Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-05-2024 04:52
Static task
static1
Behavioral task
behavioral1
Sample
b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe
Resource
win10v2004-20240426-en
General
-
Target
b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe
-
Size
4.1MB
-
MD5
e02317fc70c7f8924818f349a0a83422
-
SHA1
73a694c27a20c577c4e70a4948dab469252a1444
-
SHA256
b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2
-
SHA512
0a563ba7747fb23cd1656e64f35d97e5b0262e16f73b6d70465bf3e2f8bb8b53275095dbf138757cb96f125c415b60a80815c35a486201bc06cb7374e8d6dce2
-
SSDEEP
98304:mNO3yy04ogde7ep0A2AdPyQGNgd0+V4CCH3iZ/qkVniougG1d:AOA8mA0A2AFyQ3d0+aD4qkVni5d
Malware Config
Signatures
-
Glupteba payload 18 IoCs
Processes:
resource yara_rule behavioral2/memory/3660-2-0x0000000004C60000-0x000000000554B000-memory.dmp family_glupteba behavioral2/memory/3660-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3660-52-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/3660-54-0x0000000004C60000-0x000000000554B000-memory.dmp family_glupteba behavioral2/memory/3660-81-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/2396-80-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/2396-130-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-150-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-205-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-217-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-225-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-229-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-233-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-237-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-241-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-245-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-249-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4016-253-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2576 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 4016 csrss.exe 3672 injector.exe 2008 windefender.exe 4916 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/2008-209-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4916-212-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2008-214-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4916-220-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4916-227-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe -
Drops file in Windows directory 4 IoCs
Processes:
b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.execsrss.exedescription ioc process File opened for modification C:\Windows\rss b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe File created C:\Windows\rss\csrss.exe b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 716 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4792 powershell.exe 4776 powershell.exe 4964 powershell.exe 4216 powershell.exe 2096 powershell.exe 4224 powershell.exe 2872 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4880 schtasks.exe 896 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exewindefender.exeb709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2182 = "Astrakhan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-292 = "Central European Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-142 = "Canada Central Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2341 = "Haiti Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-11 = "Azores Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-912 = "Mauritius Standard Time" windefender.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-492 = "India Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-742 = "New Zealand Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-92 = "Pacific SA Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-441 = "Arabian Daylight Time" windefender.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeb709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exepowershell.exeb709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4224 powershell.exe 4224 powershell.exe 3660 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 3660 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 2872 powershell.exe 2872 powershell.exe 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe 4792 powershell.exe 4792 powershell.exe 4776 powershell.exe 4776 powershell.exe 4964 powershell.exe 4964 powershell.exe 4216 powershell.exe 4216 powershell.exe 2096 powershell.exe 2096 powershell.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 4016 csrss.exe 4016 csrss.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 4016 csrss.exe 4016 csrss.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 4016 csrss.exe 4016 csrss.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe 3672 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exeb709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4224 powershell.exe Token: SeDebugPrivilege 3660 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Token: SeImpersonatePrivilege 3660 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe Token: SeDebugPrivilege 2872 powershell.exe Token: SeDebugPrivilege 4792 powershell.exe Token: SeDebugPrivilege 4776 powershell.exe Token: SeDebugPrivilege 4964 powershell.exe Token: SeDebugPrivilege 4216 powershell.exe Token: SeDebugPrivilege 2096 powershell.exe Token: SeSystemEnvironmentPrivilege 4016 csrss.exe Token: SeSecurityPrivilege 716 sc.exe Token: SeSecurityPrivilege 716 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exeb709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 3660 wrote to memory of 4224 3660 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 3660 wrote to memory of 4224 3660 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 3660 wrote to memory of 4224 3660 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 2396 wrote to memory of 2872 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 2396 wrote to memory of 2872 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 2396 wrote to memory of 2872 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 2396 wrote to memory of 4916 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe cmd.exe PID 2396 wrote to memory of 4916 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe cmd.exe PID 4916 wrote to memory of 2576 4916 cmd.exe netsh.exe PID 4916 wrote to memory of 2576 4916 cmd.exe netsh.exe PID 2396 wrote to memory of 4792 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 2396 wrote to memory of 4792 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 2396 wrote to memory of 4792 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 2396 wrote to memory of 4776 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 2396 wrote to memory of 4776 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 2396 wrote to memory of 4776 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe powershell.exe PID 2396 wrote to memory of 4016 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe csrss.exe PID 2396 wrote to memory of 4016 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe csrss.exe PID 2396 wrote to memory of 4016 2396 b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe csrss.exe PID 4016 wrote to memory of 4964 4016 csrss.exe powershell.exe PID 4016 wrote to memory of 4964 4016 csrss.exe powershell.exe PID 4016 wrote to memory of 4964 4016 csrss.exe powershell.exe PID 4016 wrote to memory of 4216 4016 csrss.exe powershell.exe PID 4016 wrote to memory of 4216 4016 csrss.exe powershell.exe PID 4016 wrote to memory of 4216 4016 csrss.exe powershell.exe PID 4016 wrote to memory of 2096 4016 csrss.exe powershell.exe PID 4016 wrote to memory of 2096 4016 csrss.exe powershell.exe PID 4016 wrote to memory of 2096 4016 csrss.exe powershell.exe PID 4016 wrote to memory of 3672 4016 csrss.exe injector.exe PID 4016 wrote to memory of 3672 4016 csrss.exe injector.exe PID 2008 wrote to memory of 696 2008 windefender.exe cmd.exe PID 2008 wrote to memory of 696 2008 windefender.exe cmd.exe PID 2008 wrote to memory of 696 2008 windefender.exe cmd.exe PID 696 wrote to memory of 716 696 cmd.exe sc.exe PID 696 wrote to memory of 716 696 cmd.exe sc.exe PID 696 wrote to memory of 716 696 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe"C:\Users\Admin\AppData\Local\Temp\b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe"C:\Users\Admin\AppData\Local\Temp\b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2576 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4792 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4964 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4880 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2900
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4216 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3672 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:896 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:716
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4916
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5009c86b54ce9ead7e56e1e182d1bea6c
SHA11c020b23ba283ce67b78dc48210fa8be218b2579
SHA256975cb5e03400f598cac47ffcda5121c2b2088af4c5c26c928552e5a33c5fa9b5
SHA5127cd08153e00768a6217ba327ded9fa7da78734356b660e3afad94cf5b113a6ae0433d93a3220ecb937b939ba7208f620c266e7b8cc0f73994c888db109f10bf1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD581a43f09bde296433f881ce756d7fb74
SHA1673333103c3fcdfc6ff296afbdf33fc9e440d255
SHA2562f12435b4bd4802890fb749690f0847a3356a45c17b9ced9c24f16f27e928d4f
SHA512beee4b973c889bfcc7c835790518640ebf14ccb455ebf36eb1059fd0bbf87ee75d9f31d3cb6a91e8cf88cb2faf88811563e625e567883c9988e15cc4df59785a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ea74848467f49e47a89bcdcc2d0b0f1a
SHA1c54feb0661f8078662dc28b917510909b7b19a97
SHA256642163cb9c2923435ae4bf7157819a5d9b1faed30d4ffa2383011563c00c825c
SHA512aaabe3dc28d683dead387cf63e738c5c3b790ce54ecde06ff1b66135bbdaee0f826215487bd864dce38174608531768500419714660388301cf2a0b994a2f447
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD54ec6367b5645e08734e4021a8ad5c07a
SHA1ede26e6eb974bfa1240ac52a24466abbfe49a2d5
SHA2569966c7a6135c43548bd08f7fbd9601e61175376537c8482c33cb37c16f3ab40d
SHA51272de1cb1a7cc3020d7620413096fe02afdba764d4d7c5f138031a0e11b16220d3c01df28b3467fee78d00ba54c2319ec9d1c232e335beb75556837e4f5c942cc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5626bbe03ddd133475f0e6bb9133c09a5
SHA13d377c407131f01ec836f6444cec163ee88e9d11
SHA2568070d384986c2c2c33d24a49edd92b7f8d1a70c4d9f4d3b190d96bb56056ffc4
SHA512020dbcea1de79408d674e16055ed52859d76b280e4a62401e8353380ae575b354320397b7ec08de42f944386f92a3936936229bb2007c32696a273d12cd4d049
-
Filesize
4.1MB
MD5e02317fc70c7f8924818f349a0a83422
SHA173a694c27a20c577c4e70a4948dab469252a1444
SHA256b709890fe477480c05dfc44aac2de7bc461cd8e09cd40627e37dccd0265635d2
SHA5120a563ba7747fb23cd1656e64f35d97e5b0262e16f73b6d70465bf3e2f8bb8b53275095dbf138757cb96f125c415b60a80815c35a486201bc06cb7374e8d6dce2
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec