Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
16-05-2024 15:23
Static task
static1
Behavioral task
behavioral1
Sample
b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe
Resource
win10v2004-20240508-en
General
-
Target
b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe
-
Size
4.1MB
-
MD5
3aafa11f14ab92b3d3e98784f1adbbc1
-
SHA1
c1015ea32b75c59f6323c46055d3ef0bbaa80f85
-
SHA256
b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd
-
SHA512
13a886db858101fb79fcfacc00b6ce449607b5906ab63d369e5508710d52e6e52f259a825d7a32f47af52834c3df4adde0b02b965f73e22b5ec90621f1ea947d
-
SSDEEP
98304:QvzBhIm6zIE7SIO2RhCG9zRnSMmyRgCXxFQG9c6:mzBhDcIv8bCGbNmyXXxFQGy6
Malware Config
Signatures
-
Glupteba payload 18 IoCs
Processes:
resource yara_rule behavioral2/memory/2976-2-0x0000000002E60000-0x000000000374B000-memory.dmp family_glupteba behavioral2/memory/2976-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2976-86-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2976-88-0x0000000002E60000-0x000000000374B000-memory.dmp family_glupteba behavioral2/memory/1980-123-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-197-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-200-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-202-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-204-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-206-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-208-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-210-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-212-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-214-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-216-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-218-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-220-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3612-222-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid Process 3308 netsh.exe -
Executes dropped EXE 2 IoCs
Processes:
csrss.exeinjector.exepid Process 3612 csrss.exe 1704 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.execsrss.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\S-1-5-21-1696768468-2170909707-4198977321-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exedescription ioc Process File opened (read-only) \??\VBoxMiniRdrDN b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe -
Drops file in Windows directory 2 IoCs
Processes:
b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exedescription ioc Process File opened for modification C:\Windows\rss b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe File created C:\Windows\rss\csrss.exe b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid Process 3356 powershell.exe 4624 powershell.exe 4012 powershell.exe 3768 powershell.exe 1324 powershell.exe 2520 powershell.exe 4708 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid Process 1736 schtasks.exe 4992 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exeb5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-932 = "Coordinated Universal Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeb5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exepowershell.exeb5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid Process 4012 powershell.exe 4012 powershell.exe 2976 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 2976 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 3768 powershell.exe 3768 powershell.exe 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 1324 powershell.exe 1324 powershell.exe 2520 powershell.exe 2520 powershell.exe 4708 powershell.exe 4708 powershell.exe 3356 powershell.exe 3356 powershell.exe 4624 powershell.exe 4624 powershell.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 3612 csrss.exe 3612 csrss.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 3612 csrss.exe 3612 csrss.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe 1704 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
powershell.exeb5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exedescription pid Process Token: SeDebugPrivilege 4012 powershell.exe Token: SeDebugPrivilege 2976 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Token: SeImpersonatePrivilege 2976 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe Token: SeDebugPrivilege 3768 powershell.exe Token: SeDebugPrivilege 1324 powershell.exe Token: SeDebugPrivilege 2520 powershell.exe Token: SeDebugPrivilege 4708 powershell.exe Token: SeDebugPrivilege 3356 powershell.exe Token: SeDebugPrivilege 4624 powershell.exe Token: SeSystemEnvironmentPrivilege 3612 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exeb5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.execmd.execsrss.exedescription pid Process procid_target PID 2976 wrote to memory of 4012 2976 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 81 PID 2976 wrote to memory of 4012 2976 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 81 PID 2976 wrote to memory of 4012 2976 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 81 PID 1980 wrote to memory of 3768 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 87 PID 1980 wrote to memory of 3768 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 87 PID 1980 wrote to memory of 3768 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 87 PID 1980 wrote to memory of 1436 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 89 PID 1980 wrote to memory of 1436 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 89 PID 1436 wrote to memory of 3308 1436 cmd.exe 91 PID 1436 wrote to memory of 3308 1436 cmd.exe 91 PID 1980 wrote to memory of 1324 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 92 PID 1980 wrote to memory of 1324 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 92 PID 1980 wrote to memory of 1324 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 92 PID 1980 wrote to memory of 2520 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 94 PID 1980 wrote to memory of 2520 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 94 PID 1980 wrote to memory of 2520 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 94 PID 1980 wrote to memory of 3612 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 96 PID 1980 wrote to memory of 3612 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 96 PID 1980 wrote to memory of 3612 1980 b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe 96 PID 3612 wrote to memory of 4708 3612 csrss.exe 97 PID 3612 wrote to memory of 4708 3612 csrss.exe 97 PID 3612 wrote to memory of 4708 3612 csrss.exe 97 PID 3612 wrote to memory of 3356 3612 csrss.exe 103 PID 3612 wrote to memory of 3356 3612 csrss.exe 103 PID 3612 wrote to memory of 3356 3612 csrss.exe 103 PID 3612 wrote to memory of 4624 3612 csrss.exe 105 PID 3612 wrote to memory of 4624 3612 csrss.exe 105 PID 3612 wrote to memory of 4624 3612 csrss.exe 105 PID 3612 wrote to memory of 1704 3612 csrss.exe 107 PID 3612 wrote to memory of 1704 3612 csrss.exe 107 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe"C:\Users\Admin\AppData\Local\Temp\b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Users\Admin\AppData\Local\Temp\b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe"C:\Users\Admin\AppData\Local\Temp\b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3308
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1736
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3048
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1704
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4992
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD589493c68fa55892dfa14c39eeaa2a7e9
SHA142339b53d48604e53918be08b342e59814c56b09
SHA2566ce2914315c3886fdec941b62535c9dacc6f29a7f849320f04905b0360fe5ddb
SHA512a15df474e397c90fe55e7df31600a596da55c35aa4fc054a900ac2e519cef8e02eaf8d775409bd5b0236cebd5875a027dc93c4ff24635675bb722060e138a771
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD546501c2c8e284869707aafcf09b7d371
SHA1f1c9733def16d99a1b68b791be0f70e84c8c91be
SHA256df5b7baac8c9800bb1f1a64829e0d2a89a17a38471c594e8d45aea4820972e93
SHA5124a2ae56c57011e00325335d23a9fe981733e11e35290125b72cda31858ced52e5109049436d2f8b3cd7bd5a735b72c4918193c9f986881442624f8960a119451
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5a4b6fd6885fd2d6d40bcb4834853c813
SHA14d16633697bb2afda1bf556e3c94a8f1f6589b64
SHA25690512d26553d02588d5e8cdb7fc37d0cb9c050618f68c3ca3b0753065ac78717
SHA51262b9c59f6bc523c5783f0faf7a01136576b645a63e40324e63398b6a3ef6fa42e68e6bf14f81b45f7449d565a25d9b0523a63c948f1eedd712b813c06fbeb6da
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5b7f3c3f0e067c4b71730d940e1a6880f
SHA107bdd0ff997e8bde0720e47b0ac275eaf897e327
SHA256b93affaa83d0dc2ccb5e7f047459e6cf02dc78aaa0ea7e0056711eaa540f3faa
SHA51272d2deb1b6204dd27cf757e9446c9f3f0fc26013b3edfc8041b127a786d3ee7d5ede209863a799794976ab30193eb353133c4af24d6fcb0e48b50fd5e0dc8c18
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD51501febe01a0f2549de7e07b76eaf6bc
SHA17d4b755bb00b79c6ab3fc0b57aceb3396264b799
SHA256048ba7f985cd76530d069a0b9b115eb3a1086a2dc3f0a3be581a620bb4ffed4b
SHA512a15d369b0da33547e96c4dcd3f8356f485dfbdde724d35bb5213077c3695edddcbee92b5634fedcf94aec52c7722286b15f3a484ed5a83dc202cd1e9b5b0f295
-
Filesize
4.1MB
MD53aafa11f14ab92b3d3e98784f1adbbc1
SHA1c1015ea32b75c59f6323c46055d3ef0bbaa80f85
SHA256b5f6532c96e8d4c5a44d9d2b5f6517704dc2e466bfe374483c43d7dc13f670bd
SHA51213a886db858101fb79fcfacc00b6ce449607b5906ab63d369e5508710d52e6e52f259a825d7a32f47af52834c3df4adde0b02b965f73e22b5ec90621f1ea947d