Malware Analysis Report

2024-12-08 02:04

Sample ID 240516-s8vb8acb64
Target fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a
SHA256 fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a

Threat Level: Known bad

The file fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Checks installed software on the system

Adds Run key to start application

Manipulates WinMonFS driver.

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Command and Scripting Interpreter: PowerShell

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 15:48

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 15:48

Reported

2024-05-16 15:50

Platform

win11-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2551177587-3778486488-1329702901-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-911 = "Mauritius Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-681 = "E. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-241 = "Samoa Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1021 = "Bangladesh Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-732 = "Fiji Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-202 = "US Mountain Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 484 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 484 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 484 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3884 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3884 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3884 wrote to memory of 3268 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3884 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\system32\cmd.exe
PID 3884 wrote to memory of 3244 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\system32\cmd.exe
PID 3244 wrote to memory of 1340 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3244 wrote to memory of 1340 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3884 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3884 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3884 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3884 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3884 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3884 wrote to memory of 2064 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3884 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\rss\csrss.exe
PID 3884 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\rss\csrss.exe
PID 3884 wrote to memory of 660 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\rss\csrss.exe
PID 660 wrote to memory of 1492 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 660 wrote to memory of 1492 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 660 wrote to memory of 1492 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 660 wrote to memory of 244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 660 wrote to memory of 244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 660 wrote to memory of 244 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 660 wrote to memory of 3056 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 660 wrote to memory of 3056 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 660 wrote to memory of 3056 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 660 wrote to memory of 1540 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 660 wrote to memory of 1540 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3756 wrote to memory of 5108 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3756 wrote to memory of 5108 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3756 wrote to memory of 5108 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 5108 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5108 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 5108 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe

"C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe

"C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 6543f95d-6b57-4af0-8849-d15983e602fc.uuid.dumperstats.org udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 server8.dumperstats.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 3.33.249.248:3478 stun.sipgate.net udp
US 162.159.135.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server8.dumperstats.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
BG 185.82.216.111:443 server8.dumperstats.org tcp
BG 185.82.216.111:443 server8.dumperstats.org tcp
BG 185.82.216.111:443 server8.dumperstats.org tcp

Files

memory/484-1-0x0000000002AB0000-0x0000000002EAB000-memory.dmp

memory/484-2-0x0000000002EB0000-0x000000000379B000-memory.dmp

memory/484-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2056-4-0x00000000744CE000-0x00000000744CF000-memory.dmp

memory/2056-5-0x0000000003100000-0x0000000003136000-memory.dmp

memory/2056-6-0x0000000005F10000-0x000000000653A000-memory.dmp

memory/2056-7-0x00000000744C0000-0x0000000074C71000-memory.dmp

memory/2056-8-0x0000000005BA0000-0x0000000005BC2000-memory.dmp

memory/2056-10-0x0000000005DB0000-0x0000000005E16000-memory.dmp

memory/2056-9-0x0000000005D40000-0x0000000005DA6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mrnk1wco.k2i.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2056-11-0x00000000744C0000-0x0000000074C71000-memory.dmp

memory/2056-20-0x0000000006540000-0x0000000006897000-memory.dmp

memory/2056-21-0x0000000006920000-0x000000000693E000-memory.dmp

memory/2056-22-0x00000000069C0000-0x0000000006A0C000-memory.dmp

memory/2056-23-0x0000000006ED0000-0x0000000006F16000-memory.dmp

memory/2056-27-0x00000000744C0000-0x0000000074C71000-memory.dmp

memory/2056-26-0x0000000070940000-0x0000000070C97000-memory.dmp

memory/2056-37-0x0000000007DB0000-0x0000000007E54000-memory.dmp

memory/2056-36-0x0000000007D90000-0x0000000007DAE000-memory.dmp

memory/2056-25-0x0000000070730000-0x000000007077C000-memory.dmp

memory/2056-24-0x0000000007D50000-0x0000000007D84000-memory.dmp

memory/2056-38-0x00000000744C0000-0x0000000074C71000-memory.dmp

memory/2056-40-0x0000000007ED0000-0x0000000007EEA000-memory.dmp

memory/2056-39-0x0000000008520000-0x0000000008B9A000-memory.dmp

memory/2056-41-0x0000000007F10000-0x0000000007F1A000-memory.dmp

memory/2056-42-0x0000000008020000-0x00000000080B6000-memory.dmp

memory/2056-43-0x0000000007F40000-0x0000000007F51000-memory.dmp

memory/2056-44-0x0000000007F80000-0x0000000007F8E000-memory.dmp

memory/2056-45-0x0000000007F90000-0x0000000007FA5000-memory.dmp

memory/2056-46-0x0000000007FE0000-0x0000000007FFA000-memory.dmp

memory/2056-47-0x0000000008000000-0x0000000008008000-memory.dmp

memory/2056-50-0x00000000744C0000-0x0000000074C71000-memory.dmp

memory/3884-52-0x0000000002A20000-0x0000000002E1E000-memory.dmp

memory/3268-61-0x00000000063E0000-0x0000000006737000-memory.dmp

memory/3268-62-0x0000000070730000-0x000000007077C000-memory.dmp

memory/3268-63-0x00000000708D0000-0x0000000070C27000-memory.dmp

memory/3268-72-0x0000000007B50000-0x0000000007BF4000-memory.dmp

memory/3268-73-0x0000000007E70000-0x0000000007E81000-memory.dmp

memory/3268-74-0x0000000007EC0000-0x0000000007ED5000-memory.dmp

memory/484-77-0x0000000002AB0000-0x0000000002EAB000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/2764-87-0x0000000005580000-0x00000000058D7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c173357b40fab77550e260a1f252e31b
SHA1 d885e83c7fd0319b38c524cca05dc8fa8b5eaba0
SHA256 a60cedefb0bb2d4073590cda4a71cd31ca134602e95edf61817742657641268a
SHA512 273c60f32b61a70c428a244b2798933817439a46297f6c1d96c57a1b6bfc3b638173ce405a5341481f5ed87631525879d5a8c59150934b712490262a439ee11c

memory/2764-89-0x0000000070730000-0x000000007077C000-memory.dmp

memory/2764-90-0x0000000070980000-0x0000000070CD7000-memory.dmp

memory/484-101-0x0000000002EB0000-0x000000000379B000-memory.dmp

memory/484-100-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 54f0013932f2d50c990524df2a417656
SHA1 183b2d073d800859a67b2a732ff0bf5d56913542
SHA256 7212b2d62576d78e5f84d43dcd2442d8b33b0b8f865ff222ccce2fd2aa2c5b7b
SHA512 2c836cbd9ccbbb1c3d86ca65d20464b047c62eebfc2002f2797a0aa41e9160a8a92137b47483acfa0784267aaaf87970594a7c700f65fc52fd6622f25d6d8987

memory/2064-111-0x0000000070730000-0x000000007077C000-memory.dmp

memory/2064-112-0x0000000070980000-0x0000000070CD7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 339bb9d7208d1699292e306c5a20fcae
SHA1 4f1e11232a33470b94143a8f4a9f19620db80a7e
SHA256 fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a
SHA512 1591204123b2f1d96bedb8975e525e7a2f027da9871b0e24cb5f4b497218b56e86918240cd04591bb89ac0f4d4419007e957c7b83bfb625e9056a42853bdfd9d

memory/1492-135-0x0000000005850000-0x0000000005BA7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2cff98c8cbe76fbc4e67653948686a52
SHA1 2ba38ae43b0a4c22814910f878ca31ec35f411d4
SHA256 a0891b4e206bd589a684fdd007f1913be2cf58b5a76d6ce23853bbe67f2f04f0
SHA512 7389c092eb123e0df58b3a53ca5195daf44211f1a66461ee0b893d09eb4c5e2f411619ea3fd9b3dde66fe786e54b08040aa6e6c5d63557de5db6117d21daafd6

memory/1492-137-0x0000000070730000-0x000000007077C000-memory.dmp

memory/1492-138-0x0000000070960000-0x0000000070CB7000-memory.dmp

memory/3884-148-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/244-157-0x00000000062B0000-0x0000000006607000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 dec0a450cc2604179955c62edc9e2b3e
SHA1 b121c0502c8b6b1cf2e156c0a940fed00ebfd62d
SHA256 fa3e983b3204423777d8f03c8528921550987183c036bc72a61f1778f16da85b
SHA512 71fed2773b849f83c7b04063ac9faf6c65ab4cd1cd15c85309f03c85ee664df11b3b40852401e42f7da7927ad9eadc79b20de61e661e9014a3f6c2b4bc5c7131

memory/244-159-0x00000000068B0000-0x00000000068FC000-memory.dmp

memory/244-160-0x0000000070650000-0x000000007069C000-memory.dmp

memory/244-161-0x0000000070860000-0x0000000070BB7000-memory.dmp

memory/244-170-0x0000000007A70000-0x0000000007B14000-memory.dmp

memory/244-171-0x0000000007DF0000-0x0000000007E01000-memory.dmp

memory/244-172-0x0000000006200000-0x0000000006215000-memory.dmp

memory/3056-182-0x0000000006480000-0x00000000067D7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5b02baaabe0ecffd9edebbf1f9bf4219
SHA1 43632fd5f541d2e87d4b0259606573d84f937e64
SHA256 b4c0a0d0b54468daa58de64135128cf2efb2c1988868c6c4cc199a6a4d7f7207
SHA512 adb950347cc7774871518082d6e019a8e14cdff504e19b0b13a229d740334eaa6398ddc95bab25bb8d5687b63255e379feef60f7a77cea88017bcd0d5c20718e

memory/3056-184-0x0000000070650000-0x000000007069C000-memory.dmp

memory/3056-185-0x00000000707D0000-0x0000000070B27000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/660-201-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3884-204-0x0000000002A20000-0x0000000002E1E000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3756-209-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4540-213-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3756-212-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/660-214-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4540-218-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/660-217-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/660-221-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4540-226-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/660-225-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/660-230-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/660-233-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/660-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/660-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/660-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/660-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/660-253-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/660-258-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 15:48

Reported

2024-05-16 15:50

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-182 = "Mountain Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-572 = "China Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2872 = "Magallanes Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-251 = "Dateline Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3720 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3720 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3720 wrote to memory of 3884 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4224 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4224 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4224 wrote to memory of 844 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4224 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\system32\cmd.exe
PID 4224 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\system32\cmd.exe
PID 4604 wrote to memory of 3212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4604 wrote to memory of 3212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4224 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\system32\svchost.exe
PID 4224 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\system32\svchost.exe
PID 4224 wrote to memory of 884 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\system32\svchost.exe
PID 4224 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4224 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4224 wrote to memory of 2596 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4224 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\rss\csrss.exe
PID 4224 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\rss\csrss.exe
PID 4224 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe C:\Windows\rss\csrss.exe
PID 3112 wrote to memory of 3156 N/A C:\Windows\rss\csrss.exe C:\Windows\System32\sihclient.exe
PID 3112 wrote to memory of 3156 N/A C:\Windows\rss\csrss.exe C:\Windows\System32\sihclient.exe
PID 3112 wrote to memory of 3156 N/A C:\Windows\rss\csrss.exe C:\Windows\System32\sihclient.exe
PID 3112 wrote to memory of 4968 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3112 wrote to memory of 4968 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3112 wrote to memory of 4968 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3112 wrote to memory of 1752 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3112 wrote to memory of 1752 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3112 wrote to memory of 1752 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3112 wrote to memory of 2276 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3112 wrote to memory of 2276 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1652 wrote to memory of 3988 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 3988 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1652 wrote to memory of 3988 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3988 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3988 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3988 wrote to memory of 2896 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe

"C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe

"C:\Users\Admin\AppData\Local\Temp\fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

C:\Windows\System32\sihclient.exe

C:\Windows\System32\sihclient.exe /cv LZRhF1UUQkuu0Bw7dJSz3g.0.2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.114:443 www.bing.com tcp
US 8.8.8.8:53 114.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 a7c8a605-28aa-4b28-8f38-455103c0dbe7.uuid.dumperstats.org udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 8.8.8.8:53 server9.dumperstats.org udp
US 162.159.129.233:443 cdn.discordapp.com tcp
BG 185.82.216.111:443 server9.dumperstats.org tcp
US 15.197.250.192:3478 stun.sipgate.net udp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 111.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 192.250.197.15.in-addr.arpa udp
US 8.8.8.8:53 233.129.159.162.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
BG 185.82.216.111:443 server9.dumperstats.org tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BG 185.82.216.111:443 server9.dumperstats.org tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BG 185.82.216.111:443 server9.dumperstats.org tcp
N/A 127.0.0.1:31465 tcp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/3720-1-0x00000000029F0000-0x0000000002DF4000-memory.dmp

memory/3720-2-0x0000000002E00000-0x00000000036EB000-memory.dmp

memory/3720-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3884-4-0x000000007413E000-0x000000007413F000-memory.dmp

memory/3884-5-0x00000000030B0000-0x00000000030E6000-memory.dmp

memory/3884-7-0x0000000074130000-0x00000000748E0000-memory.dmp

memory/3884-6-0x0000000005C80000-0x00000000062A8000-memory.dmp

memory/3884-10-0x0000000006320000-0x0000000006386000-memory.dmp

memory/3884-9-0x0000000074130000-0x00000000748E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e35k0lmn.swq.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3884-11-0x0000000006390000-0x00000000063F6000-memory.dmp

memory/3884-21-0x0000000006400000-0x0000000006754000-memory.dmp

memory/3884-8-0x0000000005B40000-0x0000000005B62000-memory.dmp

memory/3884-22-0x00000000069F0000-0x0000000006A0E000-memory.dmp

memory/3884-23-0x0000000006A30000-0x0000000006A7C000-memory.dmp

memory/3884-24-0x0000000006F60000-0x0000000006FA4000-memory.dmp

memory/3884-25-0x0000000007D10000-0x0000000007D86000-memory.dmp

memory/3884-27-0x0000000007DB0000-0x0000000007DCA000-memory.dmp

memory/3884-26-0x0000000008410000-0x0000000008A8A000-memory.dmp

memory/3884-29-0x000000006FFD0000-0x000000007001C000-memory.dmp

memory/3884-42-0x0000000007FD0000-0x0000000008073000-memory.dmp

memory/3884-41-0x0000000007FB0000-0x0000000007FCE000-memory.dmp

memory/3884-31-0x0000000074130000-0x00000000748E0000-memory.dmp

memory/3884-43-0x0000000074130000-0x00000000748E0000-memory.dmp

memory/3884-44-0x00000000080C0000-0x00000000080CA000-memory.dmp

memory/3884-30-0x0000000070150000-0x00000000704A4000-memory.dmp

memory/3884-28-0x0000000007F70000-0x0000000007FA2000-memory.dmp

memory/3884-45-0x00000000081D0000-0x0000000008266000-memory.dmp

memory/3884-46-0x00000000080D0000-0x00000000080E1000-memory.dmp

memory/3884-48-0x0000000008130000-0x0000000008144000-memory.dmp

memory/3884-49-0x0000000008170000-0x000000000818A000-memory.dmp

memory/3884-50-0x0000000008160000-0x0000000008168000-memory.dmp

memory/3884-47-0x0000000008110000-0x000000000811E000-memory.dmp

memory/3884-53-0x0000000074130000-0x00000000748E0000-memory.dmp

memory/4224-55-0x0000000002920000-0x0000000002D1F000-memory.dmp

memory/844-65-0x00000000066F0000-0x0000000006A44000-memory.dmp

memory/844-77-0x0000000007920000-0x00000000079C3000-memory.dmp

memory/844-67-0x00000000709D0000-0x0000000070D24000-memory.dmp

memory/844-66-0x000000006FFD0000-0x000000007001C000-memory.dmp

memory/844-78-0x0000000007C50000-0x0000000007C61000-memory.dmp

memory/844-79-0x0000000007CA0000-0x0000000007CB4000-memory.dmp

memory/3720-82-0x00000000029F0000-0x0000000002DF4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 07d7c72f4ed13bc2c789bc2cab91a1a7
SHA1 fabda80afa0e99b5c3de5395f2bb7bc0e1689cb7
SHA256 15f34c6684e5ec7a41451c00dca307da99d3e7d8b2587725ae2c0b7aed6a6f5d
SHA512 dd12cec56968558550eb11c5b24230e29beb828b747875beb0171328548b0bacf22ac479829086d960051849a6f06eeb85dcc21cbbcda8369254e87cece87b71

memory/884-94-0x000000006FFD0000-0x000000007001C000-memory.dmp

memory/884-95-0x0000000070150000-0x00000000704A4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ef05435d79fd03dbbe64c4813259700f
SHA1 af5109c1b01f87320ca3b52982e924f70475cba6
SHA256 3f2f15c475f6e3898115809c0e490c4a66ed9ff280159f9962392e4b6a15f5bc
SHA512 3fa3f571c7b2406f28abc798dfa7ddd333fba3488ce67581663b0a0beb49a0208865a94ce685f1018c588bee558e400525db5a7c0d20eb22d9bfe22443a1dc87

memory/2596-116-0x000000006FFD0000-0x000000007001C000-memory.dmp

memory/2596-117-0x0000000070150000-0x00000000704A4000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 339bb9d7208d1699292e306c5a20fcae
SHA1 4f1e11232a33470b94143a8f4a9f19620db80a7e
SHA256 fe151278c419e7d24f164754725eea19bf94958bc74e80a21286018d7453323a
SHA512 1591204123b2f1d96bedb8975e525e7a2f027da9871b0e24cb5f4b497218b56e86918240cd04591bb89ac0f4d4419007e957c7b83bfb625e9056a42853bdfd9d

memory/4224-133-0x0000000002D20000-0x000000000360B000-memory.dmp

memory/4224-131-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3720-135-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5c3692be5cc0ddd47697006b2632fa19
SHA1 fdfebf0599427bd0131eab26584f408ca81d8574
SHA256 047bac7857d28362a46365ccc69453c9676d82912f5f0373cc34ad9309921944
SHA512 bf20bbf5be8fc54cfa2b18b94cc5bfd3ff5ad5270ed894d314b7ca691388f73e81e3cdf81267e6a5bab94a2728bb05691b6dbdd2feb18e57edca1490c8f4fdf6

memory/3156-145-0x0000000005700000-0x0000000005A54000-memory.dmp

memory/3156-148-0x0000000070770000-0x0000000070AC4000-memory.dmp

memory/3156-147-0x000000006FFD0000-0x000000007001C000-memory.dmp

memory/4968-168-0x0000000005E30000-0x0000000006184000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 a888df7952ea35f17a396a464f3b0f3d
SHA1 4b9cc09f61e5063bb0b0df2df9c32d8b2b5f4f61
SHA256 3289868943de10b69516d79f819c3c3e1258f2ad8f399a5092f0c1f863084d7b
SHA512 72888128c2479881f1eb391d93174a38f2224d4e7f6a7752277a7e279cb57f957829d54058fdb1fc1bfcbe6f56a4ccd1233e39830cb6976ba33a3f7fa379069b

memory/4968-170-0x0000000006780000-0x00000000067CC000-memory.dmp

memory/4968-172-0x0000000070070000-0x00000000703C4000-memory.dmp

memory/4968-182-0x0000000007630000-0x00000000076D3000-memory.dmp

memory/4968-171-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

memory/4968-183-0x0000000007980000-0x0000000007991000-memory.dmp

memory/4968-184-0x00000000061B0000-0x00000000061C4000-memory.dmp

memory/1752-191-0x0000000005810000-0x0000000005B64000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9ab30bebef35ee37957a078797ff2be9
SHA1 6e558b180c3d3411c99524c05212ee9079003325
SHA256 716c93a9cede7029261736d4bdfb6d9f1cdfd4d9154f3ecc812909189ac06262
SHA512 68ce59b72e2183c162159e5032db4f77ebdfeb06ce76ff94650a17be5e74b14594d2e972a8d2dafb51e00ece2521c2bd08ac8211867639078208a9b6d9a9ce72

memory/1752-197-0x000000006FEF0000-0x000000006FF3C000-memory.dmp

memory/1752-198-0x0000000070680000-0x00000000709D4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3112-215-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1652-219-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3340-222-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1652-223-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3112-225-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3340-226-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3112-228-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3112-231-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3340-232-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3112-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3112-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3112-240-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3340-241-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3112-243-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3112-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3112-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3112-252-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3112-255-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3112-258-0x0000000000400000-0x0000000000D1C000-memory.dmp