Analysis
-
max time kernel
29s -
max time network
132s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
17-05-2024 13:24
Static task
static1
Behavioral task
behavioral1
Sample
949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe
Resource
win10v2004-20240508-en
General
-
Target
949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe
-
Size
4.1MB
-
MD5
1ff97a9a48a8a195b078710b6b737107
-
SHA1
b313161f322790b09ccb1d847799df6c9535aadc
-
SHA256
949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd
-
SHA512
d6800c20afa86db257b2e60ebb044b2c27705e3063cb4e1a008265407e2ecc2aa0e14602163defc29ac3d61531fbc36bec04961d209e43472c0842731e17b7d9
-
SSDEEP
98304:EQJMl/iXMhTmfDhNRe9xfYVEx7xkD10HZd3scl3XzHAtmo0F4:/b8hTmbBIxHPR3rn3oK4
Malware Config
Signatures
-
Glupteba payload 19 IoCs
Processes:
resource yara_rule behavioral2/memory/3408-2-0x0000000004CA0000-0x000000000558B000-memory.dmp family_glupteba behavioral2/memory/3408-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3408-54-0x0000000004CA0000-0x000000000558B000-memory.dmp family_glupteba behavioral2/memory/3408-53-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3408-52-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/1688-122-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/1688-129-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-199-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-215-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-216-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-218-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-220-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-223-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-224-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-226-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-228-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-231-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-232-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral2/memory/3312-234-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 3328 netsh.exe -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 3312 csrss.exe -
Processes:
resource yara_rule behavioral2/memory/4468-210-0x0000000000400000-0x00000000008DF000-memory.dmp upx C:\Windows\windefender.exe upx behavioral2/memory/1264-212-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4468-214-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1264-217-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1264-221-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/1264-227-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe -
Drops file in Windows directory 2 IoCs
Processes:
949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exedescription ioc process File opened for modification C:\Windows\rss 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe File created C:\Windows\rss\csrss.exe 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 804 sc.exe -
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4500 powershell.exe 4412 powershell.exe 4908 powershell.exe 2148 powershell.exe 1036 powershell.exe 1432 powershell.exe 4320 powershell.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2224 3408 WerFault.exe 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 2144 1688 WerFault.exe 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4200 schtasks.exe 4060 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
powershell.exe949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exepowershell.exe949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 4320 powershell.exe 4320 powershell.exe 3408 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 3408 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 4500 powershell.exe 4500 powershell.exe 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe 4412 powershell.exe 4412 powershell.exe 4908 powershell.exe 4908 powershell.exe 2148 powershell.exe 2148 powershell.exe 1036 powershell.exe 1036 powershell.exe 1432 powershell.exe 1432 powershell.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
powershell.exe949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4320 powershell.exe Token: SeDebugPrivilege 3408 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Token: SeImpersonatePrivilege 3408 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe Token: SeDebugPrivilege 4500 powershell.exe Token: SeDebugPrivilege 4412 powershell.exe Token: SeDebugPrivilege 4908 powershell.exe Token: SeDebugPrivilege 2148 powershell.exe Token: SeDebugPrivilege 1036 powershell.exe Token: SeDebugPrivilege 1432 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.execmd.execsrss.exedescription pid process target process PID 3408 wrote to memory of 4320 3408 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 3408 wrote to memory of 4320 3408 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 3408 wrote to memory of 4320 3408 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 1688 wrote to memory of 4500 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 1688 wrote to memory of 4500 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 1688 wrote to memory of 4500 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 1688 wrote to memory of 916 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe cmd.exe PID 1688 wrote to memory of 916 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe cmd.exe PID 916 wrote to memory of 3328 916 cmd.exe netsh.exe PID 916 wrote to memory of 3328 916 cmd.exe netsh.exe PID 1688 wrote to memory of 4412 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 1688 wrote to memory of 4412 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 1688 wrote to memory of 4412 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 1688 wrote to memory of 4908 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 1688 wrote to memory of 4908 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 1688 wrote to memory of 4908 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe powershell.exe PID 1688 wrote to memory of 3312 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe csrss.exe PID 1688 wrote to memory of 3312 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe csrss.exe PID 1688 wrote to memory of 3312 1688 949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe csrss.exe PID 3312 wrote to memory of 2148 3312 csrss.exe powershell.exe PID 3312 wrote to memory of 2148 3312 csrss.exe powershell.exe PID 3312 wrote to memory of 2148 3312 csrss.exe powershell.exe PID 3312 wrote to memory of 1036 3312 csrss.exe powershell.exe PID 3312 wrote to memory of 1036 3312 csrss.exe powershell.exe PID 3312 wrote to memory of 1036 3312 csrss.exe powershell.exe PID 3312 wrote to memory of 1432 3312 csrss.exe powershell.exe PID 3312 wrote to memory of 1432 3312 csrss.exe powershell.exe PID 3312 wrote to memory of 1432 3312 csrss.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe"C:\Users\Admin\AppData\Local\Temp\949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe"C:\Users\Admin\AppData\Local\Temp\949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4500 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3328 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908 -
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4200 -
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:836
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:3708
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4060 -
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:4468
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:4556
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 7243⤵
- Program crash
PID:2144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 9202⤵
- Program crash
PID:2224
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3408 -ip 34081⤵PID:3848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1688 -ip 16881⤵PID:3920
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:1264
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD506b5f10b3048a2cf14a7633654a803ed
SHA1e644485b1c39c22320ae68b39ceeef7a00993f9e
SHA25653cb8186dfb42a75960b6a2148701b2f4fa0f49944a47dbbf1ffc5b0c8f2474b
SHA51223b313164a2f4760b3b23a4a0113bd188143974bd3dbca0fc15703e8d49d4ca4d5fe84abedd0d798555fdcb0f2879d0448fa30af22dcbd3e99ac83176db3e5df
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD571d861e3ed1fb46de5e5e014423bc9c6
SHA18977f7dfb1e1e901aec7e3a90c88cc4b92e94099
SHA2569f2be341c77c5fb39c70b9847539b796c75965389a15bbb850b2e19e3748d377
SHA5128a8f13efedd7299716e8b6fb54f5f6fdc8340bb0a2babc254fadbe0c227cd77beb600fc61a357482a6cd65fd02eae6b75550cbf314a4e7425625ad8ac7bb6e5d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD51ef884f476e790d34c92931d0a523aca
SHA12904e87dfa0ff4939fb19dd57fe91757de039e02
SHA2568ac652a93ff58050dd5551d3e20d4788821a2eed066d5d13ff7ff53cb66be8b0
SHA512a3caf36ab2950e9ab2619b510b12c1ec6aac9f53e2daf6b71257b1c4b878a774725e49c74aa45f9f4ce6ad75821954f2a4e77307ea5e2e8c1298f1f7adecba00
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD514ba104b8cdbd5f6fa18889d280bfb7c
SHA1c80301617038185c952cb56d4a5256084cfa7f8c
SHA25604b3793b9a348050cb9f794d6c58c1ad06c6de035f0b85b463b96f8bfdf12edd
SHA5120f978b424e9375aac2196a48d15de35d4fc552955f72bd400ad6171b85adae00d012fbd3764088a8e9550cb8d9d2a341a8cc7a3dca43c03e3c68cce6a6c95833
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD574900bcf4729a6d08a1838d12a718cca
SHA178857ecb79bde67150e7deb45559baad1349df02
SHA2567291e8ec4313634d5eb7db29a6d7a13a06569576264d4da4a6d93d413435d694
SHA51250b7ed99fe0db0947a818edf2b5635a7a9d4c05b757f4c8cd2f84c09c825c2767f4d2f956840ea9916de0d678357ebcd46d8adabc9c794250092d536dcfe91f7
-
Filesize
4.1MB
MD51ff97a9a48a8a195b078710b6b737107
SHA1b313161f322790b09ccb1d847799df6c9535aadc
SHA256949d2aaf5120bdfffb4c74c0886a49f3d03689383af8f2aa54fef104ffc6e8dd
SHA512d6800c20afa86db257b2e60ebb044b2c27705e3063cb4e1a008265407e2ecc2aa0e14602163defc29ac3d61531fbc36bec04961d209e43472c0842731e17b7d9
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec