Analysis
-
max time kernel
41s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-05-2024 09:48
Static task
static1
Behavioral task
behavioral1
Sample
0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe
Resource
win10v2004-20240508-en
General
-
Target
0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe
-
Size
4.1MB
-
MD5
aa9d2edf579ca886a202919ac6ac79a7
-
SHA1
e2983a8432e43012de1f6790c28eae9e366718c5
-
SHA256
0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809
-
SHA512
0808c3f984cc20fc274fe00c6f5019ce75be1ff7d3c7d753754482c898a3b01ba663f577f407e7635fc1178cf9b50e2f231370ff967eaa2d3a7a772641a0356d
-
SSDEEP
98304:UhY2qRRjR1paGoDMO/b2fpl9vUYBzPUd5cvaqxgKnFtiaq:qYlRLXY4O+pXvrLaqWucT
Malware Config
Signatures
-
Glupteba payload 18 IoCs
Processes:
resource yara_rule behavioral2/memory/788-2-0x0000000004C50000-0x000000000553B000-memory.dmp family_glupteba behavioral2/memory/788-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/788-51-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/788-54-0x0000000004C50000-0x000000000553B000-memory.dmp family_glupteba behavioral2/memory/788-78-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/220-101-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/220-130-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-151-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-206-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-218-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-222-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-226-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-230-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-238-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-242-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-246-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-250-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/4036-254-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2996 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 4036 csrss.exe -
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/2444-213-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/876-215-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/2444-217-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/876-221-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/876-229-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/876-241-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe -
Drops file in Windows directory 2 IoCs
Processes:
0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exedescription ioc process File opened for modification C:\Windows\rss 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe File created C:\Windows\rss\csrss.exe 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1484 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2120 powershell.exe 4048 powershell.exe 4764 powershell.exe 2724 powershell.exe 1204 powershell.exe 3832 powershell.exe 2464 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1632 schtasks.exe 2292 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exe0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-261 = "GMT Daylight Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
powershell.exe0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exepowershell.exe0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 2464 powershell.exe 2464 powershell.exe 788 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 788 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 2120 powershell.exe 2120 powershell.exe 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe 4048 powershell.exe 4048 powershell.exe 4764 powershell.exe 4764 powershell.exe 2724 powershell.exe 2724 powershell.exe 1204 powershell.exe 1204 powershell.exe 3832 powershell.exe 3832 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exe0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2464 powershell.exe Token: SeDebugPrivilege 788 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Token: SeImpersonatePrivilege 788 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe Token: SeDebugPrivilege 2120 powershell.exe Token: SeDebugPrivilege 4048 powershell.exe Token: SeDebugPrivilege 4764 powershell.exe Token: SeDebugPrivilege 2724 powershell.exe Token: SeDebugPrivilege 1204 powershell.exe Token: SeDebugPrivilege 3832 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.execmd.execsrss.exedescription pid process target process PID 788 wrote to memory of 2464 788 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 788 wrote to memory of 2464 788 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 788 wrote to memory of 2464 788 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 220 wrote to memory of 2120 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 220 wrote to memory of 2120 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 220 wrote to memory of 2120 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 220 wrote to memory of 2848 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe cmd.exe PID 220 wrote to memory of 2848 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe cmd.exe PID 2848 wrote to memory of 2996 2848 cmd.exe netsh.exe PID 2848 wrote to memory of 2996 2848 cmd.exe netsh.exe PID 220 wrote to memory of 4048 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 220 wrote to memory of 4048 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 220 wrote to memory of 4048 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 220 wrote to memory of 4764 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 220 wrote to memory of 4764 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 220 wrote to memory of 4764 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe powershell.exe PID 220 wrote to memory of 4036 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe csrss.exe PID 220 wrote to memory of 4036 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe csrss.exe PID 220 wrote to memory of 4036 220 0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe csrss.exe PID 4036 wrote to memory of 2724 4036 csrss.exe powershell.exe PID 4036 wrote to memory of 2724 4036 csrss.exe powershell.exe PID 4036 wrote to memory of 2724 4036 csrss.exe powershell.exe PID 4036 wrote to memory of 1204 4036 csrss.exe powershell.exe PID 4036 wrote to memory of 1204 4036 csrss.exe powershell.exe PID 4036 wrote to memory of 1204 4036 csrss.exe powershell.exe PID 4036 wrote to memory of 3832 4036 csrss.exe powershell.exe PID 4036 wrote to memory of 3832 4036 csrss.exe powershell.exe PID 4036 wrote to memory of 3832 4036 csrss.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe"C:\Users\Admin\AppData\Local\Temp\0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe"C:\Users\Admin\AppData\Local\Temp\0adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2120 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2996 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4048 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4764 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2724 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1632 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:336
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:2204
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:2292 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:2444
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:4020
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:1484
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:876
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD59e977040688463e6d35e2964b1abd2ae
SHA1744fe2bd01c804ee093fa0afa53dd4eee2ce8b42
SHA25611e0da6913072219f0dc06f6d73ce0188198712ed9e4448460997039a0fe5211
SHA512d5b2c8cb8ed1e22f08a206c37d6c9fc406c247fbe70112eddde09d06745d0a45ad4a18ebb77de2b48063809df514149fe6bbf2899d4817b2c89367bdfafce22a
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ab05cffb34ee8841ca4baac031346ba8
SHA1e876e09a3cfded9c2ef4efe5103c49c9b36f89b6
SHA2565a9d5b1a8c813eb7e9aa1ac4dabb4beaa1fe6285e419a1028fe29d9b2ca45687
SHA512a9d1e20918c349ea0b06b14cc0c6eac55298f79eff635a3c0a5a5e5eaa856c41b3d5f8b17c4569f58cbbbc40683ec45a7d8654411e9178b728acc64a41ddf091
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5cb0d398f78eb7c83bcd464f9a8c3cc60
SHA1d5cd8b57b70db5e03ec30856897a7cc7a588d37d
SHA2566c6e73490b4c74ce61ed57d87112c3544869c1f5699214bbee3390ff25c7d284
SHA512e433e3e8bb47e84dfd3a846664798b3541dc1ea6ee557f16c00a102e92ca1ab49dfd200668157a036d085f2a3dd6543bbb2535676245da1240dd417270f83851
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5c81d736843f5e37457c7c142d41c0527
SHA1f0f5cbb82f24e7110afe54ebeceb38c0138a471b
SHA2566fe0390367080adae678e4c4c21864c2637cac5048d34dbffd4f461d1dbc56c5
SHA512de27a3748b14bf0517a8e6da76528bcac1dad343c5548a3b659f64b500955e54de7c28d5517af3363c4e09e31c2aa3eef1df4492316a0332edba8de0c21d2412
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD56c30e32d990eb38b135ce5df295b9c63
SHA1314cded2d528be1bc1ff2acf3654c8cd9e7ded9d
SHA25691d29afdf1e4d1cb566e7251bb648bfb314af9c743f52d8b9f67fcc960e82a6d
SHA5128186bc4776e27d4514c90ebb4f7b4340e33339a8b07b619c0ff3b6bc9ab6c40664efb0621ef565860a5ff99b81c68ff5c45cef6ddadabf81476d2da40dba735a
-
Filesize
4.1MB
MD5aa9d2edf579ca886a202919ac6ac79a7
SHA1e2983a8432e43012de1f6790c28eae9e366718c5
SHA2560adcfe6b65204a5a44f87d157ab8be8aab0021faffbdf79967b1b35fc1580809
SHA5120808c3f984cc20fc274fe00c6f5019ce75be1ff7d3c7d753754482c898a3b01ba663f577f407e7635fc1178cf9b50e2f231370ff967eaa2d3a7a772641a0356d
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec