Malware Analysis Report

2024-11-13 19:44

Sample ID 240517-jhfayagc33
Target 8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87
SHA256 8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87
Tags
glupteba discovery dropper evasion execution loader persistence rootkit upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87

Threat Level: Known bad

The file 8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87 was found to be: Known bad.

Malicious Activity Summary

glupteba discovery dropper evasion execution loader persistence rootkit upx

Glupteba payload

Glupteba

Modifies Windows Firewall

Executes dropped EXE

UPX packed file

Adds Run key to start application

Checks installed software on the system

Manipulates WinMonFS driver.

Drops file in System32 directory

Checks for VirtualBox DLLs, possible anti-VM trick

Launches sc.exe

Drops file in Windows directory

Command and Scripting Interpreter: PowerShell

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Creates scheduled task(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-17 07:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-17 07:39

Reported

2024-05-17 07:42

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\windefender.exe N/A
N/A N/A C:\Windows\windefender.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Manipulates WinMonFS driver.

rootkit evasion
Description Indicator Process Target
File opened for modification \??\WinMonFS C:\Windows\rss\csrss.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
File created C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A
File opened for modification C:\Windows\windefender.exe C:\Windows\rss\csrss.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-262 = "GMT Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2061 = "North Korea Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2892 = "Sudan Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-3142 = "South Sudan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-652 = "AUS Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-591 = "Malay Peninsula Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-449 = "Azerbaijan Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-362 = "GTB Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-572 = "China Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Windows\rss\csrss.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\rss\csrss.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\sc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2552 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2552 wrote to memory of 4976 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 2364 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\system32\cmd.exe
PID 2204 wrote to memory of 5004 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\system32\cmd.exe
PID 5004 wrote to memory of 804 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 5004 wrote to memory of 804 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 2204 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 4852 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 3704 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2204 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\rss\csrss.exe
PID 2204 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\rss\csrss.exe
PID 2204 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\rss\csrss.exe
PID 3972 wrote to memory of 2396 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 2396 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 2396 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 2624 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 2624 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 2624 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 4988 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 4988 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 4988 N/A C:\Windows\rss\csrss.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3972 wrote to memory of 3928 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 3972 wrote to memory of 3928 N/A C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
PID 2944 wrote to memory of 4008 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 4008 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2944 wrote to memory of 4008 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 4008 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4008 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 4008 wrote to memory of 2768 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe

"C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe

"C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 999ce9c0-5c00-43dd-b42b-63d697d6bab5.uuid.datadumpcloud.org udp
US 8.8.8.8:53 stun.stunprotocol.org udp
US 8.8.8.8:53 server4.datadumpcloud.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
BG 185.82.216.104:443 server4.datadumpcloud.org tcp
US 162.159.134.233:443 cdn.discordapp.com tcp
US 8.8.8.8:53 carsalessystem.com udp
US 172.67.221.71:443 carsalessystem.com tcp
US 8.8.8.8:53 233.134.159.162.in-addr.arpa udp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
US 8.8.8.8:53 71.221.67.172.in-addr.arpa udp
N/A 127.0.0.1:3478 udp
BG 185.82.216.104:443 server4.datadumpcloud.org tcp
US 8.8.8.8:53 stun.ipfire.org udp
DE 81.3.27.44:3478 stun.ipfire.org udp
US 8.8.8.8:53 44.27.3.81.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
BG 185.82.216.104:443 server4.datadumpcloud.org tcp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp

Files

memory/2552-1-0x0000000004730000-0x0000000004B31000-memory.dmp

memory/2552-2-0x0000000004B40000-0x000000000542B000-memory.dmp

memory/2552-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/4976-4-0x000000007427E000-0x000000007427F000-memory.dmp

memory/4976-5-0x0000000005180000-0x00000000051B6000-memory.dmp

memory/4976-7-0x0000000074270000-0x0000000074A20000-memory.dmp

memory/4976-6-0x0000000005890000-0x0000000005EB8000-memory.dmp

memory/4976-9-0x0000000074270000-0x0000000074A20000-memory.dmp

memory/2552-8-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4976-10-0x0000000005EC0000-0x0000000005EE2000-memory.dmp

memory/4976-11-0x0000000005FE0000-0x0000000006046000-memory.dmp

memory/4976-12-0x00000000060C0000-0x0000000006126000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pck5gsso.cqh.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4976-19-0x00000000061B0000-0x0000000006504000-memory.dmp

memory/4976-23-0x00000000067D0000-0x00000000067EE000-memory.dmp

memory/4976-24-0x0000000006870000-0x00000000068BC000-memory.dmp

memory/4976-25-0x0000000007910000-0x0000000007954000-memory.dmp

memory/4976-26-0x0000000007A70000-0x0000000007AE6000-memory.dmp

memory/4976-27-0x0000000008170000-0x00000000087EA000-memory.dmp

memory/4976-28-0x0000000007B10000-0x0000000007B2A000-memory.dmp

memory/4976-29-0x0000000007CD0000-0x0000000007D02000-memory.dmp

memory/4976-31-0x00000000708B0000-0x0000000070C04000-memory.dmp

memory/4976-43-0x0000000007D30000-0x0000000007DD3000-memory.dmp

memory/4976-42-0x0000000007D10000-0x0000000007D2E000-memory.dmp

memory/4976-44-0x0000000074270000-0x0000000074A20000-memory.dmp

memory/4976-32-0x0000000074270000-0x0000000074A20000-memory.dmp

memory/4976-30-0x0000000070110000-0x000000007015C000-memory.dmp

memory/4976-45-0x0000000007E20000-0x0000000007E2A000-memory.dmp

memory/4976-46-0x0000000007F30000-0x0000000007FC6000-memory.dmp

memory/4976-47-0x0000000007E30000-0x0000000007E41000-memory.dmp

memory/4976-48-0x0000000007E70000-0x0000000007E7E000-memory.dmp

memory/4976-49-0x0000000007E90000-0x0000000007EA4000-memory.dmp

memory/4976-50-0x0000000007ED0000-0x0000000007EEA000-memory.dmp

memory/4976-51-0x0000000007EC0000-0x0000000007EC8000-memory.dmp

memory/4976-54-0x0000000074270000-0x0000000074A20000-memory.dmp

memory/2552-57-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2552-58-0x0000000004B40000-0x000000000542B000-memory.dmp

memory/2552-55-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2364-68-0x0000000006370000-0x00000000066C4000-memory.dmp

memory/2364-69-0x0000000006970000-0x00000000069BC000-memory.dmp

memory/2364-70-0x0000000070210000-0x000000007025C000-memory.dmp

memory/2364-71-0x0000000070390000-0x00000000706E4000-memory.dmp

memory/2364-81-0x0000000007B10000-0x0000000007BB3000-memory.dmp

memory/2364-82-0x0000000007E30000-0x0000000007E41000-memory.dmp

memory/2204-83-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2364-84-0x0000000007E80000-0x0000000007E94000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4124af351ed173c77a445aa0ed372b31
SHA1 343bad70d171a28dc40bc1692a7459843c44d12a
SHA256 af244dc3a7e6097ed3c9c8a999e023b7689240b4de6285440836ec987a40b706
SHA512 ae8838eefdd652a61e3fa5e37f0398ee068c1ca79ec6ab83e6d70fff210dd55f96d69f34a826bdb8f86662f49090a5c30cb8157317d79313b26c7f90ed121dc0

memory/4852-98-0x0000000070210000-0x000000007025C000-memory.dmp

memory/4852-99-0x0000000070390000-0x00000000706E4000-memory.dmp

memory/3704-119-0x0000000005F00000-0x0000000006254000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 e3b5a18eaba04af3bbd22c7bb903898b
SHA1 b0bbf80d0d68e23552e8b16b4324cb88836bd2f8
SHA256 61179491403f1158c6c4bf6c521b49b2bc276e407160cbfad7196a83aed84cce
SHA512 ba4fbb4ed57ef4d18bfb515c56ae8287bc7bbcdee917af5dab2bb42dccf8c0097c0030f58f721f3a6063feffef300b9e6cd8a46f040e4bcb1e2b157111c65528

memory/3704-121-0x0000000070210000-0x000000007025C000-memory.dmp

memory/3704-122-0x00000000703C0000-0x0000000070714000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 9488a1add393c655e00741529f1a2c72
SHA1 0c234c1dd855c39b8d2653d302d78c40e9f4a2f1
SHA256 8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87
SHA512 c851274058ecf86037cbe7961b73c0402efc6c4cc84e24970bdcd94d39fc4fb0b39cb5ab600adc042759310f9529b73c6959ccc8114c9378923e735c29a2814f

memory/2204-137-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2396-148-0x0000000006330000-0x0000000006684000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 bd6bc0f7b704565b1060eb5196ae57c1
SHA1 8d9ce3af43046907018d0b925501a92d438d36e8
SHA256 ba05e4a562f8ed204c1285cfe3cfea1d0d39f64c69e28787f6a56f2bff509a12
SHA512 c3d51d2f5e9b6df0d8255592618db607205d7133102c4368313511d885640cf3001f93626bbe71eb61aca03f427c2231e172cc3e49be75a641ffd3f99ff6eea7

memory/2396-150-0x0000000006B60000-0x0000000006BAC000-memory.dmp

memory/2396-151-0x0000000070170000-0x00000000701BC000-memory.dmp

memory/2396-152-0x0000000070930000-0x0000000070C84000-memory.dmp

memory/2396-162-0x0000000007C20000-0x0000000007CC3000-memory.dmp

memory/2396-163-0x00000000067E0000-0x00000000067F1000-memory.dmp

memory/3972-164-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2396-165-0x0000000006820000-0x0000000006834000-memory.dmp

memory/2624-176-0x0000000006040000-0x0000000006394000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 573ec944862fac885c6576716ea7a53c
SHA1 5b07144263c9eab8a9fc5297a76def928cbd9e84
SHA256 81e7a19306a036289e0ce2324f7e9e69548172e1f9fd7686147022bdeead1ab1
SHA512 d7c53dd86f6856d1fb5b409fd5086de04dffd1cb07c860ab8fe51ec6d4b3c002b6027d608b560a804b81dcc7322c9997953ecd77098df77afefec945b1718e3f

memory/2624-178-0x00000000065F0000-0x000000000663C000-memory.dmp

memory/2624-180-0x0000000070210000-0x0000000070564000-memory.dmp

memory/2624-179-0x0000000070090000-0x00000000700DC000-memory.dmp

memory/2624-190-0x0000000007820000-0x00000000078C3000-memory.dmp

memory/2624-191-0x00000000063A0000-0x00000000063B1000-memory.dmp

memory/2624-192-0x00000000063E0000-0x00000000063F4000-memory.dmp

memory/4988-194-0x0000000005E70000-0x00000000061C4000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 1f08ba15aa93fbc5c7d7a3af46b6d56f
SHA1 96bb6a34df53d641315350c66e14dbfcdce2e539
SHA256 627ab0566c8d39713987aea7204be824b38664a983faeca4740d6b05a42dacdd
SHA512 8ec68f43d2b36a36313df7b7065f62b83703a068eeae3311b1cb0f096ad4cccf2b8bc620f93a7bd7c24068fbfec87349874b0ba0a2628035347ea66a688306d5

memory/4988-205-0x0000000070090000-0x00000000700DC000-memory.dmp

memory/4988-206-0x0000000070820000-0x0000000070B74000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

memory/3972-222-0x0000000000400000-0x0000000002B0C000-memory.dmp

C:\Windows\windefender.exe

MD5 8e67f58837092385dcf01e8a2b4f5783
SHA1 012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256 166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA512 40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

memory/2944-226-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2944-229-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3972-230-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2684-231-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3972-232-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3972-234-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2684-235-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/3972-236-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3972-238-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3972-240-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3972-242-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3972-244-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/3972-246-0x0000000000400000-0x0000000002B0C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-17 07:39

Reported

2024-05-17 07:42

Platform

win11-20240419-en

Max time kernel

149s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe"

Signatures

Glupteba

loader dropper glupteba

Glupteba payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\rss\csrss.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" C:\Windows\rss\csrss.exe N/A

Checks installed software on the system

discovery

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Checks for VirtualBox DLLs, possible anti-VM trick

Description Indicator Process Target
File opened (read-only) \??\VBoxMiniRdrDN C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\rss\csrss.exe C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
File opened for modification C:\Windows\rss C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A
N/A N/A C:\Windows\SYSTEM32\schtasks.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-151 = "Central America Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-342 = "Egypt Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-792 = "SA Western Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2452 = "Saint Pierre Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2752 = "Tomsk Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-931 = "Coordinated Universal Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-162 = "Central Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1801 = "Line Islands Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2771 = "Omsk Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-431 = "Iran Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2321 = "Sakhalin Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-651 = "AUS Central Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-191 = "Mountain Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2611 = "Bougainville Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2322 = "Sakhalin Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-771 = "Montevideo Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-982 = "Kamchatka Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1831 = "Russia TZ 2 Daylight Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-2181 = "Astrakhan Daylight Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-1912 = "Russia TZ 10 Standard Time" C:\Windows\windefender.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@tzres.dll,-105 = "Central Brazilian Standard Time" C:\Windows\windefender.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3380 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3380 wrote to memory of 2220 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 780 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 780 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 780 wrote to memory of 4472 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 780 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\system32\cmd.exe
PID 780 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\system32\cmd.exe
PID 3920 wrote to memory of 3004 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3920 wrote to memory of 3004 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 780 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 780 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 780 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 780 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 780 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 780 wrote to memory of 1652 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 780 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\rss\csrss.exe
PID 780 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\rss\csrss.exe
PID 780 wrote to memory of 4652 N/A C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe C:\Windows\rss\csrss.exe
PID 1796 wrote to memory of 2152 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 2152 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 1796 wrote to memory of 2152 N/A C:\Windows\windefender.exe C:\Windows\SysWOW64\cmd.exe
PID 2152 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe
PID 2152 wrote to memory of 2752 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\sc.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe

"C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe

"C:\Users\Admin\AppData\Local\Temp\8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\system32\cmd.exe

C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"

C:\Windows\system32\netsh.exe

netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\rss\csrss.exe

C:\Windows\rss\csrss.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\SYSTEM32\schtasks.exe

schtasks /delete /tn ScheduledUpdate /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -nologo -noprofile

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll

C:\Windows\SYSTEM32\schtasks.exe

schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F

C:\Windows\windefender.exe

"C:\Windows\windefender.exe"

C:\Windows\SysWOW64\cmd.exe

cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\SysWOW64\sc.exe

sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:\Windows\windefender.exe

C:\Windows\windefender.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 7ac7d1b7-04b7-4b36-92bb-d69e1f908ea7.uuid.datadumpcloud.org udp
US 8.8.8.8:53 server4.datadumpcloud.org udp
US 8.8.8.8:53 cdn.discordapp.com udp
BG 185.82.216.104:443 server4.datadumpcloud.org tcp
US 162.159.129.233:443 cdn.discordapp.com tcp
US 3.33.249.248:3478 stun.sipgate.net udp
US 104.21.94.82:443 carsalessystem.com tcp
US 8.8.8.8:53 104.216.82.185.in-addr.arpa udp
BG 185.82.216.104:443 server4.datadumpcloud.org tcp
BG 185.82.216.104:443 server4.datadumpcloud.org tcp

Files

memory/3380-1-0x0000000004840000-0x0000000004C40000-memory.dmp

memory/3380-2-0x0000000004C40000-0x000000000552B000-memory.dmp

memory/3380-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/2220-4-0x00000000743DE000-0x00000000743DF000-memory.dmp

memory/2220-5-0x0000000004ED0000-0x0000000004F06000-memory.dmp

memory/2220-7-0x0000000005540000-0x0000000005B6A000-memory.dmp

memory/2220-6-0x00000000743D0000-0x0000000074B81000-memory.dmp

memory/2220-8-0x00000000743D0000-0x0000000074B81000-memory.dmp

memory/2220-9-0x00000000054C0000-0x00000000054E2000-memory.dmp

memory/2220-10-0x0000000005DC0000-0x0000000005E26000-memory.dmp

memory/2220-11-0x0000000005E30000-0x0000000005E96000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b05btj3e.5o2.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2220-20-0x0000000005EA0000-0x00000000061F7000-memory.dmp

memory/2220-21-0x0000000006370000-0x000000000638E000-memory.dmp

memory/2220-22-0x00000000063B0000-0x00000000063FC000-memory.dmp

memory/2220-23-0x00000000068D0000-0x0000000006916000-memory.dmp

memory/2220-25-0x0000000007780000-0x00000000077B4000-memory.dmp

memory/2220-27-0x00000000707D0000-0x0000000070B27000-memory.dmp

memory/2220-36-0x00000000077E0000-0x00000000077FE000-memory.dmp

memory/2220-38-0x00000000743D0000-0x0000000074B81000-memory.dmp

memory/2220-37-0x0000000007800000-0x00000000078A4000-memory.dmp

memory/2220-26-0x0000000070640000-0x000000007068C000-memory.dmp

memory/3380-24-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2220-39-0x00000000743D0000-0x0000000074B81000-memory.dmp

memory/2220-40-0x0000000007F70000-0x00000000085EA000-memory.dmp

memory/2220-41-0x0000000007930000-0x000000000794A000-memory.dmp

memory/2220-42-0x0000000007970000-0x000000000797A000-memory.dmp

memory/2220-43-0x0000000007A80000-0x0000000007B16000-memory.dmp

memory/2220-44-0x0000000007990000-0x00000000079A1000-memory.dmp

memory/2220-45-0x00000000079E0000-0x00000000079EE000-memory.dmp

memory/2220-46-0x00000000079F0000-0x0000000007A05000-memory.dmp

memory/2220-47-0x0000000007A40000-0x0000000007A5A000-memory.dmp

memory/2220-48-0x0000000007A60000-0x0000000007A68000-memory.dmp

memory/2220-51-0x00000000743D0000-0x0000000074B81000-memory.dmp

memory/3380-53-0x0000000004840000-0x0000000004C40000-memory.dmp

memory/3380-55-0x0000000004C40000-0x000000000552B000-memory.dmp

memory/3380-54-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4472-64-0x0000000006170000-0x00000000064C7000-memory.dmp

memory/4472-65-0x0000000070640000-0x000000007068C000-memory.dmp

memory/4472-66-0x0000000070890000-0x0000000070BE7000-memory.dmp

memory/4472-75-0x00000000078D0000-0x0000000007974000-memory.dmp

memory/4472-76-0x0000000007BF0000-0x0000000007C01000-memory.dmp

memory/3380-78-0x0000000000400000-0x0000000000D1C000-memory.dmp

memory/780-77-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4472-79-0x0000000007C60000-0x0000000007C75000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

memory/3916-91-0x0000000005EA0000-0x00000000061F7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 4d60a33a1103ef9ae1e565bc257b6edf
SHA1 a0a7d36c7baf801940278bbb925146f348e6e775
SHA256 1f4c9c67f9a349cbbbcc2860b6b3d0c260e8bad060d9a8823a2bbb569b94bc9d
SHA512 e411772be7c79f9680d31d07601eafd81400b229a6af1ad26e0a407244736bee14090a721cf249cec1cb4a2d4b684b1c752e421ccb459f24ebff3b0e8ed7309b

memory/3916-93-0x0000000070640000-0x000000007068C000-memory.dmp

memory/3916-94-0x00000000707C0000-0x0000000070B17000-memory.dmp

memory/1652-112-0x0000000006230000-0x0000000006587000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 3436772f3b429a7bbc740b60b9890823
SHA1 f066ceff700b85629fe85a6cd87b6eb88b1d116e
SHA256 1187f90f65f3b05b7c6fd7fd8562b303f65d779bd07b73d4f0105363bccef0d2
SHA512 7585e451f65a9a4c151fdd4a973599a8893f5c50b99aa81bfb3f88aaaa6e8be7ccd09b0d7f8e5e69ddf57b3d98e237b6938844f12c2b94c320f61fb588a6f36e

memory/1652-115-0x0000000070640000-0x000000007068C000-memory.dmp

memory/1652-116-0x0000000070850000-0x0000000070BA7000-memory.dmp

C:\Windows\rss\csrss.exe

MD5 9488a1add393c655e00741529f1a2c72
SHA1 0c234c1dd855c39b8d2653d302d78c40e9f4a2f1
SHA256 8fb9bacf9c4f07ba22534c99b80203a3177dfd26b80fbce6d64030a98a70dd87
SHA512 c851274058ecf86037cbe7961b73c0402efc6c4cc84e24970bdcd94d39fc4fb0b39cb5ab600adc042759310f9529b73c6959ccc8114c9378923e735c29a2814f

memory/780-129-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4652-132-0x0000000000400000-0x0000000002B0C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 26d863f41fab124ad9e4a6af3ae2848d
SHA1 f8de636cbc674d5e0d019565cbab329bf4c525f7
SHA256 3a6a16d64ed16779c1056609cc4b3cc2c59781afd4ce29d9e597078f3485a6b1
SHA512 da9499f61bb5d7339ccad97592b87decf7063bf56160243db7f7f16e75d2e29062ef8596175e5ea1ab5c254f40fca6c644b8a83d6a8e4714af43d0e4fc021609

memory/4252-142-0x0000000070640000-0x000000007068C000-memory.dmp

memory/4252-143-0x0000000070890000-0x0000000070BE7000-memory.dmp

memory/4428-153-0x00000000055A0000-0x00000000058F7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 c06dc8672bef0f85dc4ebf8f3b0d9f8e
SHA1 698e45c39f1abc1216b4895c2200878c78617d1b
SHA256 2a7461f8b7ce36351ae76723adc3ea6ca01170275cab83f96a33019310a7fa04
SHA512 7d17ccbcbbe9e96c7da450cb5b93706fa3cede9270df810575bc3907d7e5642dfc5008f701babb84a2175b52f2992e657758b6695be985e4a408ca58b405c920

memory/4428-163-0x0000000005BC0000-0x0000000005C0C000-memory.dmp

memory/4428-164-0x0000000070560000-0x00000000705AC000-memory.dmp

memory/4428-165-0x00000000707B0000-0x0000000070B07000-memory.dmp

memory/4428-174-0x0000000006DA0000-0x0000000006E44000-memory.dmp

memory/4428-175-0x0000000007130000-0x0000000007141000-memory.dmp

memory/4428-176-0x0000000005940000-0x0000000005955000-memory.dmp

memory/2472-186-0x0000000005EA0000-0x00000000061F7000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

MD5 cd14f0d86109aa0cb8423bd917d8e9e0
SHA1 fe055f8bef22a0b9c97c2b25466776dcd2805096
SHA256 c9f1ae1ea5e1c7c964b9bd3115b52bfb1115b93cd69b31119ea81f8c4ce839f5
SHA512 cee6c91a8b41f01ab411e54db57864d8422ef87205fc1fda43f7f4f11285a23b27b8742f22d0f2386fa0873f0f4aa8f36b63579a80a26b953eb0d2ceeb3163d5

memory/2472-189-0x0000000070560000-0x00000000705AC000-memory.dmp

memory/2472-190-0x00000000706E0000-0x0000000070A37000-memory.dmp

memory/4652-201-0x0000000074C50000-0x0000000074CB7000-memory.dmp

memory/4652-203-0x0000000074C10000-0x0000000074C21000-memory.dmp

memory/4652-202-0x0000000074C30000-0x0000000074C4E000-memory.dmp

memory/4652-200-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/1796-206-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/2612-207-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/1796-209-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4652-215-0x0000000074BC0000-0x0000000074C01000-memory.dmp

memory/4652-212-0x0000000074C50000-0x0000000074CB7000-memory.dmp

memory/4652-211-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2612-225-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4652-219-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4652-228-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/2612-243-0x0000000000400000-0x00000000008DF000-memory.dmp

memory/4652-237-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4652-246-0x0000000000400000-0x0000000002B0C000-memory.dmp

memory/4652-254-0x0000000000400000-0x0000000002B0C000-memory.dmp