Analysis
-
max time kernel
139s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe
Resource
win10v2004-20240426-en
General
-
Target
77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe
-
Size
4.1MB
-
MD5
6da21da365f0c916e4bbd63448b1c6dc
-
SHA1
63ce9c176d2729611e0d1e36286e98ac0a581bca
-
SHA256
77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8
-
SHA512
0503587cb645f3aaf11cf96798b23a3ef053f76575828da54c627588b9cda292a35b25593df435348149d821e0182532838e4192934dc0b288286bbc59339a24
-
SSDEEP
98304:yZ3eWnmCP3Day+MGMrrH7Rp/OOmeNALbhxcJ3GFuqO9B+e2R0FJ3:YufQJ+wrvRp/OL3LVxY3GFuq2BkwJ3
Malware Config
Signatures
-
Glupteba payload 14 IoCs
resource yara_rule behavioral1/memory/5024-57-0x0000000004DC0000-0x00000000056AB000-memory.dmp family_glupteba behavioral1/memory/5024-56-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/5024-54-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/1028-137-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/3692-220-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/3692-222-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/3692-223-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/3692-224-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/3692-225-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/3692-226-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/3692-227-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/3692-228-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/3692-229-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba behavioral1/memory/3692-230-0x0000000000400000-0x0000000002B0D000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2088 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 3692 csrss.exe 3776 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe File created C:\Windows\rss\csrss.exe 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe -
pid Process 2756 powershell.exe 1868 powershell.exe 2664 powershell.exe 1640 powershell.exe 3264 powershell.exe 1320 powershell.exe 4780 powershell.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4428 1028 WerFault.exe 93 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4112 schtasks.exe 3036 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2571 = "Turks and Caicos Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2756 powershell.exe 2756 powershell.exe 5024 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 5024 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 1868 powershell.exe 1868 powershell.exe 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 2664 powershell.exe 2664 powershell.exe 2664 powershell.exe 1640 powershell.exe 1640 powershell.exe 1640 powershell.exe 3264 powershell.exe 3264 powershell.exe 3264 powershell.exe 1320 powershell.exe 1320 powershell.exe 1320 powershell.exe 4780 powershell.exe 4780 powershell.exe 4780 powershell.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3692 csrss.exe 3692 csrss.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3692 csrss.exe 3692 csrss.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe 3776 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2756 powershell.exe Token: SeDebugPrivilege 5024 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Token: SeImpersonatePrivilege 5024 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe Token: SeDebugPrivilege 1868 powershell.exe Token: SeDebugPrivilege 2664 powershell.exe Token: SeDebugPrivilege 1640 powershell.exe Token: SeDebugPrivilege 3264 powershell.exe Token: SeDebugPrivilege 1320 powershell.exe Token: SeDebugPrivilege 4780 powershell.exe Token: SeSystemEnvironmentPrivilege 3692 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 5024 wrote to memory of 2756 5024 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 86 PID 5024 wrote to memory of 2756 5024 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 86 PID 5024 wrote to memory of 2756 5024 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 86 PID 1028 wrote to memory of 1868 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 114 PID 1028 wrote to memory of 1868 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 114 PID 1028 wrote to memory of 1868 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 114 PID 1028 wrote to memory of 1248 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 97 PID 1028 wrote to memory of 1248 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 97 PID 1248 wrote to memory of 2088 1248 cmd.exe 99 PID 1248 wrote to memory of 2088 1248 cmd.exe 99 PID 1028 wrote to memory of 2664 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 100 PID 1028 wrote to memory of 2664 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 100 PID 1028 wrote to memory of 2664 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 100 PID 1028 wrote to memory of 1640 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 106 PID 1028 wrote to memory of 1640 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 106 PID 1028 wrote to memory of 1640 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 106 PID 1028 wrote to memory of 3692 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 109 PID 1028 wrote to memory of 3692 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 109 PID 1028 wrote to memory of 3692 1028 77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe 109 PID 3692 wrote to memory of 3264 3692 csrss.exe 113 PID 3692 wrote to memory of 3264 3692 csrss.exe 113 PID 3692 wrote to memory of 3264 3692 csrss.exe 113 PID 3692 wrote to memory of 1320 3692 csrss.exe 119 PID 3692 wrote to memory of 1320 3692 csrss.exe 119 PID 3692 wrote to memory of 1320 3692 csrss.exe 119 PID 3692 wrote to memory of 4780 3692 csrss.exe 121 PID 3692 wrote to memory of 4780 3692 csrss.exe 121 PID 3692 wrote to memory of 4780 3692 csrss.exe 121 PID 3692 wrote to memory of 3776 3692 csrss.exe 123 PID 3692 wrote to memory of 3776 3692 csrss.exe 123 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe"C:\Users\Admin\AppData\Local\Temp\77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe"C:\Users\Admin\AppData\Local\Temp\77a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1868
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2088
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1640
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1868
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4112
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3336
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3776
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3036
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 7363⤵
- Program crash
PID:4428
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1028 -ip 10281⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5109de312b2eb72450083266a2d8f4443
SHA14e07cd288ca3ac86646dcbae30170460dfa48268
SHA2568ebd685a68208fa013618a42a40cb6d727605d4f611696f5a6f55381df7200f5
SHA5125ceb24592cdaba7619433bd16fed46a0776d8a73b1e53f9243ae15191f2949426e27b53293e3366af1bd96855fce16c814bdbc1c6b7ac02b094ab914b86cf462
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5968619ff52b54cfe2acc0fd896ebe3fc
SHA16aa534aaddcd035b1da17d326efdd660262f5029
SHA2565357e06a96e8b0a839128f9fe57031fdfc9984a679d9e96b9cefa3c36e19309a
SHA512400dfb9f03c706610008198c4dde4c521cc4b1b048f5ca8994f808ea9f79438136742bd4e83ecf98e2d976ca6a4a872d875c6af13672aabebea93feb52b9dbe3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD50da8bc62e5034c85bda0cc8081ec27d1
SHA1723038df9c7e332673576d0b82fbd2b6d91ce45f
SHA256f7b4b43c9f7415814737909ff12d2888c9a6ee29bac76fc533936765c0da4865
SHA5121e3705e8ce4db6e32956fc2869ce9ca5b63c24b352c453526374eb81cdaeb328f128ff6ca20f63481390cf6418e8553bd10d0e6b0671f6e89a96e5058a85e267
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5bc0cbc097ba8fbfbf1d61f5cec9f98a3
SHA17de17382a7a9e6d50352ee31eb8c05b30d22d54d
SHA256ac6af42908dbad6d1214c2191bbd6995f4a4b3b2189236b0b2b2e4486ceb742c
SHA512c01f8d4e108533cc0d5c4e31c907e9fade93d8e6a61ca3d65d5a397e1bbc718857428f6179e2018a279ab29538ff5fa212b069328e3cebe5d2e8daf598610d72
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD54744481165bf4b088d4baff86c62f224
SHA1814b8b1b6b0637889c948db35d8f51a560715f86
SHA256fee278d37048764fc267a2d17909ea59f0f3e67d7b7cc175c1ea75201db006b1
SHA512010ff8670dd36243c818e0834d8510b91284785c374bff2995294d5317a2062b2910d43f6c457147205115546aa4bda367759c75717c7b65911f92ba7a1d5d3d
-
Filesize
4.1MB
MD56da21da365f0c916e4bbd63448b1c6dc
SHA163ce9c176d2729611e0d1e36286e98ac0a581bca
SHA25677a8ba8c5a19bc4a758385b5fff5ea1698dccf2381b974d0d99dc97b11f57be8
SHA5120503587cb645f3aaf11cf96798b23a3ef053f76575828da54c627588b9cda292a35b25593df435348149d821e0182532838e4192934dc0b288286bbc59339a24