Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
11s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2024, 01:54
Static task
static1
Behavioral task
behavioral1
Sample
6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe
Resource
win10v2004-20240426-en
General
-
Target
6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe
-
Size
4.1MB
-
MD5
a9ff8e69692def51525760f51284539a
-
SHA1
dcb401e525396487ee3f19c4892c8e75f10da42f
-
SHA256
6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b
-
SHA512
be71258a9d21904eaaa9d4b9363547cdf16977283f13b97c19b562a811fe415abd2f263ce569c02b0e47f6917b29fe16004e1666a2df27a23423cf3d2ab0e1a4
-
SSDEEP
98304:8rbgSYZm0VZ47d2LjXdY+WeqK35WW/TEhU3Gu22L:8rcnZFqd2LRPP3hYhQZL
Malware Config
Signatures
-
Glupteba payload 19 IoCs
resource yara_rule behavioral1/memory/4900-2-0x00000000043B0000-0x0000000004C9B000-memory.dmp family_glupteba behavioral1/memory/4900-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4900-155-0x00000000043B0000-0x0000000004C9B000-memory.dmp family_glupteba behavioral1/memory/4900-153-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4900-213-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/4980-212-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-215-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-227-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-231-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-235-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-239-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-243-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-247-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-251-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-255-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-259-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-263-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-267-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/4384-270-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba -
Blocklisted process makes network request 1 IoCs
flow pid Process 25 5072 Process not Found -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4820 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 4384 csrss.exe -
resource yara_rule behavioral1/memory/5112-220-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/files/0x000800000002342f-219.dat upx behavioral1/memory/5112-224-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2672-223-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2672-229-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/2672-237-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe File created C:\Windows\rss\csrss.exe 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2356 sc.exe -
pid Process 2356 powershell.exe 1144 powershell.exe 3808 powershell.exe 5072 powershell.exe 4908 powershell.exe 4180 powershell.exe 3044 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1328 schtasks.exe 1384 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 3044 powershell.exe 3044 powershell.exe 4900 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 4900 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 2356 powershell.exe 2356 powershell.exe 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 1144 powershell.exe 1144 powershell.exe 3808 powershell.exe 3808 powershell.exe 5072 powershell.exe 5072 powershell.exe 5072 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3044 powershell.exe Token: SeDebugPrivilege 4900 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Token: SeImpersonatePrivilege 4900 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe Token: SeDebugPrivilege 2356 powershell.exe Token: SeDebugPrivilege 1144 powershell.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeDebugPrivilege 5072 powershell.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4900 wrote to memory of 3044 4900 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 86 PID 4900 wrote to memory of 3044 4900 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 86 PID 4900 wrote to memory of 3044 4900 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 86 PID 4980 wrote to memory of 2356 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 125 PID 4980 wrote to memory of 2356 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 125 PID 4980 wrote to memory of 2356 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 125 PID 4980 wrote to memory of 4004 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 112 PID 4980 wrote to memory of 4004 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 112 PID 4004 wrote to memory of 4820 4004 cmd.exe 100 PID 4004 wrote to memory of 4820 4004 cmd.exe 100 PID 4980 wrote to memory of 1144 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 101 PID 4980 wrote to memory of 1144 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 101 PID 4980 wrote to memory of 1144 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 101 PID 4980 wrote to memory of 3808 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 105 PID 4980 wrote to memory of 3808 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 105 PID 4980 wrote to memory of 3808 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 105 PID 4980 wrote to memory of 4384 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 107 PID 4980 wrote to memory of 4384 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 107 PID 4980 wrote to memory of 4384 4980 6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe 107 PID 4384 wrote to memory of 5072 4384 csrss.exe 108 PID 4384 wrote to memory of 5072 4384 csrss.exe 108 PID 4384 wrote to memory of 5072 4384 csrss.exe 108 PID 4384 wrote to memory of 4908 4384 csrss.exe 114 PID 4384 wrote to memory of 4908 4384 csrss.exe 114 PID 4384 wrote to memory of 4908 4384 csrss.exe 114 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe"C:\Users\Admin\AppData\Local\Temp\6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe"C:\Users\Admin\AppData\Local\Temp\6f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:4820
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5072
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1328
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4004
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:4908
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:4180
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:4736
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1384
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:5112
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:2964
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:2356
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:2672
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5026ac2f7d7d2ab45c41f8b300adcb697
SHA1f6dd9232772cf47703637c67b3f667b42f05c5c3
SHA25613c682f4957406a7a56234505b7edec33cd510b69aaa04d956844014f1c0ed0e
SHA51289f868462efff44c99264d2fcffdc33faaf096619e50d9b2c32400471daea8996e50b7a7d87acf59514c17520f8f398df8d1914957109b56dc54eeed7aea6a51
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD59c2e10ef176785ff6f29e05bf4299e6a
SHA18c47776d79c17c991bf1f30b63bba0ffdcd92ce9
SHA256af07d72890a2f3c541123dc52667aea9d8fda7e1216c82aba04fffb0e0d5232c
SHA512f92b4e09c34a3b87965af994ec84e615c9ea7ef89d7781312758176adb6b1be9614b312f0c4820abf0cb64057b0ece6c7f281594c94ec3010ec3952ba2ffcf49
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5236f9094a4bed6c692dc2e0984a76cf7
SHA1002a2f0a4dd43fb53c020350c192d52fc12061fe
SHA25684ef63ccf2304274b8eb7f4897fd079fa80d01c11c1fa1bf776405bbaccfba2f
SHA512e8f074a1f91c5e5fdcbec050c85969a2245fcb4cc637b0801e436715c0acbb7ab53dd7e8e698cfc53c990a463836172c3171cbef89813d54665b4e5186f169f8
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD58b5cb71c80143d4329d905ef567e6c25
SHA16b9b8c36c24ea7730c6bcb82c8947bdfd3408bb9
SHA25643d1d13e02261a1a10bb992ca6d5cf6e475837d1e0d70be797b55ac4d3904d6f
SHA512a254963857aac87a6b139cd96a8a2bd5eaf898a60942b49e4a0247cb514e40589eb8288e764eba80abf5e01b9753ddf740acf2e9f23986d07449f946e0dda9b1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD57664b4b155431f1a98326e6cf40768bb
SHA13b48a2f1242550c572b2f11b5804c0ef5fa5f862
SHA256c220a6b5df27e0685f0c6b6667b59b340d31178066b0ea576ed9821c986ad74c
SHA512936222a99321bf96a175318597f4e43a22c8ce813e64995490e1466b90f39b892e010af85b42c49b5036b13d31f4cd3a6101fd5f54ff1880e39ec78c6811aba8
-
Filesize
4.1MB
MD5a9ff8e69692def51525760f51284539a
SHA1dcb401e525396487ee3f19c4892c8e75f10da42f
SHA2566f18a37dff3bd99962843de1a8842fe97b75c60c980ed62b2a0e414864552c1b
SHA512be71258a9d21904eaaa9d4b9363547cdf16977283f13b97c19b562a811fe415abd2f263ce569c02b0e47f6917b29fe16004e1666a2df27a23423cf3d2ab0e1a4
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec