Malware Analysis Report

2024-12-08 02:03

Sample ID 240516-stfwaaah31
Target 9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511
SHA256 9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511

Threat Level: Known bad

The file 9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Checks installed software on the system

Adds Run key to start application

Manipulates WinMonFS driver.

Drops file in System32 directory

Launches sc.exe

Drops file in Windows directory

Checks for VirtualBox DLLs, possible anti-VM trick

Command and Scripting Interpreter: PowerShell

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-16 15:24

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-16 15:24

Reported

2024-05-16 15:27

Platform

win10v2004-20240426-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1472 = "Magadan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-832 = "SA Eastern Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2941 = "Sao Tome Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2062 = "North Korea Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-301 = "Romance Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-152 = "Central America Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-561 = "SE Asia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1832 = "Russia TZ 2 Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2791 = "Novosibirsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time" C:\Windows\windefender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5108 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5108 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5108 wrote to memory of 1200 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 1920 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\system32\cmd.exe
PID 2152 wrote to memory of 4516 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\system32\cmd.exe
PID 4516 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4516 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2152 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 2100 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2152 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\rss\csrss.exe
PID 2152 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\rss\csrss.exe
PID 2152 wrote to memory of 1772 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\rss\csrss.exe
PID 1772 wrote to memory of 4296 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 4296 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 4296 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 2700 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 2700 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 2700 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 3264 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 3264 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 3264 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1772 wrote to memory of 4088 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1772 wrote to memory of 4088 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3756 wrote to memory of 2440 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3756 wrote to memory of 2440 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3756 wrote to memory of 2440 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2440 wrote to memory of 4344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 4344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2440 wrote to memory of 4344 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe

"C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe

"C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
NL 23.62.61.139:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 139.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
NL 23.62.61.139:443 www.bing.com tcp
US 8.8.8.8:53 4ecd1213-19ed-4d1b-81cc-134bcfe6508c.uuid.filesdumpplace.org udp
US 8.8.8.8:53 stun.sipgate.net udp
US 8.8.8.8:53 server8.filesdumpplace.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 3.33.249.248:3478 stun.sipgate.net udp
BG 185.82.216.96:443 server8.filesdumpplace.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 248.249.33.3.in-addr.arpa udp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 96.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
BG 185.82.216.96:443 server8.filesdumpplace.org tcp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
BG 185.82.216.96:443 server8.filesdumpplace.org tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
BG 185.82.216.96:443 server8.filesdumpplace.org tcp
N/A 127.0.0.1:31465 tcp

Files

memory/5108-1-0x0000000002960000-0x0000000002D63000-memory.dmp

memory/5108-2-0x0000000002D70000-0x000000000365B000-memory.dmp

memory/5108-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1200-4-0x000000007400E000-0x000000007400F000-memory.dmp

memory/1200-5-0x0000000002830000-0x0000000002866000-memory.dmp

memory/1200-7-0x0000000074000000-0x00000000747B0000-memory.dmp

memory/1200-6-0x0000000004F70000-0x0000000005598000-memory.dmp

memory/1200-8-0x0000000074000000-0x00000000747B0000-memory.dmp

memory/1200-9-0x00000000055A0000-0x00000000055C2000-memory.dmp

memory/1200-11-0x00000000057E0000-0x0000000005846000-memory.dmp

memory/1200-10-0x0000000005640000-0x00000000056A6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q0zjdbkj.4jk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1200-21-0x0000000005850000-0x0000000005BA4000-memory.dmp

memory/1200-22-0x0000000005E10000-0x0000000005E2E000-memory.dmp

memory/1200-23-0x0000000005E50000-0x0000000005E9C000-memory.dmp

memory/1200-24-0x0000000006380000-0x00000000063C4000-memory.dmp

memory/1200-25-0x0000000006F30000-0x0000000006FA6000-memory.dmp

memory/1200-27-0x00000000071D0000-0x00000000071EA000-memory.dmp

memory/1200-26-0x0000000007830000-0x0000000007EAA000-memory.dmp

memory/1200-29-0x000000006FEA0000-0x000000006FEEC000-memory.dmp

memory/1200-31-0x0000000070600000-0x0000000070954000-memory.dmp

memory/1200-30-0x0000000074000000-0x00000000747B0000-memory.dmp

memory/1200-28-0x0000000007390000-0x00000000073C2000-memory.dmp

memory/1200-41-0x00000000073D0000-0x00000000073EE000-memory.dmp

memory/1200-43-0x00000000073F0000-0x0000000007493000-memory.dmp

memory/1200-42-0x0000000074000000-0x00000000747B0000-memory.dmp

memory/1200-44-0x00000000074E0000-0x00000000074EA000-memory.dmp

memory/1200-45-0x00000000075A0000-0x0000000007636000-memory.dmp

memory/1200-46-0x0000000007500000-0x0000000007511000-memory.dmp

memory/1200-47-0x0000000007540000-0x000000000754E000-memory.dmp

memory/1200-48-0x0000000007550000-0x0000000007564000-memory.dmp

memory/1200-49-0x0000000007640000-0x000000000765A000-memory.dmp

memory/1200-50-0x0000000007590000-0x0000000007598000-memory.dmp

memory/1200-53-0x0000000074000000-0x00000000747B0000-memory.dmp

memory/2152-55-0x0000000002960000-0x0000000002D65000-memory.dmp

memory/2152-56-0x0000000002D70000-0x000000000365B000-memory.dmp

memory/1920-66-0x0000000005F60000-0x00000000062B4000-memory.dmp

memory/1920-67-0x000000006FEA0000-0x000000006FEEC000-memory.dmp

memory/1920-78-0x00000000076D0000-0x0000000007773000-memory.dmp

memory/1920-68-0x0000000070040000-0x0000000070394000-memory.dmp

memory/1920-79-0x00000000079E0000-0x00000000079F1000-memory.dmp

memory/1920-80-0x0000000007A30000-0x0000000007A44000-memory.dmp

memory/5108-83-0x0000000002960000-0x0000000002D63000-memory.dmp

memory/5108-84-0x0000000002D70000-0x000000000365B000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7a0574c15f72e527bc4bf44d133003e6
SHA1 40e9aaedb6f7fdbfcb224e76342934f4f1eabd2c
SHA256 08a2636c0b33d29e627fb13634d20acb94a087c75ddabdeb454a665196322af9
SHA512 ebfae804d7651e4e71476278bbd7a00070074554b705f31358951faf048ce85e3ad7c7bedadc7a7350724e66085525cabbd512c190353629f6d16da47acd207e

memory/2624-96-0x000000006FEA0000-0x000000006FEEC000-memory.dmp

memory/2624-97-0x0000000070600000-0x0000000070954000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4450ceea92fa8cbc87a0f1da7baa6849
SHA1 5932737595426fbf54f7d09fdb6b24948fdfd476
SHA256 003e3ec838cf3551363ba3e33b22595fbfd16f8c1c0ecb6b80182f97cafdc8e1
SHA512 9488e91f1216c233bd1c7b1238cb9369ece41ff26b910d6ef6740920a238027e7ae16bf4928d5e2ac9b9141b0bb52030e717641c1849a61bddfb1603b51b6348

memory/2100-118-0x000000006FEA0000-0x000000006FEEC000-memory.dmp

memory/2100-119-0x0000000070040000-0x0000000070394000-memory.dmp

memory/5108-129-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 93a658296b4be3d4d5126a60a487d1f9
SHA1 9b12347718392de4cd89a917ffcf3a4155d66abd
SHA256 9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511
SHA512 4f62fe67cc299b8e9874effc112c9dd293ea74cf41f104a60e0345953345a3f535e32c51bb9391ded44357e10f2e804d23971e973f0cccd2edfdac87e9c2c152

memory/2152-134-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4296-137-0x0000000005480000-0x00000000057D4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e40d989c37749726c1d01ced9cdcbb78
SHA1 e8422068dadaaaa9348004cb54dba7eda9d2ac1a
SHA256 5fa31047d1cec7e2abb22f21098ec10f6e7249c63f7e29e6326a8dbc9c8fc4bd
SHA512 6e975da395122d9c51d64d12a309a228e8cf0447eebd4d11e70d8f6582580de5758a7b6f761c103cb1472ba1240b9963fa0a0b27ed6888c3663f65fa92fc071b

memory/4296-148-0x000000006FEA0000-0x000000006FEEC000-memory.dmp

memory/4296-149-0x0000000070620000-0x0000000070974000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 eb0dd0652acec2314419132ab64dc702
SHA1 2ec9ca17560a77bd91aecb401008f0273bcbdf31
SHA256 495057733b25a7cb6415b5f960aed670826b58f38038be82f294178e93d2f819
SHA512 1d1c7789d86702df2db07c4d50a8609da58414bf19f655edc4d05f073af5f18b911e8cb7e75b61ef6e97d3375f78e0d53d0e7293a3da8a43880e72df9d82046c

memory/2700-169-0x0000000005A90000-0x0000000005DE4000-memory.dmp

memory/2700-171-0x0000000006330000-0x000000000637C000-memory.dmp

memory/2700-172-0x000000006FDC0000-0x000000006FE0C000-memory.dmp

memory/2700-183-0x0000000007480000-0x0000000007523000-memory.dmp

memory/2700-173-0x0000000070B90000-0x0000000070EE4000-memory.dmp

memory/2700-184-0x0000000007620000-0x0000000007631000-memory.dmp

memory/2700-185-0x0000000005FE0000-0x0000000005FF4000-memory.dmp

memory/3264-196-0x0000000005B10000-0x0000000005E64000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 da9a3ecdcf76111327ed18554025eb56
SHA1 d769257c9b97f17eafa34a80f84032107a8cf827
SHA256 5e3dd1507a6e40da547ea440a37ae9218cfc27bac88696e4756559527698b3c2
SHA512 c7f08ee8dec23d4365184f7f6151d63226a6d863db34d6fff6b5a5f00c32b1361cc3c0dfe4161d6faa3de54fb3bfcb46de90493b2040a4d9b04242d912359f3a

memory/3264-198-0x000000006FDC0000-0x000000006FE0C000-memory.dmp

memory/3264-199-0x0000000070B80000-0x0000000070ED4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/1772-216-0x0000000000400000-0x0000000000D1C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/3756-221-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3756-223-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2448-224-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1772-226-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2448-228-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1772-229-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1772-232-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2448-233-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1772-235-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1772-238-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1772-241-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1772-244-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1772-247-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1772-250-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1772-253-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1772-256-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1772-259-0x0000000000400000-0x0000000000D1C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-16 15:24

Reported

2024-05-16 15:27

Platform

win11-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-402 = "Arabic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-111 = "Eastern Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1042 = "Ulaanbaatar Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-112 = "Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3912 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3912 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3912 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 4968 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\system32\cmd.exe
PID 720 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\system32\cmd.exe
PID 2272 wrote to memory of 4556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2272 wrote to memory of 4556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 720 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 720 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\rss\csrss.exe
PID 720 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\rss\csrss.exe
PID 720 wrote to memory of 1544 N/A C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe C:\Windows\rss\csrss.exe
PID 1868 wrote to memory of 3660 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1868 wrote to memory of 3660 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1868 wrote to memory of 3660 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3660 wrote to memory of 4960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3660 wrote to memory of 4960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3660 wrote to memory of 4960 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe

"C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe

"C:\Users\Admin\AppData\Local\Temp\9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 b366c2f2-b57a-41e6-9e36-8722f0c9d12e.uuid.filesdumpplace.org udp
US 8.8.8.8:53 server11.filesdumpplace.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.134.233:443 cdn.discordapp.com tcp
BG 185.82.216.96:443 server11.filesdumpplace.org tcp
US 104.21.94.82:443 carsalessystem.com tcp
N/A 127.0.0.1:3478 udp
BG 185.82.216.96:443 server11.filesdumpplace.org tcp
US 3.33.249.248:3478 stun.sipgate.net udp
BG 185.82.216.96:443 server11.filesdumpplace.org tcp

Files

memory/3912-1-0x0000000002B90000-0x0000000002F95000-memory.dmp

memory/3912-2-0x0000000002FA0000-0x000000000388B000-memory.dmp

memory/3912-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2268-4-0x000000007489E000-0x000000007489F000-memory.dmp

memory/2268-5-0x0000000002A40000-0x0000000002A76000-memory.dmp

memory/2268-6-0x00000000056B0000-0x0000000005CDA000-memory.dmp

memory/2268-7-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2268-8-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2268-9-0x00000000055B0000-0x00000000055D2000-memory.dmp

memory/2268-11-0x0000000005D50000-0x0000000005DB6000-memory.dmp

memory/2268-10-0x0000000005CE0000-0x0000000005D46000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cnmwxejn.fcf.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2268-17-0x0000000005DC0000-0x0000000006117000-memory.dmp

memory/2268-21-0x0000000006280000-0x000000000629E000-memory.dmp

memory/2268-22-0x0000000006300000-0x000000000634C000-memory.dmp

memory/2268-23-0x00000000067E0000-0x0000000006826000-memory.dmp

memory/2268-25-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/2268-24-0x0000000007670000-0x00000000076A4000-memory.dmp

memory/2268-26-0x0000000070D10000-0x0000000071067000-memory.dmp

memory/2268-37-0x00000000076F0000-0x0000000007794000-memory.dmp

memory/2268-36-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2268-35-0x00000000076D0000-0x00000000076EE000-memory.dmp

memory/2268-38-0x0000000074890000-0x0000000075041000-memory.dmp

memory/2268-40-0x0000000007820000-0x000000000783A000-memory.dmp

memory/2268-39-0x0000000007E60000-0x00000000084DA000-memory.dmp

memory/2268-41-0x0000000007860000-0x000000000786A000-memory.dmp

memory/2268-42-0x0000000007970000-0x0000000007A06000-memory.dmp

memory/2268-43-0x0000000007880000-0x0000000007891000-memory.dmp

memory/2268-44-0x00000000078D0000-0x00000000078DE000-memory.dmp

memory/2268-45-0x00000000078E0000-0x00000000078F5000-memory.dmp

memory/2268-46-0x0000000007930000-0x000000000794A000-memory.dmp

memory/2268-47-0x0000000007950000-0x0000000007958000-memory.dmp

memory/2268-50-0x0000000074890000-0x0000000075041000-memory.dmp

memory/720-52-0x0000000002A60000-0x0000000002E63000-memory.dmp

memory/4968-53-0x0000000006420000-0x0000000006777000-memory.dmp

memory/4968-62-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/4968-63-0x0000000070D50000-0x00000000710A7000-memory.dmp

memory/4968-72-0x0000000007B00000-0x0000000007BA4000-memory.dmp

memory/3912-74-0x0000000002B90000-0x0000000002F95000-memory.dmp

memory/3912-73-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3912-75-0x0000000002FA0000-0x000000000388B000-memory.dmp

memory/4968-76-0x0000000007E50000-0x0000000007E61000-memory.dmp

memory/4968-77-0x0000000007EA0000-0x0000000007EB5000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3b3a19b783d7810c89a2b9234241ab19
SHA1 c71743dce027233ac4210d12a0c965769a2e2624
SHA256 21059c1d3087895102be3fe8a1b0709ad4f78534f65791400015e1718b92ac45
SHA512 3c69b74d151d5083006c769c2a59b4ff8d649c1896ac087d0af30b551b8a4b34a77cd7bda6c3be0e9540288a1c78309782973e457496a5adb2a19b7956b14c7f

memory/1444-90-0x0000000070B00000-0x0000000070B4C000-memory.dmp

memory/1444-91-0x0000000070D10000-0x0000000071067000-memory.dmp

memory/2776-109-0x00000000061D0000-0x0000000006527000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2e63c980ce4f8a0e2f6119fe1d812e70
SHA1 958f163f4d3e9e334f848e38b6dd56c0bced6137
SHA256 aa26ec28e3861f7b121143caf7bc5a4921333995bad83ff799b9f561e5d76d9c
SHA512 b1bbc31c544a8c57d0006e526b8df195a90791dba1c1f06e9b53edab089c2a3de98e1b91ca8556ca1ab82e74616dc5821b53d23050d811473c594ba07c6f402d

memory/2776-112-0x0000000070C80000-0x0000000070FD7000-memory.dmp

memory/2776-111-0x0000000070B00000-0x0000000070B4C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 93a658296b4be3d4d5126a60a487d1f9
SHA1 9b12347718392de4cd89a917ffcf3a4155d66abd
SHA256 9f5be7f86f25bf7f8816718238bd9788a07d27116ebf5435bbe18e81fd982511
SHA512 4f62fe67cc299b8e9874effc112c9dd293ea74cf41f104a60e0345953345a3f535e32c51bb9391ded44357e10f2e804d23971e973f0cccd2edfdac87e9c2c152

memory/4084-133-0x00000000058E0000-0x0000000005C37000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 01b9bed1e7e92a32aea997f6c67f7e3f
SHA1 b9cf3e1047c93061242c2afb48bdaf4958e72a6c
SHA256 6edcd6fb23cfa8c3438dc447441432f5ddecb9549ac19bc9f323d6b5f0e2c197
SHA512 520abf12a878f6aab38242203d991d3d70b99beda9512a6c9da29f7e0234b54c47d6fa1969f7069a3db2bfe33ec1a66a6813a63296cc57a93ea2dc575fa719b6

memory/720-135-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4084-137-0x0000000070D70000-0x00000000710C7000-memory.dmp

memory/4084-136-0x0000000070B00000-0x0000000070B4C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c68d1ef69d6772966800c0e62c348734
SHA1 a18cf4b6027ac0b8f87b4b1437276079ff97b84d
SHA256 9e63096638d2276aac5a85e1b947c17a58f8ce04a2b4d96f7e36aada3aeb4aaa
SHA512 4552a1837909a0928f8a5a52a47efe8763d05d7f77a3b1afef4d4c2c037bb0e7069e66277e89c2e818fd19ba6163ec982e3d8873fd6bd4249c47a030336b6fa8

memory/4260-155-0x0000000006360000-0x00000000066B7000-memory.dmp

memory/4260-157-0x0000000006D50000-0x0000000006D9C000-memory.dmp

memory/4260-159-0x0000000070BC0000-0x0000000070F17000-memory.dmp

memory/4260-168-0x0000000007B70000-0x0000000007C14000-memory.dmp

memory/4260-158-0x0000000070A20000-0x0000000070A6C000-memory.dmp

memory/4260-169-0x0000000007E80000-0x0000000007E91000-memory.dmp

memory/4260-170-0x00000000066F0000-0x0000000006705000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4d6f95213b4f6302a3f3db583e59ba22
SHA1 ccad5dcfaa938b6e10eb01b6996c144942eb96aa
SHA256 fa7b21423972903a06c77d0fdecfc4bc8c1bfdcaf2c5f81c59ac768a95239acd
SHA512 6133a666ac2c82e8f5e47e257737ba55168c8ac811b470c4bbb9cc41445a30dcfeef6bb89e68b46e40d318f56241fb04077f530ddec056867d1daed1d0f6d03e

memory/2372-182-0x0000000070A20000-0x0000000070A6C000-memory.dmp

memory/2372-183-0x0000000070BC0000-0x0000000070F17000-memory.dmp

memory/1544-198-0x00000000750D0000-0x00000000750E1000-memory.dmp

memory/1544-197-0x00000000750F0000-0x000000007510E000-memory.dmp

memory/1544-196-0x0000000075110000-0x0000000075177000-memory.dmp

memory/1544-195-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/720-199-0x0000000002A60000-0x0000000002E63000-memory.dmp

memory/1868-200-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2492-201-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1868-203-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1544-206-0x0000000075110000-0x0000000075177000-memory.dmp

memory/1544-205-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1544-209-0x0000000075080000-0x00000000750C1000-memory.dmp

memory/2492-212-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1544-214-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1544-223-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2492-230-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1544-233-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1544-242-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1544-250-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1544-259-0x0000000000400000-0x0000000000D1C000-memory.dmp