Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-05-2024 07:08
Static task
static1
Behavioral task
behavioral1
Sample
e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe
Resource
win10v2004-20240426-en
General
-
Target
e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe
-
Size
4.1MB
-
MD5
a91f291a332061823475e8b9be911856
-
SHA1
9ef1cb5989f72cd90bb05239dea4b71cc4c8318f
-
SHA256
e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d
-
SHA512
b552313a8a830590637742dc61aacd65b1f3635dfc3c1d53f1579115e066806c6e2cd5e1ad556d1086394bc339d80095fcdeb91ce826e56b345aff85889e38e0
-
SSDEEP
98304:g0IUXroYDzElV89sdV2qHm3LaKbYXl7F29tEHWEXgelgSAZWSyDiLx:bIU7SlV8K2X2AhEHFgekc2
Malware Config
Signatures
-
Glupteba payload 19 IoCs
Processes:
resource yara_rule behavioral2/memory/908-2-0x0000000004CE0000-0x00000000055CB000-memory.dmp family_glupteba behavioral2/memory/908-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/908-22-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/908-50-0x0000000004CE0000-0x00000000055CB000-memory.dmp family_glupteba behavioral2/memory/908-60-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/908-75-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4188-74-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/4188-123-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-128-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-196-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-206-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-214-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-217-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-219-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-223-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-226-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-229-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-231-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba behavioral2/memory/244-235-0x0000000000400000-0x0000000002B0C000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2636 netsh.exe -
Executes dropped EXE 4 IoCs
Processes:
csrss.exeinjector.exewindefender.exewindefender.exepid process 244 csrss.exe 3172 injector.exe 564 windefender.exe 2364 windefender.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/564-207-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2364-210-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/564-212-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2364-215-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2364-221-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe -
Drops file in Windows directory 4 IoCs
Processes:
e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.execsrss.exedescription ioc process File opened for modification C:\Windows\rss e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe File created C:\Windows\rss\csrss.exe e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 2636 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3876 powershell.exe 2160 powershell.exe 3044 powershell.exe 3864 powershell.exe 2044 powershell.exe 3264 powershell.exe 1920 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1220 schtasks.exe 1916 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exepowershell.exewindefender.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-592 = "Malay Peninsula Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-512 = "Central Asia Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-691 = "Tasmania Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-282 = "Central Europe Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1802 = "Line Islands Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-501 = "Nepal Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-212 = "Pacific Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-52 = "Greenland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2892 = "Sudan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exee647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exepowershell.exee647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 3876 powershell.exe 3876 powershell.exe 908 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 908 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 2160 powershell.exe 2160 powershell.exe 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe 3044 powershell.exe 3044 powershell.exe 3864 powershell.exe 3864 powershell.exe 2044 powershell.exe 2044 powershell.exe 3264 powershell.exe 3264 powershell.exe 1920 powershell.exe 1920 powershell.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 244 csrss.exe 244 csrss.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 244 csrss.exe 244 csrss.exe 3172 injector.exe 3172 injector.exe 244 csrss.exe 244 csrss.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe 3172 injector.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
powershell.exee647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exedescription pid process Token: SeDebugPrivilege 3876 powershell.exe Token: SeDebugPrivilege 908 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Token: SeImpersonatePrivilege 908 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe Token: SeDebugPrivilege 2160 powershell.exe Token: SeDebugPrivilege 3044 powershell.exe Token: SeDebugPrivilege 3864 powershell.exe Token: SeDebugPrivilege 2044 powershell.exe Token: SeDebugPrivilege 3264 powershell.exe Token: SeDebugPrivilege 1920 powershell.exe Token: SeSystemEnvironmentPrivilege 244 csrss.exe Token: SeSecurityPrivilege 2636 sc.exe Token: SeSecurityPrivilege 2636 sc.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exee647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.execmd.execsrss.exewindefender.execmd.exedescription pid process target process PID 908 wrote to memory of 3876 908 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 908 wrote to memory of 3876 908 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 908 wrote to memory of 3876 908 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 4188 wrote to memory of 2160 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 4188 wrote to memory of 2160 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 4188 wrote to memory of 2160 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 4188 wrote to memory of 4760 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe cmd.exe PID 4188 wrote to memory of 4760 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe cmd.exe PID 4760 wrote to memory of 2636 4760 cmd.exe netsh.exe PID 4760 wrote to memory of 2636 4760 cmd.exe netsh.exe PID 4188 wrote to memory of 3044 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 4188 wrote to memory of 3044 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 4188 wrote to memory of 3044 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 4188 wrote to memory of 3864 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 4188 wrote to memory of 3864 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 4188 wrote to memory of 3864 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe powershell.exe PID 4188 wrote to memory of 244 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe csrss.exe PID 4188 wrote to memory of 244 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe csrss.exe PID 4188 wrote to memory of 244 4188 e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe csrss.exe PID 244 wrote to memory of 2044 244 csrss.exe powershell.exe PID 244 wrote to memory of 2044 244 csrss.exe powershell.exe PID 244 wrote to memory of 2044 244 csrss.exe powershell.exe PID 244 wrote to memory of 3264 244 csrss.exe powershell.exe PID 244 wrote to memory of 3264 244 csrss.exe powershell.exe PID 244 wrote to memory of 3264 244 csrss.exe powershell.exe PID 244 wrote to memory of 1920 244 csrss.exe powershell.exe PID 244 wrote to memory of 1920 244 csrss.exe powershell.exe PID 244 wrote to memory of 1920 244 csrss.exe powershell.exe PID 244 wrote to memory of 3172 244 csrss.exe injector.exe PID 244 wrote to memory of 3172 244 csrss.exe injector.exe PID 564 wrote to memory of 3168 564 windefender.exe cmd.exe PID 564 wrote to memory of 3168 564 windefender.exe cmd.exe PID 564 wrote to memory of 3168 564 windefender.exe cmd.exe PID 3168 wrote to memory of 2636 3168 cmd.exe sc.exe PID 3168 wrote to memory of 2636 3168 cmd.exe sc.exe PID 3168 wrote to memory of 2636 3168 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe"C:\Users\Admin\AppData\Local\Temp\e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe"C:\Users\Admin\AppData\Local\Temp\e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4188 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2636 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1220 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4944
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3172 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1916 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2364
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5c315b6845b90a1d5124d6882328392c4
SHA18d17dc768c3cea1dbfdf92738e1734d86820eca8
SHA256e619895a999903f738dabcbc85fda042cf6d25022ffdf4f5dcd82a849fd6bc66
SHA5121b155135e5b757bddfda04b467ecace26148b7159e963d254911c6fd398eec807afdb48dd00d384b5d0f8b0148e313e646afbb5bad0dadbe986b977c55d31c27
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD52ccebe563d8931def92fe7f863e3f3ac
SHA1ee33ab8ee13a12f79d8af1fb23dc263b4475cb11
SHA2563c3fafc098245d9a2a6775d654ff49c538627ebb8f28f0f55c2a0ccb95f57e77
SHA512df324d1688480a6529b9686d79421b8ee0261ddd220e50cf707d4a897799c32c742518a02ed07196595042f110a5920111cf3419a2aa69db6e3205ec77f32f01
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e6b71f003e2971ec836a580e37eaa3cd
SHA1a07e60d5b1534696521dab56bfa5e056266cb774
SHA256d2a40154f528cb034d2642c77147730654f971e53ca0524e5556e89cf0ab3141
SHA51266e1464e85c77a67a0b84171f189b6c5b211a142ff976b2cff0c0dea4e85358655231b2cf44d0c9e93168f2f452cc95d4d85a558e2badbe526d9101f8f349228
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5f4e22a021967b983a05408e17dfa0ae4
SHA133583be2e2104c98a99ccc5b72b652955e105f05
SHA2564fd18a21b2be42babf1db3aeb7d77cc35c55060439cb926830981d2c8446440b
SHA512c7d6719874c6d44788ae5773b8f49f5a69032cf22b045b4dddd8c222acca4e1f7a88a5b5b438f11c2118671c272dd2696024a85c3bf7513212f544226658ea38
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ba8803d7b297e1fbc25cde3192c26e6e
SHA11a6d181ce50e479c6a60ab451fe0be3791619401
SHA25694adee353774f8c6388c3ba6533c0564fb3302bf8e87a3bae02d76991f761d1b
SHA5120cde553c98f3a729c687881c0eec3f425a89fb74a62575a683221a433b73deb81b21a31f5a776afae4fa874c0524073d80e91cbe47982c30a9415bad9c433e73
-
Filesize
4.1MB
MD5a91f291a332061823475e8b9be911856
SHA19ef1cb5989f72cd90bb05239dea4b71cc4c8318f
SHA256e647ad980d4ad7c55b6e01cf3922c49f0a10a46193ae49b3c3a48be31c51338d
SHA512b552313a8a830590637742dc61aacd65b1f3635dfc3c1d53f1579115e066806c6e2cd5e1ad556d1086394bc339d80095fcdeb91ce826e56b345aff85889e38e0
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec