Malware Analysis Report

2024-12-08 02:10

Sample ID 240516-msp5nshc22
Target 8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f
SHA256 8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f

Threat Level: Known bad

The file 8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Manipulates WinMonFS driver.

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Command and Scripting Interpreter: PowerShell

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Creates scheduled task(s)

Uses Task Scheduler COM API

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 10:43

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 10:43

Reported

2024-05-16 10:46

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-432 = "Iran Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2372 = "Easter Island Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 216 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 216 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 216 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 668 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\system32\cmd.exe
PID 2840 wrote to memory of 4312 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\system32\cmd.exe
PID 4312 wrote to memory of 4268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4312 wrote to memory of 4268 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2840 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2840 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\rss\csrss.exe
PID 2840 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\rss\csrss.exe
PID 2840 wrote to memory of 4148 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\rss\csrss.exe
PID 4148 wrote to memory of 1840 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 1840 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 1840 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 3656 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 3656 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 3656 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 3088 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 3088 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 3088 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4148 wrote to memory of 3428 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4148 wrote to memory of 3428 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1772 wrote to memory of 2296 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1772 wrote to memory of 2296 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1772 wrote to memory of 2296 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2296 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2296 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2296 wrote to memory of 3836 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe

"C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe

"C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.250:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 250.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BE 2.17.107.123:443 www.bing.com tcp
US 8.8.8.8:53 123.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 f0c67141-ad5e-4b14-9eca-cbe0c927ed04.uuid.myfastupdate.org udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 17.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 stun2.l.google.com udp
US 8.8.8.8:53 server5.myfastupdate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server5.myfastupdate.org tcp
US 74.125.250.129:19302 stun2.l.google.com udp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.111:443 server5.myfastupdate.org tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
BG 185.82.216.111:443 server5.myfastupdate.org tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
BG 185.82.216.111:443 server5.myfastupdate.org tcp

Files

memory/216-1-0x0000000002960000-0x0000000002D67000-memory.dmp

memory/216-2-0x0000000002D70000-0x000000000365B000-memory.dmp

memory/216-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3352-4-0x00000000744BE000-0x00000000744BF000-memory.dmp

memory/3352-5-0x00000000045D0000-0x0000000004606000-memory.dmp

memory/3352-7-0x0000000004C40000-0x0000000005268000-memory.dmp

memory/3352-6-0x00000000744B0000-0x0000000074C60000-memory.dmp

memory/3352-8-0x0000000005420000-0x0000000005442000-memory.dmp

memory/3352-9-0x00000000054C0000-0x0000000005526000-memory.dmp

memory/3352-10-0x0000000005530000-0x0000000005596000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_slxzi5up.2x5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3352-20-0x00000000055A0000-0x00000000058F4000-memory.dmp

memory/3352-21-0x0000000005B90000-0x0000000005BAE000-memory.dmp

memory/3352-22-0x0000000005BE0000-0x0000000005C2C000-memory.dmp

memory/3352-23-0x0000000006100000-0x0000000006144000-memory.dmp

memory/3352-24-0x0000000006EC0000-0x0000000006F36000-memory.dmp

memory/3352-25-0x00000000075C0000-0x0000000007C3A000-memory.dmp

memory/3352-26-0x0000000006F60000-0x0000000006F7A000-memory.dmp

memory/3352-28-0x0000000070350000-0x000000007039C000-memory.dmp

memory/3352-27-0x0000000007110000-0x0000000007142000-memory.dmp

memory/3352-30-0x00000000744B0000-0x0000000074C60000-memory.dmp

memory/3352-41-0x0000000007170000-0x0000000007213000-memory.dmp

memory/3352-40-0x0000000007150000-0x000000000716E000-memory.dmp

memory/3352-29-0x00000000704D0000-0x0000000070824000-memory.dmp

memory/3352-42-0x0000000007260000-0x000000000726A000-memory.dmp

memory/3352-43-0x00000000744B0000-0x0000000074C60000-memory.dmp

memory/3352-44-0x0000000007320000-0x00000000073B6000-memory.dmp

memory/3352-45-0x00000000072A0000-0x00000000072B1000-memory.dmp

memory/3352-46-0x00000000072E0000-0x00000000072EE000-memory.dmp

memory/3352-47-0x00000000072F0000-0x0000000007304000-memory.dmp

memory/3352-48-0x00000000073E0000-0x00000000073FA000-memory.dmp

memory/3352-49-0x00000000073D0000-0x00000000073D8000-memory.dmp

memory/3352-52-0x00000000744B0000-0x0000000074C60000-memory.dmp

memory/216-54-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/216-55-0x0000000002D70000-0x000000000365B000-memory.dmp

memory/2840-57-0x0000000002950000-0x0000000002D4F000-memory.dmp

memory/668-65-0x0000000005E70000-0x00000000061C4000-memory.dmp

memory/668-68-0x0000000006510000-0x000000000655C000-memory.dmp

memory/668-69-0x0000000070450000-0x000000007049C000-memory.dmp

memory/668-70-0x0000000070BF0000-0x0000000070F44000-memory.dmp

memory/668-80-0x00000000076A0000-0x0000000007743000-memory.dmp

memory/668-81-0x00000000079D0000-0x00000000079E1000-memory.dmp

memory/668-82-0x0000000007A20000-0x0000000007A34000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c253ab42b0b0f8780ec0aeaa459be70c
SHA1 85cd358e4d80b674f7db381f1273e7d2af7d61bd
SHA256 1d2b4bd9cfef36814124de4be629beece524ff03ba879fd5725949cac4f507d6
SHA512 f2db4018158e6ac877e18260e71f77965677b3132c6719df192642dd9a09c6950a8d6b779a6230770d9cc2e8923e6bfaf34dfc95f54b4d5fd7825193527d1c63

memory/1100-96-0x0000000070450000-0x000000007049C000-memory.dmp

memory/1100-97-0x0000000070BF0000-0x0000000070F44000-memory.dmp

memory/2704-117-0x0000000005C50000-0x0000000005FA4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4bfb9ea0ee991c6c8d5d37012120ecbe
SHA1 e61e4977a74b4756bf7385b025966dcd712cadf1
SHA256 1074409653e68f3d3587ed44408722cdb191388cb422cf0e7eab6b6bff6cbd08
SHA512 1f99e6afc39a9beec2a66bcac7090eb4401d1906a862ff0ee4e1f2fac573f5e86faf9dd10a80f4737f81f595efbe9d982d3d19cf41cd18cb34244f5a7241ddff

memory/2840-119-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2704-120-0x0000000070450000-0x000000007049C000-memory.dmp

memory/2704-121-0x00000000705D0000-0x0000000070924000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 65c9fda7c255881d9deb74f1c5a732e2
SHA1 98eab99d62ab9d0f224ac1b6e505263c59302b5d
SHA256 8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f
SHA512 b7ab38633999559183103f915c4f436d7fdbcd75de249c7b01886b0b33f10c9954942e23c96868817930cb26e886558db2ded788457d3fbc0b1be0f2e10374ef

memory/2840-135-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1840-147-0x0000000006180000-0x00000000064D4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7b6d2da59c85fe84e2f0fd33c3eab968
SHA1 a768b0ed88e3b291159c51bb06f712a7bab5074b
SHA256 10cd11d13bd79990052c38d964e95f646de01107d89cbb98ca4adfe51604e396
SHA512 54f53e7ed3e2732f37eacc7a1e8d70a8a2f2f561dcfe331050ca6624e29efb259f018875c8ef355a61edcfca757c153bc580059c36c3eaba81d8cb23d324ae88

memory/1840-149-0x0000000006820000-0x000000000686C000-memory.dmp

memory/1840-150-0x00000000703B0000-0x00000000703FC000-memory.dmp

memory/1840-151-0x0000000070B50000-0x0000000070EA4000-memory.dmp

memory/1840-161-0x0000000007A30000-0x0000000007AD3000-memory.dmp

memory/1840-162-0x0000000007D70000-0x0000000007D81000-memory.dmp

memory/1840-163-0x00000000060C0000-0x00000000060D4000-memory.dmp

memory/3656-174-0x0000000005450000-0x00000000057A4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 96ab6b67689b5781c589f7b4f6791df0
SHA1 d8cd24e40221c7661f2adbe1df9eb2486633c6d2
SHA256 622fd8620b19291d25a6e4e5377a45c83836ad42a0d9630f43f8da4e731d5163
SHA512 d4dd0c81c07f7162c7545f6a0aff93a4900ec8081a8d9a7d790ad24c81c4ae74ba372223690dacb2042bde928265b3436b5370ca8542ef06c5dd76b22db0d275

memory/3656-176-0x0000000005B90000-0x0000000005BDC000-memory.dmp

memory/3656-177-0x00000000702D0000-0x000000007031C000-memory.dmp

memory/3656-178-0x0000000070A60000-0x0000000070DB4000-memory.dmp

memory/3656-188-0x0000000006D70000-0x0000000006E13000-memory.dmp

memory/3656-189-0x0000000005910000-0x0000000005921000-memory.dmp

memory/3656-190-0x0000000005950000-0x0000000005964000-memory.dmp

memory/3088-201-0x00000000059F0000-0x0000000005D44000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4f012061e55957ff824bad7f579152bc
SHA1 b43ffb45d7bd0f095c2a341aed75a499e9bea0cf
SHA256 d0c3a9b0bbcc05514ac16058c1e0051f495eb988d7a387ef21b50aef9b42af92
SHA512 523e9491837a55674b173b80aa8fb4b671781134352311ec7cded49de8cabaf9826f03a83d8aaaf76c16159f41ec4bb7be792562bad9c359f0c0d84ae960dba9

memory/3088-204-0x0000000070460000-0x00000000707B4000-memory.dmp

memory/3088-203-0x00000000702D0000-0x000000007031C000-memory.dmp

memory/4148-215-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1772-224-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2044-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1772-229-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4148-230-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2044-232-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4148-231-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4148-233-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2044-236-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4148-235-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4148-238-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4148-239-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4148-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4148-243-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4148-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4148-247-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4148-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4148-251-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 10:43

Reported

2024-05-16 10:46

Platform

win11-20240419-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-631 = "Tokyo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-502 = "Nepal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2392 = "Aleutian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-232 = "Hawaiian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2412 = "Marquesas Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1471 = "Magadan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-571 = "China Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-261 = "GMT Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3472 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3472 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3472 wrote to memory of 5116 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\system32\cmd.exe
PID 4132 wrote to memory of 5044 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\system32\cmd.exe
PID 5044 wrote to memory of 1984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5044 wrote to memory of 1984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 2400 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4132 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\rss\csrss.exe
PID 4132 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\rss\csrss.exe
PID 4132 wrote to memory of 4772 N/A C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe C:\Windows\rss\csrss.exe
PID 4772 wrote to memory of 2596 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 2596 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 2596 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 2832 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 2832 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 2832 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 4780 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 4780 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 4780 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4772 wrote to memory of 2908 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4772 wrote to memory of 2908 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 652 wrote to memory of 2784 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 652 wrote to memory of 2784 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 652 wrote to memory of 2784 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2784 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2784 wrote to memory of 1504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe

"C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe

"C:\Users\Admin\AppData\Local\Temp\8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 041de9a2-6810-439b-8336-f50aecc9a62f.uuid.myfastupdate.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server15.myfastupdate.org udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun1.l.google.com udp
BG 185.82.216.111:443 server15.myfastupdate.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.111:443 server15.myfastupdate.org tcp
BG 185.82.216.111:443 server15.myfastupdate.org tcp

Files

memory/3472-1-0x0000000002A20000-0x0000000002E1D000-memory.dmp

memory/3472-2-0x0000000002E20000-0x000000000370B000-memory.dmp

memory/3472-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/5116-4-0x000000007418E000-0x000000007418F000-memory.dmp

memory/5116-5-0x0000000002830000-0x0000000002866000-memory.dmp

memory/5116-6-0x0000000074180000-0x0000000074931000-memory.dmp

memory/5116-7-0x0000000004F30000-0x000000000555A000-memory.dmp

memory/5116-8-0x0000000074180000-0x0000000074931000-memory.dmp

memory/5116-9-0x0000000004EF0000-0x0000000004F12000-memory.dmp

memory/5116-10-0x00000000056D0000-0x0000000005736000-memory.dmp

memory/5116-11-0x0000000005740000-0x00000000057A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ktns3du0.pw5.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/5116-20-0x00000000058A0000-0x0000000005BF7000-memory.dmp

memory/5116-21-0x0000000005CA0000-0x0000000005CBE000-memory.dmp

memory/5116-22-0x0000000005D60000-0x0000000005DAC000-memory.dmp

memory/5116-23-0x0000000006230000-0x0000000006276000-memory.dmp

memory/5116-25-0x00000000703F0000-0x000000007043C000-memory.dmp

memory/5116-24-0x00000000070E0000-0x0000000007114000-memory.dmp

memory/5116-26-0x0000000070570000-0x00000000708C7000-memory.dmp

memory/5116-36-0x0000000007120000-0x000000000713E000-memory.dmp

memory/5116-37-0x0000000007140000-0x00000000071E4000-memory.dmp

memory/5116-32-0x0000000074180000-0x0000000074931000-memory.dmp

memory/5116-38-0x0000000074180000-0x0000000074931000-memory.dmp

memory/5116-39-0x00000000078B0000-0x0000000007F2A000-memory.dmp

memory/5116-40-0x0000000007270000-0x000000000728A000-memory.dmp

memory/5116-41-0x00000000072B0000-0x00000000072BA000-memory.dmp

memory/5116-42-0x00000000073C0000-0x0000000007456000-memory.dmp

memory/5116-43-0x00000000072D0000-0x00000000072E1000-memory.dmp

memory/5116-44-0x0000000007320000-0x000000000732E000-memory.dmp

memory/5116-45-0x0000000007330000-0x0000000007345000-memory.dmp

memory/5116-46-0x0000000007380000-0x000000000739A000-memory.dmp

memory/5116-47-0x00000000073A0000-0x00000000073A8000-memory.dmp

memory/5116-50-0x0000000074180000-0x0000000074931000-memory.dmp

memory/4132-52-0x0000000002A20000-0x0000000002E1A000-memory.dmp

memory/4476-61-0x0000000005970000-0x0000000005CC7000-memory.dmp

memory/4476-62-0x00000000703F0000-0x000000007043C000-memory.dmp

memory/4476-63-0x0000000070600000-0x0000000070957000-memory.dmp

memory/4476-72-0x00000000070F0000-0x0000000007194000-memory.dmp

memory/3472-74-0x0000000002A20000-0x0000000002E1D000-memory.dmp

memory/3472-73-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4476-75-0x0000000007420000-0x0000000007431000-memory.dmp

memory/3472-76-0x0000000002E20000-0x000000000370B000-memory.dmp

memory/4476-77-0x0000000007470000-0x0000000007485000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/2400-89-0x0000000006360000-0x00000000066B7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d7687f235a79890b9d1add17833fd288
SHA1 8abd391aae75514316ecb21b1a673ee2e7fa3f04
SHA256 f6d29140732300876dad7e4dd7823d79fc5cb952c203c61e4ba86fd598e68bd3
SHA512 6977483dc632ac0e3133219cf5d422995d3a2540e6844385b0c3a41966714c210a0c11fcc70293f36ae5a5b873b93e4c0d14f31252b7da802dfbb7acd4101051

memory/2400-91-0x00000000703F0000-0x000000007043C000-memory.dmp

memory/2400-92-0x0000000070590000-0x00000000708E7000-memory.dmp

memory/2192-107-0x00000000056C0000-0x0000000005A17000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5b214c7ac698cfc9d4cdee76f8db961b
SHA1 d0c8a6edb17e662ce27fb01376686530355ca711
SHA256 1b140aab7da24b03ed1733ef5c103b8c1d5d62b9a424caee91bd511d2e6aab77
SHA512 46531309a2434d5328c88c43f47a7a077bfcdd48b6d9ccc3b7c8eaede9485ffc79b4fed5637dbf9fbae85493863aa69c62fd323c7993da3b7f531fff0d7fb052

memory/2192-112-0x00000000703F0000-0x000000007043C000-memory.dmp

memory/2192-113-0x0000000070620000-0x0000000070977000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 65c9fda7c255881d9deb74f1c5a732e2
SHA1 98eab99d62ab9d0f224ac1b6e505263c59302b5d
SHA256 8d9459dbefdbcc8ba684016669437be04234e8889fb5d41b93ff08288de08c8f
SHA512 b7ab38633999559183103f915c4f436d7fdbcd75de249c7b01886b0b33f10c9954942e23c96868817930cb26e886558db2ded788457d3fbc0b1be0f2e10374ef

memory/4132-128-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6aca311d419b712070a7973aebc4d2c8
SHA1 e24a37d4a70b7ef7aa308f09d320fe458d212586
SHA256 30d5a22e7fa725858cfda0eddfe3b01e6af9f65b9880d2d6c01f123cfda4606b
SHA512 40b827b7b6bccec336b47e3486519856575c9f2f038b9c24850a0cc2af0d2d8a47dcad7fcbbbd228454f4f07675d69c6ba137bf3a4c12ce1318d898002c87313

memory/2596-139-0x00000000703F0000-0x000000007043C000-memory.dmp

memory/2596-140-0x0000000070570000-0x00000000708C7000-memory.dmp

memory/2832-158-0x0000000005C00000-0x0000000005F57000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 241adab59f94cfff965e7d4cf7b850ef
SHA1 4eaff9e54883e79510434b7fd7f0af35777cd143
SHA256 5bdd3b9287a6d128383221de2abb6d0f5a3422704f4984fe1e3e74f486dad245
SHA512 344cec5fdaa114c7a8b7fa89952d2ee80ed55c71c151ea803c896a58377adbca0e58f8d6cd58b45f64ccab586a4808d29492fd87a36efb5623c858f5404da26e

memory/2832-160-0x00000000065C0000-0x000000000660C000-memory.dmp

memory/2832-161-0x0000000070310000-0x000000007035C000-memory.dmp

memory/2832-162-0x0000000070490000-0x00000000707E7000-memory.dmp

memory/2832-171-0x0000000007300000-0x00000000073A4000-memory.dmp

memory/2832-172-0x0000000007640000-0x0000000007651000-memory.dmp

memory/2832-173-0x0000000005AD0000-0x0000000005AE5000-memory.dmp

memory/4780-175-0x0000000005AF0000-0x0000000005E47000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e1e87c1aaf594d10f9f2101db909136e
SHA1 000df92468b9ed4da4a9448e13caf6c633df1c83
SHA256 47932bcb67391c53c09a371f2a1d25ac116ef36de4a67f9d21abcd2e76d7b76b
SHA512 8adfcc095edd2535383a99f87a57b3d1079c30d252de1eee045fa27669699d3ec301bcddbfe904501e3335f7287be3191d54c5b778c3dbab2cd75cff96a38dae

memory/4780-186-0x0000000070560000-0x00000000708B7000-memory.dmp

memory/4780-185-0x0000000070310000-0x000000007035C000-memory.dmp

memory/4772-198-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4132-204-0x0000000002A20000-0x0000000002E1A000-memory.dmp

memory/4772-207-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/652-211-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3536-214-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/652-215-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3536-219-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4772-218-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4772-222-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4772-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3536-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4772-230-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4772-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4772-238-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4772-242-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4772-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4772-250-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4772-254-0x0000000000400000-0x0000000000D1C000-memory.dmp