Malware Analysis Report

2024-12-08 02:06

Sample ID 240516-ssaymsba69
Target aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f
SHA256 aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f

Threat Level: Known bad

The file aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Checks installed software on the system

Adds Run key to start application

Manipulates WinMonFS driver.

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 15:22

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 15:22

Reported

2024-05-16 15:25

Platform

win10v2004-20240226-en

Max time kernel

152s

Max time network

161s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-602 = "Taipei Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-382 = "South Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-412 = "E. Africa Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-385 = "Namibia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-192 = "Mountain Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-892 = "Morocco Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 648 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 648 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 648 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4184 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4184 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4184 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4184 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\system32\cmd.exe
PID 4184 wrote to memory of 4552 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\system32\cmd.exe
PID 4552 wrote to memory of 5024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4552 wrote to memory of 5024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4184 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4184 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4184 wrote to memory of 4264 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4184 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4184 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4184 wrote to memory of 2952 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4184 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\rss\csrss.exe
PID 4184 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\rss\csrss.exe
PID 4184 wrote to memory of 2368 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\rss\csrss.exe
PID 2368 wrote to memory of 4288 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 4288 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 4288 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 3956 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 3956 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 3956 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 2088 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 2088 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 2088 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2368 wrote to memory of 4796 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2368 wrote to memory of 4796 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3168 wrote to memory of 4132 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3168 wrote to memory of 4132 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3168 wrote to memory of 4132 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4132 wrote to memory of 1072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4132 wrote to memory of 1072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4132 wrote to memory of 1072 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe

"C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe

"C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1424 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 142.53.16.96.in-addr.arpa udp
US 8.8.8.8:53 23fe934f-dc8f-4a99-8297-f9bc2f1e3b9f.uuid.thestatsfiles.ru udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 stun1.l.google.com udp
US 8.8.8.8:53 server1.thestatsfiles.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server1.thestatsfiles.ru tcp
US 74.125.250.129:19302 stun1.l.google.com udp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
BG 185.82.216.96:443 server1.thestatsfiles.ru tcp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.178.10:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 10.178.250.142.in-addr.arpa udp
BG 185.82.216.96:443 server1.thestatsfiles.ru tcp
US 8.8.8.8:53 63.141.182.52.in-addr.arpa udp

Files

memory/648-1-0x0000000002AD0000-0x0000000002ED7000-memory.dmp

memory/648-2-0x0000000002EE0000-0x00000000037CB000-memory.dmp

memory/648-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2028-4-0x0000000074B6E000-0x0000000074B6F000-memory.dmp

memory/648-5-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2028-6-0x0000000003460000-0x0000000003496000-memory.dmp

memory/2028-7-0x0000000074B60000-0x0000000075310000-memory.dmp

memory/2028-8-0x0000000074B60000-0x0000000075310000-memory.dmp

memory/2028-9-0x0000000005BC0000-0x00000000061E8000-memory.dmp

memory/2028-10-0x00000000061F0000-0x0000000006212000-memory.dmp

memory/2028-11-0x0000000006290000-0x00000000062F6000-memory.dmp

memory/2028-12-0x0000000006300000-0x0000000006366000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ebl4n0af.lkf.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2028-22-0x00000000065A0000-0x00000000068F4000-memory.dmp

memory/2028-23-0x00000000057C0000-0x00000000057DE000-memory.dmp

memory/2028-24-0x0000000006BA0000-0x0000000006BEC000-memory.dmp

memory/2028-25-0x0000000006FC0000-0x0000000007004000-memory.dmp

memory/2028-26-0x0000000074B60000-0x0000000075310000-memory.dmp

memory/2028-27-0x0000000007D90000-0x0000000007E06000-memory.dmp

memory/2028-28-0x00000000084F0000-0x0000000008B6A000-memory.dmp

memory/2028-29-0x0000000006AF0000-0x0000000006B0A000-memory.dmp

memory/648-31-0x0000000002AD0000-0x0000000002ED7000-memory.dmp

memory/648-30-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2028-33-0x0000000070A00000-0x0000000070A4C000-memory.dmp

memory/2028-32-0x0000000008090000-0x00000000080C2000-memory.dmp

memory/648-34-0x0000000002EE0000-0x00000000037CB000-memory.dmp

memory/2028-45-0x0000000008070000-0x000000000808E000-memory.dmp

memory/2028-47-0x0000000074B60000-0x0000000075310000-memory.dmp

memory/2028-46-0x00000000080D0000-0x0000000008173000-memory.dmp

memory/2028-35-0x0000000070B80000-0x0000000070ED4000-memory.dmp

memory/2028-48-0x00000000081C0000-0x00000000081CA000-memory.dmp

memory/2028-49-0x0000000008280000-0x0000000008316000-memory.dmp

memory/2028-50-0x00000000081E0000-0x00000000081F1000-memory.dmp

memory/648-51-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2028-52-0x0000000008220000-0x000000000822E000-memory.dmp

memory/2028-53-0x0000000008230000-0x0000000008244000-memory.dmp

memory/2028-54-0x0000000008320000-0x000000000833A000-memory.dmp

memory/2028-55-0x0000000008270000-0x0000000008278000-memory.dmp

memory/2028-58-0x0000000074B60000-0x0000000075310000-memory.dmp

memory/648-59-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4184-61-0x0000000002940000-0x0000000002D48000-memory.dmp

memory/1212-71-0x0000000005560000-0x00000000058B4000-memory.dmp

memory/1212-72-0x0000000005DD0000-0x0000000005E1C000-memory.dmp

memory/1212-73-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/1212-74-0x0000000070C90000-0x0000000070FE4000-memory.dmp

memory/1212-84-0x0000000006DE0000-0x0000000006E83000-memory.dmp

memory/1212-85-0x00000000070D0000-0x00000000070E1000-memory.dmp

memory/1212-86-0x0000000007140000-0x0000000007154000-memory.dmp

memory/4184-89-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/4264-100-0x0000000005A40000-0x0000000005D94000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 b7d1f715f5a621e91c5a27a45cbf23c2
SHA1 ba7a48babbdbd14df5e0f3bf56de465a3f77c522
SHA256 9fdf8033f442434a6880d55bb78b7f427a42bd9f6e0d5f6cadd833bfa63e3ded
SHA512 d7077ac1e8b13d13f6980bd9cb3f51f6b58541018299c0dc91e53b2c6ff151ca4a9e8e1ed0db22daf9f0c614dff4a439d23088ae38b7df75a44d0cdf7c35f047

memory/4264-102-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/4264-103-0x0000000070C80000-0x0000000070FD4000-memory.dmp

memory/2952-119-0x0000000005710000-0x0000000005A64000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 9e8034928db7b6766b8910f6de2e70c1
SHA1 66cfa5d8f3016a38192e88f5343447683595b648
SHA256 2421b903ddd13337674518a3b0df2be8145802ad808a937f8d6497147538624f
SHA512 b5be7196bbb580967c3c6bda7874983ccb5c332686281e19533e1e3d80eda1a335164f11bbecc9fa4cf82171525350e3868d52a7d1e10708b0cdffc98b5b65e1

memory/4184-125-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2952-126-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/2952-127-0x00000000712A0000-0x00000000715F4000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 ff1d79559e6abe3ef9637ad3e5377c5f
SHA1 b0304d4b3bd6cf83525c331dc289fad3e0fab652
SHA256 aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f
SHA512 18464759beea38bd2b2ab353932e6e55ce0f0d6147b81019d472e9d6aec4633f14e476d1437b2f3fa8b9bdc747f590ee5bcf3f77d5df269a8227b1996db02558

memory/4184-141-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4288-153-0x0000000006360000-0x00000000066B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 405e1fb8a3c85c933d6e5782ffc5ecc2
SHA1 8ea247bf9de9c4647516e81baf25d446ca7a0103
SHA256 38646da74322aed285016e5f7a2920674e4a639ce04a8715c0e14dd7fc0ffabf
SHA512 3cb89cab51da112c9d7d3c11ee37e480877072de8cf84e65e1ab2623806d11f70aa6ff0462519f5377e37d81f1c448741ac9940496aad4fa6cf4c0c2e1c1c40c

memory/4288-155-0x0000000006890000-0x00000000068DC000-memory.dmp

memory/4288-156-0x0000000070A60000-0x0000000070AAC000-memory.dmp

memory/4288-157-0x0000000070BE0000-0x0000000070F34000-memory.dmp

memory/4288-167-0x00000000078F0000-0x0000000007993000-memory.dmp

memory/4288-168-0x0000000007C10000-0x0000000007C21000-memory.dmp

memory/4288-169-0x00000000060D0000-0x00000000060E4000-memory.dmp

memory/3956-176-0x0000000006380000-0x00000000066D4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 cc22094f18e1ffc333e803c0ea3c6748
SHA1 fd31a518b27922c1e208b4cfb4d152f5763e1a14
SHA256 6618f2b67357ce58f6a280203412a4608365dff5d5e9c4edf0044aad03d6f9c8
SHA512 c9ec58034e1fc3306cdb204f1284fc5e9facead7ddc0d0ff1d45cddab436c392b434593c2748421c1933872dd00099e076565de9b8949c8d0ce81f0a6ea56816

memory/3956-182-0x0000000006D80000-0x0000000006DCC000-memory.dmp

memory/3956-183-0x0000000070980000-0x00000000709CC000-memory.dmp

memory/3956-184-0x0000000071110000-0x0000000071464000-memory.dmp

memory/3956-194-0x0000000007C80000-0x0000000007D23000-memory.dmp

memory/3956-195-0x0000000007FA0000-0x0000000007FB1000-memory.dmp

memory/2368-196-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3956-197-0x0000000006830000-0x0000000006844000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6ae465528e7f8fa303791b5f88b3fcf1
SHA1 f0b1ac50258ec964c72d6f2bcd62d6863d414374
SHA256 d71c661bc8372a555e96188290f2085a3f2c9dff1327611794448d326de4797c
SHA512 65f9fffa23608673b0f4d0b3e19b1ea40be73c8b95d7f60d8d4bdddea0e11fcd81ee7b47232cbb99a4eae3b6a26264fe52165203a0ca40cd704a777675d01ba9

memory/2088-209-0x0000000070980000-0x00000000709CC000-memory.dmp

memory/2088-210-0x0000000071110000-0x0000000071464000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2368-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3168-231-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2932-234-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2368-233-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3168-236-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2932-238-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2368-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2368-239-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2932-242-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2368-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2932-244-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2368-243-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2368-245-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2368-247-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 15:22

Reported

2024-05-16 15:25

Platform

win11-20240426-en

Max time kernel

150s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-831 = "SA Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2431 = "Cuba Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2511 = "Lord Howe Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1891 = "Russia TZ 3 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-932 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-221 = "Alaskan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-452 = "Caucasus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-222 = "Alaskan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-891 = "Morocco Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1972 = "Belarus Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2891 = "Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1788 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1788 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4060 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4060 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4060 wrote to memory of 2828 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4060 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\system32\cmd.exe
PID 4060 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\system32\cmd.exe
PID 1472 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1472 wrote to memory of 2212 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4060 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4060 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4060 wrote to memory of 2192 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4060 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4060 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4060 wrote to memory of 3624 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4060 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\rss\csrss.exe
PID 4060 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\rss\csrss.exe
PID 4060 wrote to memory of 4164 N/A C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe C:\Windows\rss\csrss.exe
PID 4164 wrote to memory of 412 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 412 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 412 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 5072 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 5072 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 5072 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 3060 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 3060 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 3060 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4164 wrote to memory of 1064 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4164 wrote to memory of 1064 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 240 wrote to memory of 4072 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 240 wrote to memory of 4072 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 240 wrote to memory of 4072 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4072 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4072 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4072 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe

"C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe

"C:\Users\Admin\AppData\Local\Temp\aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 86d81a84-e4d5-4a2c-9f1a-6cc7be358639.uuid.thestatsfiles.ru udp
US 8.8.8.8:53 server9.thestatsfiles.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server9.thestatsfiles.ru tcp
US 74.125.250.129:19302 stun4.l.google.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.96:443 server9.thestatsfiles.ru tcp
BG 185.82.216.96:443 server9.thestatsfiles.ru tcp

Files

memory/1788-1-0x0000000002A40000-0x0000000002E3F000-memory.dmp

memory/1788-2-0x0000000002E40000-0x000000000372B000-memory.dmp

memory/1788-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/228-4-0x0000000074DBE000-0x0000000074DBF000-memory.dmp

memory/228-5-0x0000000002B60000-0x0000000002B96000-memory.dmp

memory/228-6-0x0000000005450000-0x0000000005A7A000-memory.dmp

memory/228-7-0x0000000074DB0000-0x0000000075561000-memory.dmp

memory/228-8-0x0000000005290000-0x00000000052B2000-memory.dmp

memory/228-10-0x0000000005AF0000-0x0000000005B56000-memory.dmp

memory/228-9-0x0000000005A80000-0x0000000005AE6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a2e3z11m.ko1.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/228-19-0x0000000005B60000-0x0000000005EB7000-memory.dmp

memory/228-20-0x0000000074DB0000-0x0000000075561000-memory.dmp

memory/228-21-0x0000000006020000-0x000000000603E000-memory.dmp

memory/228-22-0x00000000060D0000-0x000000000611C000-memory.dmp

memory/228-23-0x0000000006FA0000-0x0000000006FE6000-memory.dmp

memory/228-24-0x0000000007450000-0x0000000007484000-memory.dmp

memory/228-27-0x0000000071210000-0x0000000071567000-memory.dmp

memory/228-26-0x0000000074DB0000-0x0000000075561000-memory.dmp

memory/228-25-0x0000000071020000-0x000000007106C000-memory.dmp

memory/228-36-0x0000000007490000-0x00000000074AE000-memory.dmp

memory/228-37-0x00000000074B0000-0x0000000007554000-memory.dmp

memory/228-38-0x0000000074DB0000-0x0000000075561000-memory.dmp

memory/228-39-0x0000000007C20000-0x000000000829A000-memory.dmp

memory/228-40-0x00000000075E0000-0x00000000075FA000-memory.dmp

memory/228-41-0x0000000007620000-0x000000000762A000-memory.dmp

memory/228-42-0x0000000007730000-0x00000000077C6000-memory.dmp

memory/228-43-0x0000000007640000-0x0000000007651000-memory.dmp

memory/228-44-0x0000000007690000-0x000000000769E000-memory.dmp

memory/228-45-0x00000000076A0000-0x00000000076B5000-memory.dmp

memory/228-46-0x00000000076F0000-0x000000000770A000-memory.dmp

memory/228-47-0x0000000007710000-0x0000000007718000-memory.dmp

memory/228-50-0x0000000074DB0000-0x0000000075561000-memory.dmp

memory/2828-52-0x0000000006370000-0x00000000066C7000-memory.dmp

memory/2828-61-0x0000000071020000-0x000000007106C000-memory.dmp

memory/2828-62-0x0000000071270000-0x00000000715C7000-memory.dmp

memory/2828-71-0x0000000007AC0000-0x0000000007B64000-memory.dmp

memory/2828-72-0x0000000007E10000-0x0000000007E21000-memory.dmp

memory/2828-73-0x0000000007E60000-0x0000000007E75000-memory.dmp

memory/1788-77-0x0000000002A40000-0x0000000002E3F000-memory.dmp

memory/1788-76-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 666e77b03fe8cd5fd572228d7a6027f0
SHA1 9defcefa59858ff4b2c5a403c71e1c6eee4189c0
SHA256 007051482bcdc9621a0e1a6f7d449e65e5e7c9431e77c39ec44b48d863e383c9
SHA512 a7bbdaace6b22f0c2513864ab7febf4fd984b368da3bede368b719e4225f4a0a1529858f4ae49c22f95708bd0833a2ab75770a50e19f2a41e11622eccd41b2c2

memory/2192-88-0x0000000071020000-0x000000007106C000-memory.dmp

memory/2192-89-0x0000000071270000-0x00000000715C7000-memory.dmp

memory/1788-98-0x0000000002E40000-0x000000000372B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 ef8bc47d8558ed86dd3573fa98092774
SHA1 24fb1125f41be1bb7ec616115f5eef84e2840b46
SHA256 f46affc26b48c4881b4075d45a726c6b3c56a7cd9163a3fcd92505f0df979a5a
SHA512 70fe9f75a4fb3ae80903587ff6ac0de67ddb009b5dc618b5004d7ee42ee4b7f9bb89607e03564c7dcc7f155cae49f866580d24b48e67cd14a80e76ac83748995

memory/3624-109-0x0000000071020000-0x000000007106C000-memory.dmp

memory/3624-110-0x0000000071270000-0x00000000715C7000-memory.dmp

memory/4060-119-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 ff1d79559e6abe3ef9637ad3e5377c5f
SHA1 b0304d4b3bd6cf83525c331dc289fad3e0fab652
SHA256 aced0843663e7fb4e1f5011794213d53569aadc5b84d963b7321ddc4839edf3f
SHA512 18464759beea38bd2b2ab353932e6e55ce0f0d6147b81019d472e9d6aec4633f14e476d1437b2f3fa8b9bdc747f590ee5bcf3f77d5df269a8227b1996db02558

memory/412-134-0x0000000005F40000-0x0000000006297000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d52804a9946a47a280e550a80b4c87f5
SHA1 04fa8f7fc447fa2ad1ea0ea282f0149d46e3e209
SHA256 bff37bbc2be1505ee86062c246b5ab061985b18d9ce656766e0012c1ff543de9
SHA512 86ed0d579d812b802f0384346f81d88ecd641967fcf194f33c39b648b121a12f653e0e7363a4c76df934f78532eb3cfa6c0d90383ad91262fb9ff4e16fc36f08

memory/412-136-0x0000000071020000-0x000000007106C000-memory.dmp

memory/412-137-0x00000000711A0000-0x00000000714F7000-memory.dmp

memory/5072-155-0x0000000006010000-0x0000000006367000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 71fad5f8d206403f77c84d6146157429
SHA1 409f978b5b6d7049b17cb583213f147116f2c760
SHA256 258fc0604a05e9ca729278c4db4887ee076267ca6a94b82b2f25c29eba933611
SHA512 1d24f703877f24f5a75c52f3d46983af3801937bf2c2256c3637cf042f596a2cb565332d4438790d504803e27bb33d63ca4d341dd941f87113ec5dffd3627e6f

memory/5072-157-0x00000000069D0000-0x0000000006A1C000-memory.dmp

memory/5072-158-0x0000000070F40000-0x0000000070F8C000-memory.dmp

memory/5072-159-0x00000000710C0000-0x0000000071417000-memory.dmp

memory/5072-168-0x00000000076F0000-0x0000000007794000-memory.dmp

memory/5072-169-0x0000000007A20000-0x0000000007A31000-memory.dmp

memory/5072-171-0x0000000005E80000-0x0000000005E95000-memory.dmp

memory/3060-175-0x0000000005FC0000-0x0000000006317000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 34def07f3a878c25c3d36a817db9ebd1
SHA1 4028242c1d8912fc3b45a6d3a61e9ac64658b792
SHA256 40b7e7bf1f1075ebd46df94c789490a720c8f86ca08d2c444bd67d71d852e8b2
SHA512 27ba057a13c85d4168b10656ea5c01b632f9a647f95c5ae15f1dc03e6b4dd363a3425dc9492685ce0cb9ce7ebdaa43947e1d979cf70fccb64457889686ddc7cb

memory/3060-183-0x0000000070F40000-0x0000000070F8C000-memory.dmp

memory/3060-184-0x0000000071190000-0x00000000714E7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/4060-199-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4164-200-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/240-206-0x0000000000400000-0x00000000008DF000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/380-208-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/240-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4164-212-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/380-214-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4164-217-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4164-220-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/380-222-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4164-224-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4164-228-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4164-232-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/380-234-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4164-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4164-240-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4164-244-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4164-248-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4164-252-0x0000000000400000-0x0000000000D1C000-memory.dmp