Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2024, 21:52
Static task
static1
Behavioral task
behavioral1
Sample
34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe
Resource
win10v2004-20240426-en
General
-
Target
34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe
-
Size
4.1MB
-
MD5
b9c066bfd5930f01490b888a93cda864
-
SHA1
7ba8f12c7cf394d9822086afb05c2d8ca59bc4d6
-
SHA256
34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020
-
SHA512
874beda4f139173dcbfcdf5a0ad42da6452a493423b6c1d4a6d1851bcc01e75068db4e3598e15b4f3b15f40618171a4808cc42592e00e31f7ea2a979f3386fc2
-
SSDEEP
98304:0X33DbWGkLHuFK+TwQmBC6reQ4TTNXYvI8KgvjrB0ra:0XPWAwQyCdJYw8Kgga
Malware Config
Signatures
-
Glupteba payload 18 IoCs
resource yara_rule behavioral1/memory/3628-2-0x0000000004A20000-0x000000000530B000-memory.dmp family_glupteba behavioral1/memory/3628-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/3628-126-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1524-132-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/3628-169-0x0000000004A20000-0x000000000530B000-memory.dmp family_glupteba behavioral1/memory/3628-208-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1128-215-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-217-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-219-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-221-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-223-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-225-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-227-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-229-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-233-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-235-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-237-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba behavioral1/memory/1128-239-0x0000000000400000-0x0000000002733000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2520 netsh.exe -
Executes dropped EXE 2 IoCs
pid Process 1128 csrss.exe 2536 injector.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
description ioc Process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe File created C:\Windows\rss\csrss.exe 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe -
pid Process 1696 powershell.exe 1932 powershell.exe 3960 powershell.exe 2860 powershell.exe 1352 powershell.exe 4980 powershell.exe 4832 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4708 schtasks.exe 3944 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2942 = "Sao Tome Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1932 powershell.exe 1932 powershell.exe 3628 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 3628 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 3960 powershell.exe 3960 powershell.exe 3960 powershell.exe 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 2860 powershell.exe 2860 powershell.exe 2860 powershell.exe 1352 powershell.exe 1352 powershell.exe 4980 powershell.exe 4980 powershell.exe 4832 powershell.exe 4832 powershell.exe 1696 powershell.exe 1696 powershell.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 1128 csrss.exe 1128 csrss.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 1128 csrss.exe 1128 csrss.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe 2536 injector.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 1932 powershell.exe Token: SeDebugPrivilege 3628 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Token: SeImpersonatePrivilege 3628 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe Token: SeDebugPrivilege 3960 powershell.exe Token: SeDebugPrivilege 2860 powershell.exe Token: SeDebugPrivilege 1352 powershell.exe Token: SeDebugPrivilege 4980 powershell.exe Token: SeDebugPrivilege 4832 powershell.exe Token: SeDebugPrivilege 1696 powershell.exe Token: SeSystemEnvironmentPrivilege 1128 csrss.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3628 wrote to memory of 1932 3628 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 85 PID 3628 wrote to memory of 1932 3628 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 85 PID 3628 wrote to memory of 1932 3628 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 85 PID 1524 wrote to memory of 3960 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 96 PID 1524 wrote to memory of 3960 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 96 PID 1524 wrote to memory of 3960 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 96 PID 1524 wrote to memory of 3268 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 101 PID 1524 wrote to memory of 3268 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 101 PID 3268 wrote to memory of 2520 3268 cmd.exe 103 PID 3268 wrote to memory of 2520 3268 cmd.exe 103 PID 1524 wrote to memory of 2860 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 104 PID 1524 wrote to memory of 2860 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 104 PID 1524 wrote to memory of 2860 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 104 PID 1524 wrote to memory of 1352 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 106 PID 1524 wrote to memory of 1352 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 106 PID 1524 wrote to memory of 1352 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 106 PID 1524 wrote to memory of 1128 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 108 PID 1524 wrote to memory of 1128 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 108 PID 1524 wrote to memory of 1128 1524 34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe 108 PID 1128 wrote to memory of 4980 1128 csrss.exe 109 PID 1128 wrote to memory of 4980 1128 csrss.exe 109 PID 1128 wrote to memory of 4980 1128 csrss.exe 109 PID 1128 wrote to memory of 4832 1128 csrss.exe 115 PID 1128 wrote to memory of 4832 1128 csrss.exe 115 PID 1128 wrote to memory of 4832 1128 csrss.exe 115 PID 1128 wrote to memory of 1696 1128 csrss.exe 117 PID 1128 wrote to memory of 1696 1128 csrss.exe 117 PID 1128 wrote to memory of 1696 1128 csrss.exe 117 PID 1128 wrote to memory of 2536 1128 csrss.exe 119 PID 1128 wrote to memory of 2536 1128 csrss.exe 119 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe"C:\Users\Admin\AppData\Local\Temp\34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Users\Admin\AppData\Local\Temp\34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe"C:\Users\Admin\AppData\Local\Temp\34877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3960
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2520
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4708
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:3108
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2536
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:3944
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5e2d2b504a4a5d84abd05b1a3a1f46617
SHA1adc38af0cb884849716077f899dce20340beded3
SHA2569cf6c1de6f3e6688b5a18bb6be472361a43d2a14de240f02eba53f11c3caec25
SHA512da828de6cc8847e2a8752bdd9729121c572d706cdec8d602857e65d7510baeb716fd92c03363f4e7db698d4588c9b5ea1e729c94640dd5f765f0ce0e1e0245fd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5fe5d77f4e1811a31f3658d06aff95fe6
SHA1b2a18e756d5a304267e535c6085e077f0a075e59
SHA25655b23238d1c267ca9f43acd1cf9978ed58b7aca10d78b2a1ab27e7901c358deb
SHA5125070a9f2dd1ad63fefb01ab42baefaafbb63812f99709bf8a4fba9130dc65e8fe78ae6f7636f233cfeaf7d451e4e2253df55e460b741484d3efb5fbbdeb35f4d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD56c4cd76c7bfff5169692879c1994f922
SHA1f66cc0929b874b3cc7cea201b1385d208b23ead3
SHA2565bb3787fcad6e2a4ce6f83bc8539ff93450ed737fd055450cba6e3760ef4b310
SHA51282745fdc25ac0cc8d5c772a4f44bfbc8a4e0df2eefa64df03c4378247ab6db179bad3bd3f33e946fa52a854a6462f577cb15be042da3ccf798615d6b2332944d
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD52b0e827c13faf5512ad51e8dfc011fe3
SHA1cae3dcd237e3e44b12be6d3f664c3c4311f84b89
SHA2561c7a9c4e88ce48e535605a5abff1bc2e2d1f63bbd7f4a427f9579e5c030bc76c
SHA5121f2a8dac8fd33a50f344c670d953ba4028804c81ca799c539d9b6b008cfd24ef3f414d4ce046a0834ae8576bf2280f0df02030e49addaf9c2775ef92c3d83aff
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD555e05c1afdd591d0252b26eca18eebfb
SHA1cb406dee0a8e11f7e8eaa38f6074a484f390e3d5
SHA256746ba4fd712b47a6678440ba02edfe70f641f3bee903f92995a9a2e8bc842b5b
SHA512bdb54f3fc2d56f085445ab49b36a24a83ab5a91968ba9fa4ab3fd2a4e1881204a39116ed9db1216e5904f77923b5d7bdb06cc3e3bce6133f9b3494dbf508b46b
-
Filesize
4.1MB
MD5b9c066bfd5930f01490b888a93cda864
SHA17ba8f12c7cf394d9822086afb05c2d8ca59bc4d6
SHA25634877ab10419ca3f26a8fb29e8e7c0992ac56ce72bfb91980924c582b32bb020
SHA512874beda4f139173dcbfcdf5a0ad42da6452a493423b6c1d4a6d1851bcc01e75068db4e3598e15b4f3b15f40618171a4808cc42592e00e31f7ea2a979f3386fc2