Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17-05-2024 07:11
Static task
static1
Behavioral task
behavioral1
Sample
20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe
Resource
win10v2004-20240226-en
General
-
Target
20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe
-
Size
4.1MB
-
MD5
edc4c9139e0be3af1b1931eb20c68d8d
-
SHA1
3a9953a6db123f790ce29fddbec1ce15e0de9741
-
SHA256
20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092
-
SHA512
c40b6e1e8700b33dea43164f1cf4238adbc0bac23bf7c2208164f9af52b0a525021d4eacbe924bcdcc2439d2f98e495291a86bdbbd8e9df9963501e2c86fa5ed
-
SSDEEP
98304:40IUXroYDzElV89sdV2qHm3LaKbYXl7F29tEHWEXgelgSAZWSyDiLl:jIU7SlV8K2X2AhEHFgekcy
Malware Config
Signatures
-
Glupteba payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/4188-2-0x0000000004CA0000-0x000000000558B000-memory.dmp family_glupteba behavioral1/memory/4188-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4188-9-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral1/memory/4188-27-0x0000000004CA0000-0x000000000558B000-memory.dmp family_glupteba behavioral1/memory/4188-33-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4188-32-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral1/memory/4188-62-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral1/memory/3152-104-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral1/memory/3152-145-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral1/memory/2480-173-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral1/memory/2480-226-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral1/memory/2480-235-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 892 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 2480 csrss.exe 1496 injector.exe 892 windefender.exe 1664 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral1/memory/892-239-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1664-242-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/892-243-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe -
Drops file in Windows directory 4 IoCs
Processes:
csrss.exe20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exedescription ioc process File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe File created C:\Windows\rss\csrss.exe 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe File created C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2212 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1288 powershell.exe 4424 powershell.exe 752 powershell.exe 3972 powershell.exe 2732 powershell.exe 4220 powershell.exe 1364 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1112 schtasks.exe 4932 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exe20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exepowershell.exe20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4220 powershell.exe 4220 powershell.exe 4220 powershell.exe 4188 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 4188 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 1364 powershell.exe 1364 powershell.exe 1364 powershell.exe 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe 1288 powershell.exe 1288 powershell.exe 1288 powershell.exe 4424 powershell.exe 4424 powershell.exe 4424 powershell.exe 752 powershell.exe 752 powershell.exe 3972 powershell.exe 3972 powershell.exe 3972 powershell.exe 2732 powershell.exe 2732 powershell.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 2480 csrss.exe 2480 csrss.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 2480 csrss.exe 2480 csrss.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 2480 csrss.exe 2480 csrss.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe 1496 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exe20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 4220 powershell.exe Token: SeDebugPrivilege 4188 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Token: SeImpersonatePrivilege 4188 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe Token: SeDebugPrivilege 1364 powershell.exe Token: SeDebugPrivilege 1288 powershell.exe Token: SeDebugPrivilege 4424 powershell.exe Token: SeDebugPrivilege 752 powershell.exe Token: SeDebugPrivilege 3972 powershell.exe Token: SeDebugPrivilege 2732 powershell.exe Token: SeSystemEnvironmentPrivilege 2480 csrss.exe Token: SeSecurityPrivilege 2212 sc.exe Token: SeSecurityPrivilege 2212 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 4188 wrote to memory of 4220 4188 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 4188 wrote to memory of 4220 4188 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 4188 wrote to memory of 4220 4188 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 3152 wrote to memory of 1364 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 3152 wrote to memory of 1364 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 3152 wrote to memory of 1364 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 3152 wrote to memory of 3416 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe cmd.exe PID 3152 wrote to memory of 3416 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe cmd.exe PID 3416 wrote to memory of 892 3416 cmd.exe netsh.exe PID 3416 wrote to memory of 892 3416 cmd.exe netsh.exe PID 3152 wrote to memory of 1288 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 3152 wrote to memory of 1288 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 3152 wrote to memory of 1288 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 3152 wrote to memory of 4424 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 3152 wrote to memory of 4424 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 3152 wrote to memory of 4424 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe powershell.exe PID 3152 wrote to memory of 2480 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe csrss.exe PID 3152 wrote to memory of 2480 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe csrss.exe PID 3152 wrote to memory of 2480 3152 20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe csrss.exe PID 2480 wrote to memory of 752 2480 csrss.exe powershell.exe PID 2480 wrote to memory of 752 2480 csrss.exe powershell.exe PID 2480 wrote to memory of 752 2480 csrss.exe powershell.exe PID 2480 wrote to memory of 3972 2480 csrss.exe powershell.exe PID 2480 wrote to memory of 3972 2480 csrss.exe powershell.exe PID 2480 wrote to memory of 3972 2480 csrss.exe powershell.exe PID 2480 wrote to memory of 2732 2480 csrss.exe powershell.exe PID 2480 wrote to memory of 2732 2480 csrss.exe powershell.exe PID 2480 wrote to memory of 2732 2480 csrss.exe powershell.exe PID 2480 wrote to memory of 1496 2480 csrss.exe injector.exe PID 2480 wrote to memory of 1496 2480 csrss.exe injector.exe PID 892 wrote to memory of 4580 892 windefender.exe cmd.exe PID 892 wrote to memory of 4580 892 windefender.exe cmd.exe PID 892 wrote to memory of 4580 892 windefender.exe cmd.exe PID 4580 wrote to memory of 2212 4580 cmd.exe sc.exe PID 4580 wrote to memory of 2212 4580 cmd.exe sc.exe PID 4580 wrote to memory of 2212 4580 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe"C:\Users\Admin\AppData\Local\Temp\20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe"C:\Users\Admin\AppData\Local\Temp\20feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1364 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:892 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1288 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1112 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:2156
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1496 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4932 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2272,i,4858140932023865871,5726683989663339295,262144 --variations-seed-version /prefetch:81⤵PID:5008
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
PID:1664
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5eb32703972021e535c18eb8360ef4dc3
SHA13dd5a661f9eab98a96586e935a45324fe955da62
SHA256f84cc2ca0c1bce13b035f79d8a5ee1654e51587c62e43e0d0f03e4573c5665d1
SHA512d65a313eb1e0fdb2384af0f2e5c2b114ceb2bfc0a53c9fd0c6c3dc25d5c61e5ad0bb2fc5f8b717ef5f863237333197bc686dcf21ec79ced9e7420272816ae956
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5230c513883dc4d363ac5700616bb245b
SHA15729019f219971107f797810d3c258eda03f7282
SHA2567a1c7dbb814ec0adcf82e980d63f84012b9c8e9d88e1bee9755d3c58b6489eae
SHA512936abcca7494daaa024ec132b963251df2fa876a37a6a5b127c752064d4b7fa76329b8b0574ae971da78742e2ee05c5e8fee6a1610b5e2da80476fc8ebc0d4b2
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD533ed97ca795b0aaa78006e04e744eac9
SHA1974c5775b1c7f369d6b12ace7d16e577538b7f4b
SHA2567959ca022d055b4b3897fb26b8f9502bc1900dcd494ccb45d152e7d90219af71
SHA5121ccddb7d430c9c6f857ae6048a9b97039ead89aa689b4ee73c6d1df24cfd808d6a70831ecbb2863b82cc332677b13b4e4ea28a4c894193af08c273879df8653a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5597d761e51acbf330d3e50ff4967f7af
SHA193e5f823f6b819a50d35fe09a1fef2db1521e75e
SHA256c19f61eed59e2404b905c2b598aef2433e731ad6ff64f755b1a70986f72bc4b7
SHA512016167c94ad48ec8c3b82cec3e63b057ac118a468f7ab034ec3adc408d34dad789b9a9bc0c175418726b5b784dc7d8e356d3cc79ef78d2805b4d03eef70cae78
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD561c71de64e2677f37abcfae5c5a7d4eb
SHA1027fe83d75b4c2db3d28f1db7702c5c95b01c8ce
SHA2567860145d0c69a5a381002b0601b376dd82376c16aafd8a50614b71578e4b64e9
SHA512e918f7197b68438f4bb35f4f8a93d41dae0e721cc9b438ecd83e13680bf65dc6876909fa0dcd754b6265a7aeec7edb9d33e4b469723641e07bb86964ffd24ea6
-
Filesize
4.1MB
MD5edc4c9139e0be3af1b1931eb20c68d8d
SHA13a9953a6db123f790ce29fddbec1ce15e0de9741
SHA25620feaf7c5673f594e0e5e1ece1f0754c432522a26918c559f94c4ef875ea6092
SHA512c40b6e1e8700b33dea43164f1cf4238adbc0bac23bf7c2208164f9af52b0a525021d4eacbe924bcdcc2439d2f98e495291a86bdbbd8e9df9963501e2c86fa5ed
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec