glupteba | f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507

Analysis

max time kernel
6s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 21:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Size

4.1MB
MD5

689d3ce68157244af7f45b105664e675
SHA1

617c4dd0e34b0e207a5c9da4fe367f129f5ba8cf
SHA256

f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507
SHA512

b4f53f02888adb9885460fae741d1abef13facfe79c822aa0cd03d8d41f586d3b790f112276defe463e1d267b2c2fa07a01440b93c6e67a2b977d515834405db
SSDEEP

98304:d/1aS45wg9wCj95WS7Tld+z+RCAmv1nHALSIS:d/oSJg9H959pd0eCv1HALS1

Score

10^/10

glupteba dropper evasion execution loader upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 8 IoCs

resource	yara_rule
behavioral1/memory/4220-148-0x0000000000400000-0x0000000002B08000-memory.dmp	family_glupteba
behavioral1/memory/2988-205-0x0000000000400000-0x0000000002B08000-memory.dmp	family_glupteba
behavioral1/memory/3528-207-0x0000000000400000-0x0000000002B08000-memory.dmp	family_glupteba
behavioral1/memory/3528-219-0x0000000000400000-0x0000000002B08000-memory.dmp	family_glupteba
behavioral1/memory/3528-223-0x0000000000400000-0x0000000002B08000-memory.dmp	family_glupteba
behavioral1/memory/3528-227-0x0000000000400000-0x0000000002B08000-memory.dmp	family_glupteba
behavioral1/memory/3528-231-0x0000000000400000-0x0000000002B08000-memory.dmp	family_glupteba
behavioral1/memory/3528-235-0x0000000000400000-0x0000000002B08000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1344	netsh.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000023374-210.dat	upx
behavioral1/memory/2872-215-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/4208-216-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/4208-212-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2872-221-0x0000000000400000-0x00000000008DF000-memory.dmp	upx
behavioral1/memory/2872-229-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4600	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1280	powershell.exe
3824	powershell.exe
1088	powershell.exe
1212	powershell.exe
3824	powershell.exe
4312	powershell.exe
888	powershell.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2408	schtasks.exe
3788	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3142 = "South Sudan Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1280	powershell.exe
1280	powershell.exe
4220	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
4220	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
3824	powershell.exe
3824	powershell.exe
3824	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	powershell.exe
Token: SeDebugPrivilege	4220	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Token: SeImpersonatePrivilege	4220	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
Token: SeDebugPrivilege	3824	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 1280	4220	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe	84
PID 4220 wrote to memory of 1280	4220	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe	84
PID 4220 wrote to memory of 1280	4220	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe	84
PID 2988 wrote to memory of 3824	2988	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe	95
PID 2988 wrote to memory of 3824	2988	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe	95
PID 2988 wrote to memory of 3824	2988	f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe	95

C:\Users\Admin\AppData\Local\Temp\f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
"C:\Users\Admin\AppData\Local\Temp\f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Users\Admin\AppData\Local\Temp\f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe
  "C:\Users\Admin\AppData\Local\Temp\f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507.exe"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:5044
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1344
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1088
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1212
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    PID:3528
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3824
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:2408
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1004
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4312
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:888
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      PID:3412
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:3788
  - - C:\Windows\windefender.exe
      "C:\Windows\windefender.exe"
      4⤵
      PID:4208
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        5⤵
        
        PID:1152
      - C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        6⤵
        Launches sc.exe
        
        PID:4600

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ixtra05p.fxs.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
59fdb33df54f2d6125ae5d50d485239c

SHA1
b9c60b57466e31bd612ce118afa00e859b342343

SHA256
3839f0a18ee156424a3d09847ca9098374102b4a822d9fd3e342608576176e44

SHA512
53f475bdbd8a1e0794ab0cff581c6e94416cfb11cf42c85d920d139dd1a79538e31f9f24c9ece40029f378637956580db12e2048c3d3aba523f934466b232bfb

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
0c002cdd43a605e2b8b685ac0e33cdf1

SHA1
4aaa3b224b64c67c4e85bb732755f636c75e7c37

SHA256
8a7e2a4db5d87b07bfa2633ac6078deab976ed8d2d479a85b93553d52160dc4b

SHA512
a624a4ef26ed4cc0793719472d4a762b4c02c1d0f6755c7f360f196f19fe76c310dbb09987b4562b5697cc7805ba4cfa4e46d9e2e0bb647260a374f26c7fc217

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
f9ab3fc4853750578b7f83656d3b4bcd

SHA1
671342b828ad92907f5d0be57e727c3c24e7fc35

SHA256
60604ad83015d02b4004ecb3732dd17fe8ec9c16f7e8ced8a1b7cd22351a8c57

SHA512
2681bfc42a1f08355751e26ace0b5fb747380ae380485266578097273759f59eb0d87af35a9c1400876764e65a3c426acaf149a9e5b19756a422a0fe82e12052

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
ab25c29dcae6c9eb2246b611f818202d

SHA1
88d16c52636c935223cf9ab85305fa4cd9bffeda

SHA256
93071f56932956f642e36d12440eaea0acaa78a42aee3385f967a886d36cdd34

SHA512
628c3785a106246e96a44878023b76e369f0b3e167a7147b6e29f248d794ace045adfe175ac782138b040e6ce8a02c2cbb0e65af0edfdb1858fa597c3955bc29

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
4a7cedb3f70f114e68b493032b6e1e01

SHA1
0d64e1bb3acea3ccf75f1473ce478ea25c11915f

SHA256
992ba81aa5676f6fa925d01ed33207169f871df4138d51a6d9d2dcbaf3fe14d0

SHA512
9ee8a95271276e3a11beb4ca7b240bbbfc72c69376bb0c3e06e8090ad529f15b8bbf5112e4e0718b146da0693e25a6f937c4520548df3cf36645efefe53d6ec8

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
689d3ce68157244af7f45b105664e675

SHA1
617c4dd0e34b0e207a5c9da4fe367f129f5ba8cf

SHA256
f664220007be5b388030b309d696b62f16faccce628feab953fb510f20708507

SHA512
b4f53f02888adb9885460fae741d1abef13facfe79c822aa0cd03d8d41f586d3b790f112276defe463e1d267b2c2fa07a01440b93c6e67a2b977d515834405db

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/888-188-0x0000000070B30000-0x0000000070B7C000-memory.dmp

Filesize
304KB

Download
memory/888-183-0x00000000059F0000-0x0000000005D44000-memory.dmp

Filesize
3.3MB

Download
memory/888-189-0x0000000071260000-0x00000000715B4000-memory.dmp

Filesize
3.3MB

Download
memory/1088-87-0x0000000070C10000-0x0000000070C5C000-memory.dmp

Filesize
304KB

Download
memory/1088-88-0x0000000071390000-0x00000000716E4000-memory.dmp

Filesize
3.3MB

Download
memory/1212-110-0x0000000070C10000-0x0000000070C5C000-memory.dmp

Filesize
304KB

Download
memory/1212-111-0x0000000071390000-0x00000000716E4000-memory.dmp

Filesize
3.3MB

Download
memory/1280-21-0x0000000006B50000-0x0000000006B94000-memory.dmp

Filesize
272KB

Download
memory/1280-3-0x0000000002CC0000-0x0000000002CF6000-memory.dmp

Filesize
216KB

Download
memory/1280-28-0x0000000071390000-0x00000000716E4000-memory.dmp

Filesize
3.3MB

Download
memory/1280-20-0x0000000006620000-0x000000000666C000-memory.dmp

Filesize
304KB

Download
memory/1280-39-0x0000000007BC0000-0x0000000007C63000-memory.dmp

Filesize
652KB

Download
memory/1280-40-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

Filesize
40KB

Download
memory/1280-41-0x0000000007DC0000-0x0000000007E56000-memory.dmp

Filesize
600KB

Download
memory/1280-42-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

Filesize
68KB

Download
memory/1280-43-0x0000000007D00000-0x0000000007D0E000-memory.dmp

Filesize
56KB

Download
memory/1280-44-0x0000000007D20000-0x0000000007D34000-memory.dmp

Filesize
80KB

Download
memory/1280-45-0x0000000007D60000-0x0000000007D7A000-memory.dmp

Filesize
104KB

Download
memory/1280-46-0x0000000007D50000-0x0000000007D58000-memory.dmp

Filesize
32KB

Download
memory/1280-49-0x00007FF8EA250000-0x00007FF8EA445000-memory.dmp

Filesize
2.0MB

Download
memory/1280-4-0x00007FF8EA250000-0x00007FF8EA445000-memory.dmp

Filesize
2.0MB

Download
memory/1280-5-0x0000000005920000-0x0000000005F48000-memory.dmp

Filesize
6.2MB

Download
memory/1280-25-0x00007FF8EA250000-0x00007FF8EA445000-memory.dmp

Filesize
2.0MB

Download
memory/1280-6-0x0000000005820000-0x0000000005842000-memory.dmp

Filesize
136KB

Download
memory/1280-8-0x0000000005FC0000-0x0000000006026000-memory.dmp

Filesize
408KB

Download
memory/1280-24-0x00000000079B0000-0x00000000079CA000-memory.dmp

Filesize
104KB

Download
memory/1280-23-0x0000000008010000-0x000000000868A000-memory.dmp

Filesize
6.5MB

Download
memory/1280-22-0x0000000007910000-0x0000000007986000-memory.dmp

Filesize
472KB

Download
memory/1280-2-0x00007FF8EA250000-0x00007FF8EA445000-memory.dmp

Filesize
2.0MB

Download
memory/1280-38-0x0000000007BA0000-0x0000000007BBE000-memory.dmp

Filesize
120KB

Download
memory/1280-26-0x0000000007B60000-0x0000000007B92000-memory.dmp

Filesize
200KB

Download
memory/1280-7-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/1280-27-0x0000000070C10000-0x0000000070C5C000-memory.dmp

Filesize
304KB

Download
memory/1280-19-0x00000000065E0000-0x00000000065FE000-memory.dmp

Filesize
120KB

Download
memory/1280-18-0x0000000006030000-0x0000000006384000-memory.dmp

Filesize
3.3MB

Download
memory/2872-229-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2872-221-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2872-215-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/2988-205-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-235-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-227-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-223-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-251-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-239-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-231-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-207-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-243-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-255-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-259-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-263-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-247-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3528-219-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/3824-71-0x00000000077D0000-0x0000000007873000-memory.dmp

Filesize
652KB

Download
memory/3824-137-0x0000000070C10000-0x0000000070C5C000-memory.dmp

Filesize
304KB

Download
memory/3824-60-0x0000000070C10000-0x0000000070C5C000-memory.dmp

Filesize
304KB

Download
memory/3824-61-0x0000000071390000-0x00000000716E4000-memory.dmp

Filesize
3.3MB

Download
memory/3824-72-0x0000000007B10000-0x0000000007B21000-memory.dmp

Filesize
68KB

Download
memory/3824-73-0x0000000007B60000-0x0000000007B74000-memory.dmp

Filesize
80KB

Download
memory/3824-138-0x0000000071390000-0x00000000716E4000-memory.dmp

Filesize
3.3MB

Download
memory/4208-216-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4208-212-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/4220-98-0x00007FF8EA250000-0x00007FF8EA445000-memory.dmp

Filesize
2.0MB

Download
memory/4220-1-0x00007FF8EA250000-0x00007FF8EA445000-memory.dmp

Filesize
2.0MB

Download
memory/4220-148-0x0000000000400000-0x0000000002B08000-memory.dmp

Filesize
39.0MB

Download
memory/4312-162-0x0000000070B30000-0x0000000070B7C000-memory.dmp

Filesize
304KB

Download
memory/4312-159-0x0000000006270000-0x00000000065C4000-memory.dmp

Filesize
3.3MB

Download
memory/4312-161-0x0000000006940000-0x000000000698C000-memory.dmp

Filesize
304KB

Download
memory/4312-163-0x0000000071870000-0x0000000071BC4000-memory.dmp

Filesize
3.3MB

Download
memory/4312-173-0x0000000007B80000-0x0000000007C23000-memory.dmp

Filesize
652KB

Download
memory/4312-175-0x00000000066F0000-0x0000000006704000-memory.dmp

Filesize
80KB

Download
memory/4312-174-0x0000000007EB0000-0x0000000007EC1000-memory.dmp

Filesize
68KB

Download