory of 4992 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 108 PID 4352 wrote to memory of 4992 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 108 PID 4352 wrote to memory of 4992 4352 d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe 108 PID 4992 wrote to memory of 3548 4992 csrss.exe 109 PID 4992 wrote to memory of 3548 4992 csrss.exe 109 PID 4992 wrote to memory of 3548 4992 csrss.exe 109 PID 4992 wrote to memory of 4972 4992 csrss.exe 115 PID 4992 wrote to memory of 4972 4992 csrss.exe 115 PID 4992 wrote to memory of 4972 4992 csrss.exe 115 PID 4992 wrote to memory of 4360 4992 csrss.exe 117 PID 4992 wrote to memory of 4360 4992 csrss.exe 117 PID 4992 wrote to memory of 4360 4992 csrss.exe 117 PID 4992 wrote to memory of 3400 4992 csrss.exe 120 PID 4992 wrote to memory of 3400 4992 csrss.exe 120 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe"C:\Users\Admin\AppData\Local\Temp\d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
C:\Users\Admin\AppData\Local\Temp\d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe"C:\Users\Admin\AppData\Local\Temp\d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:1908
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5096
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1280
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4792
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4360
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3400
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2284
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD54b10f616055d1ed91af8bdcffbe3b886
SHA1adc790d6fae43a338f56f35a99616ebd4321c18d
SHA256cc3ab3ed2d3318329f747533d15915d8ed16aededb71a3f8ea4ddf7a8b2faa60
SHA5124c446e5c658e3f5ad6d37788276d7bcb2ff25d5811550015106dbcfcd1def539d47194febe9370f8052bbfa1433c4b8e3a4b065ea85dfceb2def1c692211d4ae
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a56514c3aaf2d087f0e6391821a4a84e
SHA1ae8cd76eb7aac4e2ed4a746674d869d2678c5ea2
SHA256f03ec17fdf77917046f01df672adca5e4df56fa7150977c614c0205442a02fcc
SHA5123bbac0a9699fc985c515de8d679793dd1c773ad62b28d1b0bd066ef4b330580bc3c420c575d15e5c26130857a82e76ed78bc43dd5571d9ecc234c422eafbe547
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5661b0dc024adffed4f626f9f6e5bd1f0
SHA1fc17d80af88c1ed38210ba0f60b1ecee700ad953
SHA25610947c4cc5877b49141a7fd1d1c1988b1732217d3ee90d30153354186a73c583
SHA512738086762fea0809dc2d051660b9b5307e16d588fad3b4e757872d15a149d3af532082fa3d10e234f912c7932d7a6fcb9780e27e5d95721229321bff214531ac
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5d279f2e67f76e243c912be1c580c5cba
SHA1a306d350b0a1ee8395866cbb878537185d574e94
SHA25640390f312c0b8d55a4c2e837d915228430201f9c79010e19f5eaa2bf260bcefe
SHA512b95fa66b1161181aa6d2ed2d038fb997d79e9aadcfc32bae952172df35ce98eb3b66f72245a0f0f265571ad21feadedf4f34e1f4bdc924aa5e64482077528709
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5155e6042ed15a185372894c78038c811
SHA1a8c21b81f5cf5b50f4d99f5fce05b958cf1bbdef
SHA25600f83caf33ded893e31d01e3b4b131d19d6c1018ed7560681987d69a48ab90a8
SHA5122f63e5c4100805c0e4ff418429d9bded6195a0bf9f0eacdbc8cc069acdcc11798482856e217a0bd5dc38a79a71dc97876c9ea5d268968ecaf474bf2e35d125da
-
Filesize
4.1MB
MD5d32b9d6134c9c22d54de56687bcd7a0b
SHA176787efd4bf960188b435f6287de1f29988557c9
SHA256d869c43edeffa5f506d4d2473c7286430c7600dc99c6c08f6ea224215e79b3c9
SHA512ca8a9f5f1cd97496aeaccd0aa9a96859e7377ecc202ae9d8da167d68c09f89f6643fa6dfa5ff7814931133b582a8cc3414fa4c81a3c4f50dc48ecae3ecce4096