Malware Analysis Report

2024-12-08 02:16

Sample ID 240516-pxt1jadf48
Target 1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f
SHA256 1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f
Tags
glupteba dropper execution loader discovery evasion persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f

Threat Level: Known bad

The file 1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f was found to be: Known bad.

Malicious Activity Summary

glupteba dropper execution loader discovery evasion persistence rootkit upx

Glupteba

Glupteba payload

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Manipulates WinMonFS driver.

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Uses Task Scheduler COM API

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 12:42

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 12:42

Reported

2024-05-16 12:45

Platform

win10v2004-20240508-en

Max time kernel

11s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe

"C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3440,i,11266875042087428226,16669718873272757238,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe

"C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
BE 88.221.83.200:443 www.bing.com tcp
US 8.8.8.8:53 200.83.221.88.in-addr.arpa udp

Files

memory/764-1-0x0000000002990000-0x0000000002D97000-memory.dmp

memory/764-2-0x0000000002DA0000-0x000000000368B000-memory.dmp

memory/764-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4600-4-0x0000000074F5E000-0x0000000074F5F000-memory.dmp

memory/4600-5-0x0000000002A00000-0x0000000002A36000-memory.dmp

memory/4600-6-0x0000000005230000-0x0000000005858000-memory.dmp

memory/4600-7-0x0000000074F50000-0x0000000075700000-memory.dmp

memory/4600-8-0x0000000074F50000-0x0000000075700000-memory.dmp

memory/4600-9-0x00000000050A0000-0x00000000050C2000-memory.dmp

memory/4600-10-0x00000000051C0000-0x0000000005226000-memory.dmp

memory/4600-11-0x0000000005860000-0x00000000058C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_j2oqctg1.swc.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4600-21-0x0000000005AD0000-0x0000000005E24000-memory.dmp

memory/4600-22-0x0000000006010000-0x000000000602E000-memory.dmp

memory/4600-23-0x0000000006030000-0x000000000607C000-memory.dmp

memory/4600-24-0x0000000006570000-0x00000000065B4000-memory.dmp

memory/4600-25-0x0000000007320000-0x0000000007396000-memory.dmp

memory/4600-26-0x0000000007A20000-0x000000000809A000-memory.dmp

memory/4600-27-0x00000000073C0000-0x00000000073DA000-memory.dmp

memory/4600-28-0x0000000007560000-0x0000000007592000-memory.dmp

memory/4600-40-0x00000000075A0000-0x00000000075BE000-memory.dmp

memory/4600-30-0x0000000070F90000-0x00000000712E4000-memory.dmp

memory/4600-29-0x0000000070DF0000-0x0000000070E3C000-memory.dmp

memory/4600-42-0x0000000074F50000-0x0000000075700000-memory.dmp

memory/4600-41-0x00000000075C0000-0x0000000007663000-memory.dmp

memory/4600-43-0x00000000076B0000-0x00000000076BA000-memory.dmp

memory/4600-44-0x0000000007780000-0x0000000007816000-memory.dmp

memory/4600-45-0x0000000074F50000-0x0000000075700000-memory.dmp

memory/4600-46-0x00000000076E0000-0x00000000076F1000-memory.dmp

memory/4600-47-0x0000000007720000-0x000000000772E000-memory.dmp

memory/4600-48-0x0000000007730000-0x0000000007744000-memory.dmp

memory/4600-49-0x0000000007820000-0x000000000783A000-memory.dmp

memory/4600-50-0x0000000007760000-0x0000000007768000-memory.dmp

memory/4600-53-0x0000000074F50000-0x0000000075700000-memory.dmp

memory/2296-55-0x0000000002930000-0x0000000002D2B000-memory.dmp

memory/1096-65-0x00000000059C0000-0x0000000005D14000-memory.dmp

memory/1096-66-0x0000000070DF0000-0x0000000070E3C000-memory.dmp

memory/1096-67-0x0000000071570000-0x00000000718C4000-memory.dmp

memory/1096-77-0x00000000071A0000-0x0000000007243000-memory.dmp

memory/1096-78-0x00000000074E0000-0x00000000074F1000-memory.dmp

memory/1096-79-0x0000000007530000-0x0000000007544000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 12:42

Reported

2024-05-16 12:45

Platform

win11-20240426-en

Max time kernel

149s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3062789476-783164490-2318012559-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-442 = "Arabian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1501 = "Turkey Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-302 = "Romance Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2360 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2360 wrote to memory of 776 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\system32\cmd.exe
PID 2008 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\system32\cmd.exe
PID 4348 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4348 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2008 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2008 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\rss\csrss.exe
PID 2008 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\rss\csrss.exe
PID 2008 wrote to memory of 1004 N/A C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe C:\Windows\rss\csrss.exe
PID 1004 wrote to memory of 568 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 568 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 568 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 2912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 2912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 2912 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 428 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 428 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 428 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1004 wrote to memory of 2088 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1004 wrote to memory of 2088 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 388 wrote to memory of 1260 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 388 wrote to memory of 1260 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 388 wrote to memory of 1260 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1260 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1260 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1260 wrote to memory of 2076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe

"C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe

"C:\Users\Admin\AppData\Local\Temp\1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 d3576769-a0aa-46c2-b673-9c44b6ac0847.uuid.datadumpcloud.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server8.datadumpcloud.org udp
US 162.159.135.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun2.l.google.com udp
BG 185.82.216.104:443 server8.datadumpcloud.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.104:443 server8.datadumpcloud.org tcp
BG 185.82.216.104:443 server8.datadumpcloud.org tcp

Files

memory/2360-1-0x0000000002A40000-0x0000000002E39000-memory.dmp

memory/2360-2-0x0000000002E40000-0x000000000372B000-memory.dmp

memory/2360-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/776-4-0x000000007481E000-0x000000007481F000-memory.dmp

memory/776-5-0x0000000003080000-0x00000000030B6000-memory.dmp

memory/776-6-0x0000000005DF0000-0x000000000641A000-memory.dmp

memory/776-7-0x0000000074810000-0x0000000074FC1000-memory.dmp

memory/776-8-0x00000000059E0000-0x0000000005A02000-memory.dmp

memory/776-9-0x0000000005B00000-0x0000000005B66000-memory.dmp

memory/776-10-0x0000000005D20000-0x0000000005D86000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zu1kz40j.a0s.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/776-11-0x0000000074810000-0x0000000074FC1000-memory.dmp

memory/776-20-0x0000000006490000-0x00000000067E7000-memory.dmp

memory/776-21-0x0000000006460000-0x000000000647E000-memory.dmp

memory/776-22-0x00000000068E0000-0x000000000692C000-memory.dmp

memory/776-23-0x0000000006E30000-0x0000000006E76000-memory.dmp

memory/776-25-0x0000000070A80000-0x0000000070ACC000-memory.dmp

memory/776-26-0x0000000074810000-0x0000000074FC1000-memory.dmp

memory/776-24-0x0000000007CD0000-0x0000000007D04000-memory.dmp

memory/776-27-0x0000000070C00000-0x0000000070F57000-memory.dmp

memory/776-37-0x0000000007D30000-0x0000000007DD4000-memory.dmp

memory/776-36-0x0000000007D10000-0x0000000007D2E000-memory.dmp

memory/776-38-0x0000000074810000-0x0000000074FC1000-memory.dmp

memory/776-40-0x0000000007E50000-0x0000000007E6A000-memory.dmp

memory/776-39-0x00000000084A0000-0x0000000008B1A000-memory.dmp

memory/776-41-0x0000000007E90000-0x0000000007E9A000-memory.dmp

memory/776-42-0x0000000007F50000-0x0000000007FE6000-memory.dmp

memory/776-43-0x0000000007ED0000-0x0000000007EE1000-memory.dmp

memory/776-44-0x0000000007F00000-0x0000000007F0E000-memory.dmp

memory/776-45-0x0000000007F10000-0x0000000007F25000-memory.dmp

memory/776-46-0x0000000008010000-0x000000000802A000-memory.dmp

memory/776-47-0x0000000007FF0000-0x0000000007FF8000-memory.dmp

memory/776-50-0x0000000074810000-0x0000000074FC1000-memory.dmp

memory/2008-52-0x0000000002A40000-0x0000000002E3A000-memory.dmp

memory/2304-61-0x0000000005760000-0x0000000005AB7000-memory.dmp

memory/2304-62-0x0000000070A80000-0x0000000070ACC000-memory.dmp

memory/2304-63-0x0000000070C20000-0x0000000070F77000-memory.dmp

memory/2304-72-0x0000000006F10000-0x0000000006FB4000-memory.dmp

memory/2304-73-0x0000000007230000-0x0000000007241000-memory.dmp

memory/2360-74-0x0000000002A40000-0x0000000002E39000-memory.dmp

memory/2304-75-0x0000000007280000-0x0000000007295000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f06da3d54890007a31993b29a429024d
SHA1 33816804ec8d4865749bca6c55b41cfaf315a545
SHA256 b410609fdbea2202239d0abd71fa969f617bce29f9dd09e70da66cf5335d753d
SHA512 b2c3d22496eb829d31c66fcb9151edcf5eecc39a373b2c35c23f4e9c1f9bdf20d429e73546fa9a9279731fe4327b359d0b7a3eb2b2441c29fd84f3752f2c34f3

memory/2360-88-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4472-89-0x0000000070A80000-0x0000000070ACC000-memory.dmp

memory/4472-90-0x0000000070C00000-0x0000000070F57000-memory.dmp

memory/3340-108-0x00000000062F0000-0x0000000006647000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 004b267da6d1e530e60d2ee21de3bc3b
SHA1 d91a3d6c4c1be9f735eb8e8f9aa35decf3e65d78
SHA256 f7e06fe60ad860a702764213662be5939990a7bbcfc3f40f1c34a7e4f9ed1a6a
SHA512 6d976b20deb1858e39a83466fbd0f3f0bb19b14c81d2f241afa87c8240d6af83bbaa5fd04042896bb392d5b4eda7a03443e6747f95642e0579cfece130faf2f8

memory/3340-110-0x0000000070A80000-0x0000000070ACC000-memory.dmp

memory/3340-111-0x0000000070C90000-0x0000000070FE7000-memory.dmp

memory/2360-120-0x0000000002E40000-0x000000000372B000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 c52bd0492d008442b7ccc42e5861162b
SHA1 dfba8a1164e4d4793517eb3fb5b36ebc7fdcc98d
SHA256 1e067e37c46ca2a8e336c04cd08cf07a30042540b535747305994de3794db83f
SHA512 5b5120ea8253b76d90d16b04c81fe035c9430fde2a939aa67fd982c6a7ef22f246a274d79255a3bc0a9acbad1cb0e7ca120bc38c9a555185d7cecbe6ef502d26

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 17a726c5c29f05884c18de31f743eca5
SHA1 f73e37c9df326b20524b0a26f43bb96ff55311ca
SHA256 3bb1d88e173034a879a2c070eb53af6fe3393dd3d17768ee6cb290b8051cac13
SHA512 8d0ad12954a61c587e586596a172f9e0b8a13b1cd526a3a74a4a71879b69e7f18933c1265425dc937cf18ffc795560d967fb4d760df149ca54f24350edca2871

memory/568-137-0x0000000070A80000-0x0000000070ACC000-memory.dmp

memory/568-138-0x0000000070C00000-0x0000000070F57000-memory.dmp

memory/2008-136-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2912-156-0x0000000006240000-0x0000000006597000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 64abe4b9f8c640ddc299c2c42d50f156
SHA1 3ce51f6fee7f05fd0a34e9c7adc0947857668f80
SHA256 ab5d8797e80cbd80ebfff65b31f94bffc69b791ed17ad9d458548089995dcbdd
SHA512 b7c41b360e9b1958566b5080f69dcdc6b2e561c32b090cae40fcc686049c0e822d20e6b29904f8bdadc562348e871c82c101a248cdbd7f33b944b1df88759c2f

memory/2912-158-0x0000000006D40000-0x0000000006D8C000-memory.dmp

memory/2912-159-0x00000000709A0000-0x00000000709EC000-memory.dmp

memory/2912-160-0x0000000070BB0000-0x0000000070F07000-memory.dmp

memory/2912-169-0x0000000007A60000-0x0000000007B04000-memory.dmp

memory/2912-170-0x0000000007D90000-0x0000000007DA1000-memory.dmp

memory/2912-171-0x00000000065C0000-0x00000000065D5000-memory.dmp

memory/428-181-0x0000000005970000-0x0000000005CC7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0fc5cbe4b0abcffdcd7f3e265cfbf0d8
SHA1 3c172268d4be45b021dadd23ee477fd6e4fbe3e5
SHA256 88e6064d810e00c11ce719b56787bbe87f51ab318820c1539a2da6c82d861bef
SHA512 84f32318153dcc978d668abf755757ae08afb37b9165c66ad828a053eee840c7ac27c5acf1d8a45ac0f468900a6ce1199eb4bf79833886248ba8bdceb67c4a73

memory/428-183-0x00000000709A0000-0x00000000709EC000-memory.dmp

memory/428-184-0x0000000070B20000-0x0000000070E77000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1004-201-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2008-206-0x0000000002A40000-0x0000000002E3A000-memory.dmp

memory/388-207-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4140-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/388-212-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1004-214-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4140-216-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1004-218-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1004-221-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4140-224-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1004-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1004-230-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1004-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1004-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1004-242-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1004-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1004-250-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1004-253-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1004-258-0x0000000000400000-0x0000000000D1C000-memory.dmp