Malware Analysis Report

2024-12-08 02:08

Sample ID 240516-pv9cfach9t
Target 38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2
SHA256 38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2

Threat Level: Known bad

The file 38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Manipulates WinMonFS driver.

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 12:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 12:40

Reported

2024-05-16 12:42

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-872 = "Pakistan Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-162 = "Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-632 = "Tokyo Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-242 = "Samoa Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2592 = "Tocantins Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4560 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4560 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4560 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\system32\cmd.exe
PID 5004 wrote to memory of 608 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\system32\cmd.exe
PID 608 wrote to memory of 3424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 608 wrote to memory of 3424 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5004 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 780 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5004 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\rss\csrss.exe
PID 5004 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\rss\csrss.exe
PID 5004 wrote to memory of 4476 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\rss\csrss.exe
PID 4476 wrote to memory of 1856 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 1856 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 1856 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 4852 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 4852 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 4852 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 1844 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 1844 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 1844 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4476 wrote to memory of 2556 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4476 wrote to memory of 2556 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2020 wrote to memory of 452 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2020 wrote to memory of 452 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2020 wrote to memory of 452 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 452 wrote to memory of 5104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 452 wrote to memory of 5104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 452 wrote to memory of 5104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe

"C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4008,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe

"C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
NL 23.62.61.170:443 www.bing.com tcp
NL 23.62.61.170:443 www.bing.com tcp
US 8.8.8.8:53 170.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 bf5c02a4-37cb-46df-9e07-a6684c7c4bce.uuid.statsexplorer.org udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 stun.ipfire.org udp
US 8.8.8.8:53 server13.statsexplorer.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
DE 81.3.27.44:3478 stun.ipfire.org udp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 44.27.3.81.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
BG 185.82.216.108:443 server13.statsexplorer.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.108:443 server13.statsexplorer.org tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
BG 185.82.216.108:443 server13.statsexplorer.org tcp

Files

memory/4560-1-0x0000000002920000-0x0000000002D27000-memory.dmp

memory/4560-2-0x0000000002D30000-0x000000000361B000-memory.dmp

memory/4560-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2756-4-0x00000000003E0000-0x000000000044D000-memory.dmp

memory/2756-5-0x0000000002CF0000-0x0000000002D26000-memory.dmp

memory/2756-6-0x00000000057C0000-0x0000000005DE8000-memory.dmp

memory/2756-7-0x0000000005670000-0x0000000005692000-memory.dmp

memory/2756-8-0x0000000005F60000-0x0000000005FC6000-memory.dmp

memory/2756-9-0x0000000005FD0000-0x0000000006036000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vqhrcppl.vt2.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2756-19-0x0000000006040000-0x0000000006394000-memory.dmp

memory/2756-20-0x0000000006620000-0x000000000663E000-memory.dmp

memory/2756-21-0x0000000006650000-0x000000000669C000-memory.dmp

memory/2756-22-0x0000000006B80000-0x0000000006BC4000-memory.dmp

memory/2756-23-0x0000000007740000-0x00000000077B6000-memory.dmp

memory/2756-24-0x0000000008040000-0x00000000086BA000-memory.dmp

memory/2756-25-0x00000000079E0000-0x00000000079FA000-memory.dmp

memory/2756-26-0x0000000007BA0000-0x0000000007BD2000-memory.dmp

memory/2756-27-0x0000000070CE0000-0x0000000070D2C000-memory.dmp

memory/2756-28-0x00000000710E0000-0x0000000071434000-memory.dmp

memory/2756-38-0x0000000007BE0000-0x0000000007BFE000-memory.dmp

memory/2756-39-0x0000000007C00000-0x0000000007CA3000-memory.dmp

memory/2756-40-0x0000000007CF0000-0x0000000007CFA000-memory.dmp

memory/2756-41-0x0000000007DB0000-0x0000000007E46000-memory.dmp

memory/2756-42-0x0000000007D10000-0x0000000007D21000-memory.dmp

memory/2756-43-0x0000000007D50000-0x0000000007D5E000-memory.dmp

memory/2756-44-0x0000000007D60000-0x0000000007D74000-memory.dmp

memory/2756-45-0x0000000007E50000-0x0000000007E6A000-memory.dmp

memory/2756-46-0x0000000007DA0000-0x0000000007DA8000-memory.dmp

memory/2756-49-0x00000000003E0000-0x000000000044D000-memory.dmp

memory/5004-51-0x00000000029B0000-0x0000000002DAF000-memory.dmp

memory/4560-52-0x0000000002920000-0x0000000002D27000-memory.dmp

memory/4560-53-0x0000000002D30000-0x000000000361B000-memory.dmp

memory/844-59-0x0000000005F60000-0x00000000062B4000-memory.dmp

memory/844-64-0x0000000070CE0000-0x0000000070D2C000-memory.dmp

memory/844-65-0x0000000071460000-0x00000000717B4000-memory.dmp

memory/844-75-0x00000000077B0000-0x0000000007853000-memory.dmp

memory/844-76-0x0000000007AC0000-0x0000000007AD1000-memory.dmp

memory/4560-77-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/844-78-0x0000000007B10000-0x0000000007B24000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 dd43a172f8312f7b71f75616bca12015
SHA1 b5376e1227f75aefaf7ba463a52a186d092d36b4
SHA256 9dd7e7bff43caab26c255c20ed1ab92afec20518ca3fef9a0524ad81ef16b4d5
SHA512 5a9bbe8a7ad7311ae3141e1904db9e26347f59cfc595e4fbb4df46fff707f064b7bf8eb657c9bc7c096527312636c675b51b1f006bb27b6a7c919a5db9e7f70e

memory/4932-92-0x0000000070CE0000-0x0000000070D2C000-memory.dmp

memory/4932-93-0x0000000071460000-0x00000000717B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 37436c8145bb509f846315e5bb085329
SHA1 49a33da8d69241439697e3e1889b88bb3b80822f
SHA256 4e442c0d7b3544820efb31031259d27f149b2c9cef158287719f63a8bded5768
SHA512 98d344d66bc0473040b82bc4df9bc713ed557da4623df1c4804a24764dd75e8220d4f8bb7f25907d5dd80526a8f3fccd13005097a9ff46d55534a46beeba860f

memory/780-114-0x0000000070CE0000-0x0000000070D2C000-memory.dmp

memory/780-115-0x0000000071460000-0x00000000717B4000-memory.dmp

memory/5004-125-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 529eb810c50b92db0d4023037472c536
SHA1 6d0139357967ca54649b27d8770b0c8701aff5fd
SHA256 38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2
SHA512 136ee3092386d02d1c8bc24c20a300dd979f3311ad297412569c42677ca7e3c029ca32308ada6ae769511ef346af1a177714c00deb80abf33d0593f5f6f45797

memory/5004-130-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1856-143-0x0000000006140000-0x0000000006494000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 646e17faf9ea33bd969fdb2a0dcc5a84
SHA1 8cc221dec835a00ab5ab30f87db5a5ac169c95e2
SHA256 0a956a4a7944cf3f5def843f38150d05ed5363d2090541e682c45438a9d5f406
SHA512 b80dd3153ea8171a8ad8995f47338af0bebd4624c18c22db1ed56fcf3d2ff6f6c5de7ae159edfdf49daf221fdace42272721f092203f00b7d1d1dbe32392c4f9

memory/1856-145-0x0000000070CE0000-0x0000000070D2C000-memory.dmp

memory/1856-146-0x0000000071440000-0x0000000071794000-memory.dmp

memory/4852-166-0x0000000005F10000-0x0000000006264000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 43c3a34607d36dfe410770497fdb1d08
SHA1 65c25def1dffbd818639cc993c111915ec030010
SHA256 b7e105d5558790efde7cef868ede6ec47a5a10ec85bf7284243f879a9e6f455b
SHA512 7fb0a5a84a8eb6b58893e86949e9f6e80d901a2df7f77bfd8d49a10020b5c5d7d36db819a01dedbc9040975c02a6261bd50c735a3046369f6fba279d08f5ee76

memory/4852-168-0x00000000064C0000-0x000000000650C000-memory.dmp

memory/4852-169-0x0000000070C00000-0x0000000070C4C000-memory.dmp

memory/4852-170-0x0000000070D80000-0x00000000710D4000-memory.dmp

memory/4852-180-0x0000000007600000-0x00000000076A3000-memory.dmp

memory/4852-181-0x0000000007960000-0x0000000007971000-memory.dmp

memory/4852-182-0x0000000005E60000-0x0000000005E74000-memory.dmp

memory/1844-190-0x00000000063D0000-0x0000000006724000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2ab356966c7223ce30c94a4a50b9662f
SHA1 a847299479f69d2f51894db54c0a37146479026b
SHA256 b35a382f12182f2bbfd16d327f68f1f0acbcad194b8a74e846725bab5ac2faaf
SHA512 bcf155bc818dad3ee609fabb4103bbba33496cb0a7ef7a8e11d3cdc50b8ef18796b6755f217f2ee1d457f866087adb5e34bea3653c5fe250a42463d7f15ba43d

memory/1844-195-0x0000000070C00000-0x0000000070C4C000-memory.dmp

memory/1844-196-0x0000000070D90000-0x00000000710E4000-memory.dmp

memory/4476-208-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4476-215-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2020-220-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3644-222-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2020-224-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4476-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3644-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4476-229-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4476-232-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3644-233-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4476-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4476-238-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4476-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4476-244-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4476-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4476-250-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4476-253-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 12:40

Reported

2024-05-16 12:42

Platform

win11-20240426-en

Max time kernel

149s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-361 = "GTB Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-731 = "Fiji Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-131 = "US Eastern Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3524 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 1032 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 232 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 232 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 232 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 232 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\system32\cmd.exe
PID 232 wrote to memory of 1036 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\system32\cmd.exe
PID 1036 wrote to memory of 4748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1036 wrote to memory of 4748 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 232 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 232 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 232 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 232 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 232 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 232 wrote to memory of 236 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 232 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\rss\csrss.exe
PID 232 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\rss\csrss.exe
PID 232 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe C:\Windows\rss\csrss.exe
PID 2744 wrote to memory of 3504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2744 wrote to memory of 3504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2744 wrote to memory of 3504 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2744 wrote to memory of 4948 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2744 wrote to memory of 4948 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2744 wrote to memory of 4948 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2744 wrote to memory of 1772 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2744 wrote to memory of 1772 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2744 wrote to memory of 1772 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2744 wrote to memory of 360 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2744 wrote to memory of 360 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4640 wrote to memory of 556 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4640 wrote to memory of 556 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4640 wrote to memory of 556 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 556 wrote to memory of 3012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 556 wrote to memory of 3012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 556 wrote to memory of 3012 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe

"C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe

"C:\Users\Admin\AppData\Local\Temp\38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 16bccc41-7041-4a82-a5be-34aa6d40feef.uuid.statsexplorer.org udp
US 8.8.8.8:53 server14.statsexplorer.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.133.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun1.l.google.com udp
BG 185.82.216.108:443 server14.statsexplorer.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
BG 185.82.216.108:443 server14.statsexplorer.org tcp
NL 52.111.243.30:443 tcp
BG 185.82.216.108:443 server14.statsexplorer.org tcp
BG 185.82.216.108:443 server14.statsexplorer.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/3524-1-0x0000000002A20000-0x0000000002E23000-memory.dmp

memory/3524-2-0x0000000002E30000-0x000000000371B000-memory.dmp

memory/3524-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1032-4-0x0000000073F2E000-0x0000000073F2F000-memory.dmp

memory/1032-5-0x00000000034C0000-0x00000000034F6000-memory.dmp

memory/1032-7-0x0000000005B50000-0x000000000617A000-memory.dmp

memory/1032-6-0x0000000073F20000-0x00000000746D1000-memory.dmp

memory/1032-8-0x0000000073F20000-0x00000000746D1000-memory.dmp

memory/1032-9-0x00000000061D0000-0x00000000061F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z5t3z0b4.ohd.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1032-11-0x00000000063E0000-0x0000000006446000-memory.dmp

memory/1032-20-0x0000000006450000-0x00000000067A7000-memory.dmp

memory/1032-10-0x0000000006370000-0x00000000063D6000-memory.dmp

memory/1032-21-0x0000000006940000-0x000000000695E000-memory.dmp

memory/1032-22-0x0000000006980000-0x00000000069CC000-memory.dmp

memory/1032-23-0x0000000007AC0000-0x0000000007B06000-memory.dmp

memory/1032-37-0x0000000007DD0000-0x0000000007E74000-memory.dmp

memory/1032-36-0x0000000073F20000-0x00000000746D1000-memory.dmp

memory/1032-35-0x0000000007DB0000-0x0000000007DCE000-memory.dmp

memory/1032-38-0x0000000073F20000-0x00000000746D1000-memory.dmp

memory/1032-26-0x0000000070310000-0x0000000070667000-memory.dmp

memory/1032-24-0x0000000007D50000-0x0000000007D84000-memory.dmp

memory/1032-25-0x0000000070190000-0x00000000701DC000-memory.dmp

memory/1032-41-0x0000000007F40000-0x0000000007F4A000-memory.dmp

memory/1032-40-0x0000000007F00000-0x0000000007F1A000-memory.dmp

memory/1032-39-0x0000000008540000-0x0000000008BBA000-memory.dmp

memory/1032-42-0x0000000008050000-0x00000000080E6000-memory.dmp

memory/1032-43-0x0000000007F60000-0x0000000007F71000-memory.dmp

memory/1032-45-0x0000000007FC0000-0x0000000007FD5000-memory.dmp

memory/1032-44-0x0000000007FB0000-0x0000000007FBE000-memory.dmp

memory/1032-46-0x0000000008010000-0x000000000802A000-memory.dmp

memory/1032-47-0x0000000008030000-0x0000000008038000-memory.dmp

memory/1032-50-0x0000000073F20000-0x00000000746D1000-memory.dmp

memory/232-52-0x0000000002A30000-0x0000000002E37000-memory.dmp

memory/2100-71-0x0000000007570000-0x0000000007614000-memory.dmp

memory/2100-62-0x0000000070310000-0x0000000070667000-memory.dmp

memory/2100-61-0x0000000070190000-0x00000000701DC000-memory.dmp

memory/2100-72-0x00000000078A0000-0x00000000078B1000-memory.dmp

memory/2100-73-0x00000000078F0000-0x0000000007905000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/3060-85-0x0000000005550000-0x00000000058A7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 911162a0d2d76ec1ad74b26a901fbb52
SHA1 5d1123ba301ba65e3f5e9a180ea7932ee02714f9
SHA256 3578db8a5aaac07031a16079387410778eaf5f0bd297a2625151a40fdaa0f382
SHA512 1cf91c9c00feb63690d994d671f27205be99b75c1549230e9ca3209c4bb1a701f02553e396ad82a250af23b390d35864a4dcdc39525ff81d1cf12fc13df225fd

memory/3060-88-0x0000000070400000-0x0000000070757000-memory.dmp

memory/3060-87-0x0000000070190000-0x00000000701DC000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9950750df60c856dccd797fbb07d6fbc
SHA1 f3dd4b22343e03c1fbd7bfef133298ff7591b197
SHA256 4f74f7827f8a2e36abb6a8a8b51a1a469fa6b1a0f89aa6a16b1fd7b6031acdc5
SHA512 dbe0ea143a83146ea5c9d76e582c0fb66fa4b7d05cb03977256ddd858976564802e6b848952fd178aa9ab0b819d58cd7f4dafd17613cc3f94ae0293f3e715f56

memory/236-106-0x0000000005660000-0x00000000059B7000-memory.dmp

memory/236-109-0x0000000070330000-0x0000000070687000-memory.dmp

memory/236-108-0x0000000070190000-0x00000000701DC000-memory.dmp

memory/3524-118-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3524-120-0x0000000002E30000-0x000000000371B000-memory.dmp

memory/3524-119-0x0000000002A20000-0x0000000002E23000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 529eb810c50b92db0d4023037472c536
SHA1 6d0139357967ca54649b27d8770b0c8701aff5fd
SHA256 38c3513c60b6da1156c8d641fa87da2e4c834176096bd70a0fb697088ac9bdd2
SHA512 136ee3092386d02d1c8bc24c20a300dd979f3311ad297412569c42677ca7e3c029ca32308ada6ae769511ef346af1a177714c00deb80abf33d0593f5f6f45797

memory/232-125-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3504-136-0x0000000006310000-0x0000000006667000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 45bc89254c047990154ecb9b0dd00084
SHA1 4fec6c7cad50ce2bb858b8bcf1d1bb1b54d0a465
SHA256 b96be396c465de36d31ce5a058ade79b0c7fe8f0c396b99db46680e37b71c4c5
SHA512 318fdabf537927d20b81786ee5692a28f3f0b58a55b11eb33318f3bc9d725af0eff1561950b1865d5d0710211cc5cf9d38dd03b854f6ca35751a69879bcd72ba

memory/3504-139-0x0000000070380000-0x00000000706D7000-memory.dmp

memory/3504-138-0x0000000070190000-0x00000000701DC000-memory.dmp

memory/4948-157-0x0000000005390000-0x00000000056E7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5d9c0a87a4434440e0a1e18f88c7c67d
SHA1 f50738e62bc5aa1c55eadfacfb4e75a9d4c3f9db
SHA256 a04b0786a08904509b8f126f74fabbab4c37c7159b9dc7b3a038fb175210fecc
SHA512 2dab680171fa7895463e2d0e8630fe4e39101dd289baaee0a0cb13325ef2d06e844b1e66258486c2c8e8e5b15e22207cdac76c206a154960790bf786272a876c

memory/4948-159-0x0000000005FE0000-0x000000000602C000-memory.dmp

memory/4948-160-0x00000000700B0000-0x00000000700FC000-memory.dmp

memory/4948-170-0x0000000006CE0000-0x0000000006D84000-memory.dmp

memory/4948-161-0x0000000070250000-0x00000000705A7000-memory.dmp

memory/4948-171-0x0000000007070000-0x0000000007081000-memory.dmp

memory/4948-172-0x0000000005860000-0x0000000005875000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6f78f2ecf9ed743829c72bc8662bcc0f
SHA1 eac82df92e18aa09f96519233ab7db92b5c3e6eb
SHA256 dad828874d3c0bd1fb5836e13241ce487998441964c1882dfac05700271c9f58
SHA512 e536ff42b9c8e97a70df0fab182d79f182c9635544758489fba58b2ceafa7584e0158789874bdcb3e31ff81647a4fe53142dbb8c5d71d307c8e2400ba5da96aa

memory/1772-183-0x00000000700B0000-0x00000000700FC000-memory.dmp

memory/1772-184-0x0000000070250000-0x00000000705A7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2744-200-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4640-205-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3176-208-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4640-207-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2744-210-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3176-211-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2744-213-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2744-216-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3176-217-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2744-219-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2744-222-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2744-225-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2744-228-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2744-231-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2744-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2744-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2744-240-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2744-243-0x0000000000400000-0x0000000000D1C000-memory.dmp