Malware Analysis Report

2024-12-08 02:03

Sample ID 240516-stb74aah3w
Target 985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9
SHA256 985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9

Threat Level: Known bad

The file 985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Manipulates WinMonFS driver.

Adds Run key to start application

Checks installed software on the system

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Command and Scripting Interpreter: PowerShell

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 15:24

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 15:24

Reported

2024-05-16 15:27

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-272 = "Greenwich Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-162 = "Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2591 = "Tocantins Daylight Time" C:\Windows\windefender.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2841 = "Saratov Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3088 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3088 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3088 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 220 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 220 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 220 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 220 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\system32\cmd.exe
PID 220 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\system32\cmd.exe
PID 4500 wrote to memory of 3376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4500 wrote to memory of 3376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 220 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 220 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 220 wrote to memory of 4412 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 220 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 220 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 220 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 220 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\rss\csrss.exe
PID 220 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\rss\csrss.exe
PID 220 wrote to memory of 2256 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\rss\csrss.exe
PID 2256 wrote to memory of 448 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 448 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 448 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 4268 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 4268 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 4268 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2468 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2468 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 2468 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2256 wrote to memory of 5060 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2256 wrote to memory of 5060 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1168 wrote to memory of 1864 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1168 wrote to memory of 1864 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1168 wrote to memory of 1864 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1864 wrote to memory of 4076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1864 wrote to memory of 4076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1864 wrote to memory of 4076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe

"C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe

"C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.171:443 www.bing.com tcp
US 8.8.8.8:53 171.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 886cf49b-031d-43fe-8192-8f3f1d931e47.uuid.realupdate.ru udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 stun4.l.google.com udp
US 8.8.8.8:53 server14.realupdate.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun4.l.google.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server14.realupdate.ru tcp
US 8.8.8.8:53 carsalessystem.com udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 82.94.21.104.in-addr.arpa udp
BG 185.82.216.96:443 server14.realupdate.ru tcp
US 8.8.8.8:53 58.99.105.20.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
BG 185.82.216.96:443 server14.realupdate.ru tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BG 185.82.216.96:443 server14.realupdate.ru tcp

Files

memory/3088-1-0x0000000002980000-0x0000000002D87000-memory.dmp

memory/3088-2-0x0000000002D90000-0x000000000367B000-memory.dmp

memory/3088-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4980-4-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

memory/4980-5-0x0000000004D90000-0x0000000004DC6000-memory.dmp

memory/4980-6-0x0000000005530000-0x0000000005B58000-memory.dmp

memory/4980-7-0x0000000074C40000-0x00000000753F0000-memory.dmp

memory/4980-8-0x0000000074C40000-0x00000000753F0000-memory.dmp

memory/4980-9-0x0000000005470000-0x0000000005492000-memory.dmp

memory/4980-10-0x0000000005B60000-0x0000000005BC6000-memory.dmp

memory/4980-11-0x0000000005CD0000-0x0000000005D36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_za0hi0zy.lju.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4980-21-0x0000000005D40000-0x0000000006094000-memory.dmp

memory/4980-22-0x0000000006350000-0x000000000636E000-memory.dmp

memory/4980-23-0x0000000006380000-0x00000000063CC000-memory.dmp

memory/4980-24-0x0000000006830000-0x0000000006874000-memory.dmp

memory/4980-25-0x0000000007690000-0x0000000007706000-memory.dmp

memory/4980-26-0x0000000007D90000-0x000000000840A000-memory.dmp

memory/4980-27-0x0000000007710000-0x000000000772A000-memory.dmp

memory/4980-28-0x00000000078D0000-0x0000000007902000-memory.dmp

memory/4980-30-0x0000000071280000-0x00000000715D4000-memory.dmp

memory/4980-29-0x0000000070AE0000-0x0000000070B2C000-memory.dmp

memory/4980-41-0x0000000007910000-0x000000000792E000-memory.dmp

memory/4980-42-0x0000000074C40000-0x00000000753F0000-memory.dmp

memory/4980-36-0x0000000074C40000-0x00000000753F0000-memory.dmp

memory/4980-43-0x0000000007930000-0x00000000079D3000-memory.dmp

memory/4980-44-0x0000000007A20000-0x0000000007A2A000-memory.dmp

memory/4980-45-0x0000000007B30000-0x0000000007BC6000-memory.dmp

memory/4980-46-0x0000000007A30000-0x0000000007A41000-memory.dmp

memory/4980-47-0x0000000007A70000-0x0000000007A7E000-memory.dmp

memory/4980-48-0x0000000007A90000-0x0000000007AA4000-memory.dmp

memory/4980-49-0x0000000007AD0000-0x0000000007AEA000-memory.dmp

memory/4980-50-0x0000000007AC0000-0x0000000007AC8000-memory.dmp

memory/4980-53-0x0000000074C40000-0x00000000753F0000-memory.dmp

memory/3088-54-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3088-55-0x0000000002D90000-0x000000000367B000-memory.dmp

memory/220-57-0x00000000029B0000-0x0000000002DB3000-memory.dmp

memory/220-58-0x0000000002DC0000-0x00000000036AB000-memory.dmp

memory/4484-59-0x00000000058E0000-0x0000000005C34000-memory.dmp

memory/4484-69-0x0000000005ED0000-0x0000000005F1C000-memory.dmp

memory/4484-70-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

memory/4484-71-0x0000000071380000-0x00000000716D4000-memory.dmp

memory/4484-81-0x00000000070C0000-0x0000000007163000-memory.dmp

memory/4484-82-0x00000000073F0000-0x0000000007401000-memory.dmp

memory/4484-83-0x0000000007440000-0x0000000007454000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

memory/4412-96-0x00000000061A0000-0x00000000064F4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6fea11ff63018e31974aa3dfe320e3fe
SHA1 972203314b6aebddf6bb242c710c9cf8b766b872
SHA256 80489f2315739812819b26fc201afa0960dbd170741d0d1ff7124d95bd92bf28
SHA512 9cc6cbb1c6090b38bfe081601cc0bbb02b78d17d023c2a765e4eadd32cb974c5ea7779c037ffbb80aeac5dc53cf678c7c32f86c33c8a3f5ffa0f10d5318e66a8

memory/4412-98-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

memory/4412-99-0x0000000070D60000-0x00000000710B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 07175441c91df9fb1c344817ed8c078d
SHA1 4fac271ca23a0717e7008f71980d762db1f69716
SHA256 357b09a29f1eaaf0904957d37d1d976462d85943af305b7cde37141002585746
SHA512 c7d291f09ddac5d1b2332ad310fa04a40f34c68c8a0f8739f45b247e8bd864e68f5b731a4edf634aeeaebf207476cc9fdaeeda23954079e048f5f7b90f0e558b

memory/4260-120-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

memory/4260-121-0x0000000070D60000-0x00000000710B4000-memory.dmp

memory/220-131-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 e01db36b2072fb0648e7b3d39600676a
SHA1 a031bd80b92659226afe1fbc31335e97e293e8a3
SHA256 985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9
SHA512 3c30090d0bcdc8fe2b9af75840f84a587ff83f64cf569b369a3eeb4fefdb166a4c18926cbc5fc60f62a2fe86242155cbe57c8bc86b4e8f1912802f285925337f

memory/220-136-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/448-148-0x0000000005CE0000-0x0000000006034000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e69a24f9620d1ad7c04a09ee65a86c29
SHA1 805c6d0283711836e917701117a2003850e4e21d
SHA256 05f6ece155a718dd8508e6fb04f4b398365ca3e0ef5ddf18efbc2f27ade7b5a4
SHA512 f6d443d6c22860139379a1abfa2fff4d73606de6614cc910f63410bfa9a1f4de6bea34e8f1675ac552cca244260ccd07d665ba5f99854d624c028f2dac73154c

memory/448-150-0x00000000068E0000-0x000000000692C000-memory.dmp

memory/448-151-0x0000000070B40000-0x0000000070B8C000-memory.dmp

memory/448-152-0x00000000712E0000-0x0000000071634000-memory.dmp

memory/448-162-0x00000000075D0000-0x0000000007673000-memory.dmp

memory/448-163-0x00000000078F0000-0x0000000007901000-memory.dmp

memory/448-164-0x0000000006160000-0x0000000006174000-memory.dmp

memory/4268-175-0x0000000006110000-0x0000000006464000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8513ecf8d1476dd29e3f7dd049325770
SHA1 0732071f6d6ad6018894a521100cb90ca46ac475
SHA256 9fe02ce4e1dd230975a7b6656d082964dd1f477fbd73c9d3f5d7fad7c7427fa4
SHA512 00843ab083aafd3be9090e06de6aeced16fed27e5ee56a5d91476513fdb8a6848970b02356c9577582c11f535cdce7163f4ca31285b8c917363e97a6939bc0ca

memory/4268-177-0x0000000006BA0000-0x0000000006BEC000-memory.dmp

memory/4268-179-0x0000000070BE0000-0x0000000070F34000-memory.dmp

memory/4268-178-0x0000000070A60000-0x0000000070AAC000-memory.dmp

memory/4268-189-0x0000000007870000-0x0000000007913000-memory.dmp

memory/4268-190-0x0000000007C20000-0x0000000007C31000-memory.dmp

memory/4268-191-0x0000000006490000-0x00000000064A4000-memory.dmp

memory/2468-202-0x0000000005C30000-0x0000000005F84000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 f9a7ddb96a216f63c4ac8df9be2306ea
SHA1 d5c17182a6492ffefe429b774448608a25f9af1a
SHA256 2ea06861e55451c4a2ee054044f8c5da8eaf6a3f093b75e4859410b4a2bf658e
SHA512 bbd66c19fbb4d5e01df72f5930b5a4cc27e5ea0ecb9e584a6a64eea974d2f74234538a60d079a32e01fb2ff080f18e2730e04fd5affd96ba5d70d07ebf503d1c

memory/2468-204-0x0000000070A60000-0x0000000070AAC000-memory.dmp

memory/2468-205-0x00000000711F0000-0x0000000071544000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/2256-220-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1168-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3492-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1168-230-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2256-231-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2256-232-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3492-233-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2256-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3492-237-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2256-236-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2256-239-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2256-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3492-243-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2256-242-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2256-244-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2256-247-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2256-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2256-250-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2256-252-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 15:24

Reported

2024-05-16 15:27

Platform

win11-20240426-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1022 = "Bangladesh Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-271 = "Greenwich Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-772 = "Montevideo Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-162 = "Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2371 = "Easter Island Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2632 = "Norfolk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-491 = "India Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-161 = "Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-542 = "Myanmar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4964 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4964 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4964 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\system32\cmd.exe
PID 1940 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\system32\cmd.exe
PID 2016 wrote to memory of 1880 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2016 wrote to memory of 1880 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1940 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1940 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\rss\csrss.exe
PID 1940 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\rss\csrss.exe
PID 1940 wrote to memory of 1332 N/A C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe C:\Windows\rss\csrss.exe
PID 1332 wrote to memory of 2408 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1332 wrote to memory of 2408 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1332 wrote to memory of 2408 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1332 wrote to memory of 1368 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1332 wrote to memory of 1368 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1332 wrote to memory of 1368 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1332 wrote to memory of 356 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1332 wrote to memory of 356 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1332 wrote to memory of 356 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1332 wrote to memory of 2032 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1332 wrote to memory of 2032 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4984 wrote to memory of 2448 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2448 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4984 wrote to memory of 2448 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2448 wrote to memory of 1184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2448 wrote to memory of 1184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2448 wrote to memory of 1184 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe

"C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe

"C:\Users\Admin\AppData\Local\Temp\985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 c569a2e2-9e7f-4017-ab64-d55e69baab8c.uuid.realupdate.ru udp
US 8.8.8.8:53 server6.realupdate.ru udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.129.233:443 cdn.discordapp.com tcp
DE 81.3.27.44:3478 stun.ipfire.org udp
BG 185.82.216.96:443 server6.realupdate.ru tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 44.27.3.81.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
BG 185.82.216.96:443 server6.realupdate.ru tcp
BG 185.82.216.96:443 server6.realupdate.ru tcp
N/A 127.0.0.1:31465 tcp

Files

memory/4964-1-0x0000000002A20000-0x0000000002E28000-memory.dmp

memory/4964-2-0x0000000002E30000-0x000000000371B000-memory.dmp

memory/4964-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/916-4-0x000000007441E000-0x000000007441F000-memory.dmp

memory/916-5-0x00000000027A0000-0x00000000027D6000-memory.dmp

memory/916-6-0x0000000004EE0000-0x000000000550A000-memory.dmp

memory/916-7-0x0000000074410000-0x0000000074BC1000-memory.dmp

memory/916-8-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

memory/916-9-0x00000000056C0000-0x0000000005726000-memory.dmp

memory/916-10-0x0000000005730000-0x0000000005796000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4cflkrjg.bv2.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/916-19-0x0000000074410000-0x0000000074BC1000-memory.dmp

memory/916-20-0x00000000057A0000-0x0000000005AF7000-memory.dmp

memory/916-21-0x0000000005C50000-0x0000000005C6E000-memory.dmp

memory/916-22-0x0000000005C90000-0x0000000005CDC000-memory.dmp

memory/916-23-0x0000000006DE0000-0x0000000006E26000-memory.dmp

memory/916-25-0x0000000070680000-0x00000000706CC000-memory.dmp

memory/916-24-0x0000000007050000-0x0000000007084000-memory.dmp

memory/916-26-0x0000000070800000-0x0000000070B57000-memory.dmp

memory/916-35-0x00000000070B0000-0x00000000070CE000-memory.dmp

memory/916-36-0x0000000074410000-0x0000000074BC1000-memory.dmp

memory/916-37-0x00000000070D0000-0x0000000007174000-memory.dmp

memory/916-38-0x0000000074410000-0x0000000074BC1000-memory.dmp

memory/916-39-0x0000000007840000-0x0000000007EBA000-memory.dmp

memory/916-40-0x0000000007200000-0x000000000721A000-memory.dmp

memory/916-41-0x0000000007240000-0x000000000724A000-memory.dmp

memory/916-42-0x0000000007350000-0x00000000073E6000-memory.dmp

memory/916-43-0x0000000007260000-0x0000000007271000-memory.dmp

memory/916-44-0x00000000072B0000-0x00000000072BE000-memory.dmp

memory/916-45-0x00000000072C0000-0x00000000072D5000-memory.dmp

memory/916-46-0x0000000007310000-0x000000000732A000-memory.dmp

memory/916-47-0x0000000007330000-0x0000000007338000-memory.dmp

memory/916-50-0x0000000074410000-0x0000000074BC1000-memory.dmp

memory/1940-52-0x0000000002A20000-0x0000000002E1E000-memory.dmp

memory/2544-61-0x00000000056D0000-0x0000000005A27000-memory.dmp

memory/2544-63-0x0000000070820000-0x0000000070B77000-memory.dmp

memory/2544-72-0x0000000006E80000-0x0000000006F24000-memory.dmp

memory/2544-62-0x0000000070680000-0x00000000706CC000-memory.dmp

memory/2544-73-0x00000000071A0000-0x00000000071B1000-memory.dmp

memory/2544-74-0x00000000071F0000-0x0000000007205000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/2568-86-0x0000000005570000-0x00000000058C7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 52ef1388958567a35e66f5dbd923fa90
SHA1 b17b7b26c7a3ebe1d431e2e1ba45f0d1d67b9734
SHA256 4fff7f8a36da934deebe97a23709fed027b6bb07eb55503503fc12ebd7fca4e8
SHA512 e7f4ace16efa9e1ba2c0f24e9d2c1ee27f6583d569dc7d07175d5388daa17d32938555c98ebf87fd2380ca51377893aa2dfe99cc69e35c766487efc5d791bb52

memory/2568-88-0x0000000070680000-0x00000000706CC000-memory.dmp

memory/2568-89-0x0000000071050000-0x00000000713A7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 470009feef4511b071a51f30afa9e0a9
SHA1 6be50a0b350d466ddc307c08b64c939a30e0f206
SHA256 fa4070e9da8cbbe70c6d1508e32c6c6b293e4ab66934787c9ef61590bfcfa269
SHA512 c92e12ed19eb8a2bf198a6afb2acd6045520be4395230b0f9ad66c5d0ac8153901634f4b6cd347824788eafc33f52a4988542a7f29642215482b5c0e137dc86c

memory/4964-109-0x0000000002A20000-0x0000000002E28000-memory.dmp

memory/4964-108-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4964-110-0x0000000002E30000-0x000000000371B000-memory.dmp

memory/4300-112-0x0000000070800000-0x0000000070B57000-memory.dmp

memory/4300-111-0x0000000070680000-0x00000000706CC000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 e01db36b2072fb0648e7b3d39600676a
SHA1 a031bd80b92659226afe1fbc31335e97e293e8a3
SHA256 985ba69b325fce3711e83db096d4c22239087ba8b185425e31081c8a4e5f5cd9
SHA512 3c30090d0bcdc8fe2b9af75840f84a587ff83f64cf569b369a3eeb4fefdb166a4c18926cbc5fc60f62a2fe86242155cbe57c8bc86b4e8f1912802f285925337f

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 d698377ebb8305f76cbcc845e8df431f
SHA1 686a0f2b721cbc6d124d6c9bc927af2063835179
SHA256 d79d4044c67dd07374b950eeff82be284dc02b9e35b9fc274b3b036c31efd4d5
SHA512 6c149504c0719a80afc1481d0b1e241396b4451adf7d5e2cf3fb938cea5c7c79204988d848b9cbbc98dc1dbde502580230f1faebea4925d05b4f582973310ec9

memory/2408-136-0x0000000070680000-0x00000000706CC000-memory.dmp

memory/2408-137-0x0000000070800000-0x0000000070B57000-memory.dmp

memory/1368-155-0x0000000005D40000-0x0000000006097000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 fdbc7624fe3a4085af1bec7fcd1c63d0
SHA1 61431adf6e032c9ef9120365ebc0f6430540e27b
SHA256 e355b219a475c9b3ca9e6dc284b6f2a91371faf819d38762b2aed86c04862b99
SHA512 7e01b6d17bade105eeffce8fd3f6d074394cc026371de26580b91ceda4ef8657c060007838a12340f6522623aa8a45ecbcb4afb63048217ebab73e9df71f0bbe

memory/1368-157-0x0000000006320000-0x000000000636C000-memory.dmp

memory/1368-158-0x00000000705A0000-0x00000000705EC000-memory.dmp

memory/1368-159-0x0000000070720000-0x0000000070A77000-memory.dmp

memory/1368-168-0x0000000007530000-0x00000000075D4000-memory.dmp

memory/1368-169-0x0000000007850000-0x0000000007861000-memory.dmp

memory/1368-170-0x00000000060C0000-0x00000000060D5000-memory.dmp

memory/1940-171-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/356-181-0x0000000005EF0000-0x0000000006247000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 5b16a6081e25ff06fefe1d1493043f2e
SHA1 dee5e69e32b07b5cf1b615a57581fe142c3055cc
SHA256 4cbbc67815740beceec7f94a08e14421a7c9bd0701d7f328f649b60ed202ac85
SHA512 3e8140f5b8f9ab6e8763887866d4e1c9a781b733a049d52d8003362ba565f3dfc726ad7b74bbf056192c99eca1327e2b7a750f5a29def16ab0c9f0e4304a9c19

memory/356-183-0x00000000705A0000-0x00000000705EC000-memory.dmp

memory/356-184-0x0000000070750000-0x0000000070AA7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1332-200-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1940-206-0x0000000002A20000-0x0000000002E1E000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4984-211-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2272-210-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4984-207-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1332-213-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2272-216-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1332-217-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1332-221-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2272-223-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1332-225-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1332-229-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1332-233-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1332-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1332-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1332-245-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1332-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1332-253-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1332-257-0x0000000000400000-0x0000000000D1C000-memory.dmp