Malware Analysis Report

2024-11-13 19:44

Sample ID 240517-je8s3sfg5t
Target d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912
SHA256 d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912

Threat Level: Known bad

The file d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

UPX packed file

Executes dropped EXE

Checks installed software on the system

Adds Run key to start application

Manipulates WinMonFS driver.

Drops file in System32 directory

Launches sc.exe

Checks for VirtualBox DLLs, possible anti-VM trick

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Creates scheduled task(s)

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-17 07:36

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-17 07:36

Reported

2024-05-17 07:38

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-722 = "Central Pacific Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2342 = "Haiti Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-392 = "Arab Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-962 = "Paraguay Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1411 = "Syria Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-661 = "Cen. Australia Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-252 = "Dateline Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-91 = "Pacific SA Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-384 = "Namibia Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-451 = "Caucasus Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-351 = "FLE Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-201 = "US Mountain Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-41 = "E. South America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2891 = "Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-601 = "Taipei Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-82 = "Atlantic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4788 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4788 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4788 wrote to memory of 1524 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1836 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1836 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1836 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1836 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\system32\cmd.exe
PID 1836 wrote to memory of 4540 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\system32\cmd.exe
PID 4540 wrote to memory of 3132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 4540 wrote to memory of 3132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 1836 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1836 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1836 wrote to memory of 1640 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1836 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1836 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1836 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1836 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\rss\csrss.exe
PID 1836 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\rss\csrss.exe
PID 1836 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\rss\csrss.exe
PID 5040 wrote to memory of 1200 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5040 wrote to memory of 1200 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5040 wrote to memory of 1200 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5040 wrote to memory of 2492 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5040 wrote to memory of 2492 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5040 wrote to memory of 2492 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5040 wrote to memory of 1996 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5040 wrote to memory of 1996 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5040 wrote to memory of 1996 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 5040 wrote to memory of 3384 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 5040 wrote to memory of 3384 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 1512 wrote to memory of 3720 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 3720 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1512 wrote to memory of 3720 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 3720 wrote to memory of 1420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3720 wrote to memory of 1420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 3720 wrote to memory of 1420 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe

"C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe

"C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.160:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 160.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 29053efd-38d9-4bf8-9fa7-5fa2453a7a96.uuid.alldatadump.org udp
US 8.8.8.8:53 stun1.l.google.com udp
US 8.8.8.8:53 server4.alldatadump.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
US 74.125.250.129:19302 stun1.l.google.com udp
BG 185.82.216.108:443 server4.alldatadump.org tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 129.250.125.74.in-addr.arpa udp
US 8.8.8.8:53 233.130.159.162.in-addr.arpa udp
US 8.8.8.8:53 108.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
BG 185.82.216.108:443 server4.alldatadump.org tcp
BG 185.82.216.108:443 server4.alldatadump.org tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4788-1-0x0000000004730000-0x0000000004B2E000-memory.dmp

memory/4788-2-0x0000000004B30000-0x000000000541B000-memory.dmp

memory/4788-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/1524-4-0x000000007498E000-0x000000007498F000-memory.dmp

memory/1524-5-0x0000000002E30000-0x0000000002E66000-memory.dmp

memory/1524-6-0x0000000074980000-0x0000000075130000-memory.dmp

memory/1524-7-0x00000000056B0000-0x0000000005CD8000-memory.dmp

memory/1524-8-0x0000000005560000-0x0000000005582000-memory.dmp

memory/1524-9-0x0000000005600000-0x0000000005666000-memory.dmp

memory/1524-10-0x0000000005DD0000-0x0000000005E36000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0sdv5ocq.h31.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/1524-20-0x0000000005F40000-0x0000000006294000-memory.dmp

memory/1524-21-0x0000000006410000-0x000000000642E000-memory.dmp

memory/1524-22-0x0000000006450000-0x000000000649C000-memory.dmp

memory/1524-23-0x0000000007580000-0x00000000075C4000-memory.dmp

memory/1524-24-0x0000000007730000-0x00000000077A6000-memory.dmp

memory/1524-25-0x0000000007E30000-0x00000000084AA000-memory.dmp

memory/1524-26-0x00000000077D0000-0x00000000077EA000-memory.dmp

memory/1524-29-0x0000000070820000-0x000000007086C000-memory.dmp

memory/1524-30-0x0000000070F80000-0x00000000712D4000-memory.dmp

memory/1524-28-0x0000000007990000-0x00000000079C2000-memory.dmp

memory/4788-27-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/1524-42-0x00000000079F0000-0x0000000007A93000-memory.dmp

memory/1524-43-0x0000000074980000-0x0000000075130000-memory.dmp

memory/1524-41-0x0000000074980000-0x0000000075130000-memory.dmp

memory/1524-40-0x00000000079D0000-0x00000000079EE000-memory.dmp

memory/1524-44-0x0000000007AE0000-0x0000000007AEA000-memory.dmp

memory/1524-45-0x0000000074980000-0x0000000075130000-memory.dmp

memory/1524-46-0x0000000007BF0000-0x0000000007C86000-memory.dmp

memory/1524-47-0x0000000007AF0000-0x0000000007B01000-memory.dmp

memory/1524-48-0x0000000007B30000-0x0000000007B3E000-memory.dmp

memory/1524-49-0x0000000007B50000-0x0000000007B64000-memory.dmp

memory/1524-50-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

memory/1524-51-0x0000000007B90000-0x0000000007B98000-memory.dmp

memory/1524-54-0x0000000074980000-0x0000000075130000-memory.dmp

memory/4788-56-0x0000000004730000-0x0000000004B2E000-memory.dmp

memory/4788-57-0x0000000004B30000-0x000000000541B000-memory.dmp

memory/4788-58-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2832-68-0x0000000006220000-0x0000000006574000-memory.dmp

memory/2832-69-0x0000000070820000-0x000000007086C000-memory.dmp

memory/2832-70-0x00000000709A0000-0x0000000070CF4000-memory.dmp

memory/2832-80-0x0000000007800000-0x00000000078A3000-memory.dmp

memory/2832-81-0x0000000007B30000-0x0000000007B41000-memory.dmp

memory/4788-82-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2832-83-0x0000000007B80000-0x0000000007B94000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 8d24a5f5a7ec7ab2bc2c990f7cf6bdb0
SHA1 8564ca6a67c31b736abcb1667b7e31f8247c3ea4
SHA256 b66c6e66bf7b7772329e623ccf3a3371288d5373b79c3381ba6f99dbb93ba715
SHA512 de29e8e7c5139b322868b07e3cc531f59fa259774ce6e2ebc2abc81deffb057add8bac38e98ecda5c2313931296f0396cff430a64409dbdb905c0a359e0f1d68

memory/1640-97-0x0000000070820000-0x000000007086C000-memory.dmp

memory/1640-98-0x0000000070F80000-0x00000000712D4000-memory.dmp

memory/1836-108-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4548-110-0x0000000005560000-0x00000000058B4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 71698f7d21ef7880c7ad9189ce593b37
SHA1 260cc012c642e2c2bf4dabd9ea2a13e5a766c040
SHA256 4896d3502065cc41f0cae878b90b71077f2b99dc5bd188bb427f079c689ec523
SHA512 231bafa2d8840c945a9d982c9781350ca00a4341eb227e7fb23df5a9edb4c013cf8d1f84a96da2ecea8975337f4508f4d00569cbfee177a491cc0a938ba1cac3

memory/4548-122-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/4548-121-0x0000000070820000-0x000000007086C000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 750a1eda2b6bc78ba43853949fca2b03
SHA1 b766c146a67d891a54c54cf145c4c24d8330e940
SHA256 d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912
SHA512 24f0b70f01ba1274bb0b6f0864dc2bdf103e4137982a4c61951780e82b4a76a73839b5d61a3e4db6def09ab35fb552675ef0769a2b864375ee68dd9396a7f44a

memory/1836-137-0x0000000000400000-0x0000000002B0C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 7b3c145d71e3ef0768732c616893654d
SHA1 acae49ce75a7ec0fe6026e7e723426bf44e49e9c
SHA256 a664367a7d7977e8caab7374c4b6bb70620fd3d10d97347db14026da58e7fc7f
SHA512 e3f22733976d1c2a0c1de3e23cc557da146c9299bcb26c416b732c32e19cb5fea1f749b8f5f867e6820259264b79c50b2bb3108e9b4fd3ba4b0f32608ece70e3

memory/1200-150-0x0000000070820000-0x000000007086C000-memory.dmp

memory/1200-151-0x0000000070FA0000-0x00000000712F4000-memory.dmp

memory/2492-171-0x0000000005630000-0x0000000005984000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 6e3c579b3078fe9abe4665371c29b6a6
SHA1 1f389d15792599ec84d4c87ce11ddfb76ceaea53
SHA256 f3c9c00755d4fa0517f1d1e2c0fadbf135ed348080ea33bd373d1b238588a8f5
SHA512 3cb82806ce507ff34937c53a1978dbdebf792ed4cead5854fb375bbd6a01f81cb5446f54c24820abb765596b1ec8ab0fc2b8359b9fc59a6370824a2f251d2d8a

memory/2492-173-0x0000000005B80000-0x0000000005BCC000-memory.dmp

memory/5040-174-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2492-175-0x0000000070740000-0x000000007078C000-memory.dmp

memory/2492-176-0x00000000708E0000-0x0000000070C34000-memory.dmp

memory/2492-186-0x0000000006D70000-0x0000000006E13000-memory.dmp

memory/2492-187-0x00000000070C0000-0x00000000070D1000-memory.dmp

memory/2492-188-0x0000000004E70000-0x0000000004E84000-memory.dmp

memory/1996-199-0x0000000005E70000-0x00000000061C4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c06c933939519d9a1f99fe2ab3980410
SHA1 0e0bc910d4fe7ed6500b2de989ad90c7178ab521
SHA256 a6dc56f21e6a08ef888b464dd148a2b22ff95ccd0a9df1b7d4d7cbdb70fdcbce
SHA512 86843da42d88f81f18fd147dc41244499ed9ce2d7ed9c9072b0a683dc817c7c426f9ed3c7b91096e04b4b3abb43ae717c5a8981898684b917eff848eca1c9d7a

memory/1996-202-0x0000000070EF0000-0x0000000071244000-memory.dmp

memory/1996-201-0x0000000070740000-0x000000007078C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/5040-219-0x0000000000400000-0x0000000002B0C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/1512-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1432-227-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1512-229-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/5040-230-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/1432-232-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/5040-233-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/5040-236-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/1432-238-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/5040-239-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/5040-242-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/5040-245-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/5040-248-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/5040-251-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/5040-254-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/5040-257-0x0000000000400000-0x0000000002B0C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-17 07:36

Reported

2024-05-17 07:38

Platform

win11-20240508-en

Max time kernel

150s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-621 = "Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2342 = "Haiti Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-961 = "Paraguay Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1412 = "Syria Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-492 = "India Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-741 = "New Zealand Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-352 = "FLE Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-372 = "Jerusalem Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3141 = "South Sudan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-672 = "AUS Eastern Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-541 = "Myanmar Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-141 = "Canada Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2432 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2432 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\system32\cmd.exe
PID 3268 wrote to memory of 2960 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\system32\cmd.exe
PID 2960 wrote to memory of 1684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2960 wrote to memory of 1684 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3268 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 4280 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 3440 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3268 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\rss\csrss.exe
PID 3268 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\rss\csrss.exe
PID 3268 wrote to memory of 3524 N/A C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe C:\Windows\rss\csrss.exe
PID 3524 wrote to memory of 4756 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 4756 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 4756 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 3896 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 3896 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 3896 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 680 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 680 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 680 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3524 wrote to memory of 2784 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3524 wrote to memory of 2784 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 4852 wrote to memory of 1284 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 1284 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4852 wrote to memory of 1284 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1284 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1284 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 1284 wrote to memory of 2308 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe

"C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe

"C:\Users\Admin\AppData\Local\Temp\d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 a49823d8-6d60-404d-8a4c-5765ea902362.uuid.alldatadump.org udp
US 8.8.8.8:53 server10.alldatadump.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
US 74.125.250.129:19302 stun3.l.google.com udp
US 162.159.130.233:443 cdn.discordapp.com tcp
BG 185.82.216.108:443 server10.alldatadump.org tcp
US 172.67.221.71:443 carsalessystem.com tcp
BG 185.82.216.108:443 server10.alldatadump.org tcp
US 52.111.229.48:443 tcp
BG 185.82.216.108:443 server10.alldatadump.org tcp

Files

memory/2432-1-0x0000000004860000-0x0000000004C59000-memory.dmp

memory/2432-2-0x0000000004C60000-0x000000000554B000-memory.dmp

memory/2432-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2680-4-0x000000007456E000-0x000000007456F000-memory.dmp

memory/2680-5-0x0000000005170000-0x00000000051A6000-memory.dmp

memory/2680-7-0x00000000057E0000-0x0000000005E0A000-memory.dmp

memory/2680-6-0x0000000074560000-0x0000000074D11000-memory.dmp

memory/2680-8-0x0000000005770000-0x0000000005792000-memory.dmp

memory/2680-9-0x0000000005E80000-0x0000000005EE6000-memory.dmp

memory/2680-10-0x00000000060E0000-0x0000000006146000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eoocc4ri.l2e.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2680-19-0x0000000074560000-0x0000000074D11000-memory.dmp

memory/2680-20-0x0000000006150000-0x00000000064A7000-memory.dmp

memory/2680-21-0x0000000006610000-0x000000000662E000-memory.dmp

memory/2680-22-0x00000000066C0000-0x000000000670C000-memory.dmp

memory/2680-23-0x0000000006BD0000-0x0000000006C16000-memory.dmp

memory/2680-25-0x0000000007A20000-0x0000000007A54000-memory.dmp

memory/2680-26-0x00000000707D0000-0x000000007081C000-memory.dmp

memory/2680-27-0x0000000070950000-0x0000000070CA7000-memory.dmp

memory/2680-37-0x0000000007AA0000-0x0000000007B44000-memory.dmp

memory/2680-36-0x0000000007A80000-0x0000000007A9E000-memory.dmp

memory/2680-38-0x0000000074560000-0x0000000074D11000-memory.dmp

memory/2432-24-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2680-39-0x0000000074560000-0x0000000074D11000-memory.dmp

memory/2680-40-0x0000000008210000-0x000000000888A000-memory.dmp

memory/2680-41-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

memory/2680-42-0x0000000007C30000-0x0000000007C3A000-memory.dmp

memory/2680-43-0x0000000007D40000-0x0000000007DD6000-memory.dmp

memory/2680-44-0x0000000007C50000-0x0000000007C61000-memory.dmp

memory/2680-45-0x0000000007CA0000-0x0000000007CAE000-memory.dmp

memory/2680-46-0x0000000007CB0000-0x0000000007CC5000-memory.dmp

memory/2680-47-0x0000000007D00000-0x0000000007D1A000-memory.dmp

memory/2680-48-0x0000000007D20000-0x0000000007D28000-memory.dmp

memory/2680-51-0x0000000074560000-0x0000000074D11000-memory.dmp

memory/2432-53-0x0000000004860000-0x0000000004C59000-memory.dmp

memory/2432-54-0x0000000004C60000-0x000000000554B000-memory.dmp

memory/4356-63-0x0000000005C70000-0x0000000005FC7000-memory.dmp

memory/2432-64-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4356-65-0x00000000707D0000-0x000000007081C000-memory.dmp

memory/4356-66-0x0000000070A00000-0x0000000070D57000-memory.dmp

memory/4356-75-0x0000000007440000-0x00000000074E4000-memory.dmp

memory/4356-76-0x0000000007740000-0x0000000007751000-memory.dmp

memory/4356-77-0x0000000007790000-0x00000000077A5000-memory.dmp

memory/2432-81-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/3268-80-0x0000000000400000-0x0000000002B0C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 ac4917a885cf6050b1a483e4bc4d2ea5
SHA1 b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256 e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512 092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d

memory/4280-91-0x0000000005CE0000-0x0000000006037000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 0df13614b9601694eb193004023f4e7a
SHA1 5931d277315a251cff7a0446c52202341f456d71
SHA256 d8e9f6d02c2274747606936833b1e41aa7ea29f248119ef48362b15e6b2e5b78
SHA512 efdfbb19f850429d434ecd7f37e5954e9908427edc6c3093a9225ad2b61e78256ba840e5da74154728795c767139d1a0173ae73c6275160e48384da73932939e

memory/4280-93-0x00000000707D0000-0x000000007081C000-memory.dmp

memory/4280-94-0x00000000709E0000-0x0000000070D37000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 00b3626765a6cb379685d4e25419f827
SHA1 329b6168ccfe714d3d719f9f0300ebd774546730
SHA256 7c54e7a17a205f0bd153fed242518e53314330a95cb1bd2ec823ab0e1539aa88
SHA512 824000065800143bcf162889a5b4b8150e69d67ad1527640cf9289301d8e20207801064057a5d344ad81936934c6134af1989ac007c02d85b584686d23d8a046

memory/3440-113-0x00000000707D0000-0x000000007081C000-memory.dmp

memory/3440-114-0x0000000070950000-0x0000000070CA7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 750a1eda2b6bc78ba43853949fca2b03
SHA1 b766c146a67d891a54c54cf145c4c24d8330e940
SHA256 d8f51a68fb44f7cc9fe241e8c95b00c23440f8bd6d1a0969003b8aea1dbf6912
SHA512 24f0b70f01ba1274bb0b6f0864dc2bdf103e4137982a4c61951780e82b4a76a73839b5d61a3e4db6def09ab35fb552675ef0769a2b864375ee68dd9396a7f44a

memory/3268-130-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4756-132-0x0000000005630000-0x0000000005987000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 68d709452190d35bd3624000c3b3deb0
SHA1 1cddbfd6dcae24ce56c05e69bbc015739c4e82fc
SHA256 e6e83f296772563dd2c8076b0867c55618d6eccf98fa2ae26027cc118d85a8e2
SHA512 1a8b4969d27dc767bebc56a550a1d401ae4d5f796bfe609db6745758c73454b0c1d07a4b1721d4f74bad5c0b71d4dff2b6bac1b6eed186e06c42ddbd8caca9cb

memory/4756-143-0x0000000070A20000-0x0000000070D77000-memory.dmp

memory/4756-142-0x00000000707D0000-0x000000007081C000-memory.dmp

memory/3896-161-0x0000000005A30000-0x0000000005D87000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4703e73adee78434cb780ca340966b30
SHA1 79073006bbdab174eab7eefa26160615fd03009b
SHA256 7904153962cf7fbfb850b2676f31087d5d5fc5463e95d4adb5f44b95f312aeb7
SHA512 ec77dbd30df7c959fef5336378b9a7a40288c7327a5f10ca2c77a6c6741ec98ce4c55fe5e49ea50940ec2f108db4fe4457ff308afc1146b5142eafda0be33522

memory/3896-163-0x0000000006540000-0x000000000658C000-memory.dmp

memory/3896-165-0x00000000706F0000-0x000000007073C000-memory.dmp

memory/3896-166-0x0000000070920000-0x0000000070C77000-memory.dmp

memory/3896-175-0x0000000007240000-0x00000000072E4000-memory.dmp

memory/3896-176-0x00000000075C0000-0x00000000075D1000-memory.dmp

memory/3896-177-0x0000000005DB0000-0x0000000005DC5000-memory.dmp

memory/680-187-0x0000000006060000-0x00000000063B7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 2d33de345cf9b16676364e5cf0d7044a
SHA1 bf218bceb22e5d96797b3c13f06d499b51cfe0be
SHA256 85a514dea4f9026ddfbec847e1314e355f0897a034e2ff77c8b9418ece56f44e
SHA512 113a91a257e5e4dff2ad85a19db7d319d4b31f6017569415d933a418a105567e9c10cb338b056a4ccc23d1e9bf24bab4d76b2fd06808a90ffd73398bcb096585

memory/680-189-0x00000000706F0000-0x000000007073C000-memory.dmp

memory/680-190-0x0000000070870000-0x0000000070BC7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3524-206-0x0000000000400000-0x0000000002B0C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/4852-212-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4136-215-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4852-217-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3524-218-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4136-222-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3524-221-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3524-225-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4136-230-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3524-229-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3524-233-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3524-238-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3524-241-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3524-245-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3524-249-0x0000000000400000-0x0000000002B0C000-memory.dmp