Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
8s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2024, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe
Resource
win10v2004-20240426-en
General
-
Target
512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe
-
Size
4.1MB
-
MD5
a4dcafafd421da2d8c467a838e5fab0f
-
SHA1
78a7c9ae97b97cbe4895b973f6afd470d590b4b2
-
SHA256
512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32
-
SHA512
2d10c38cf46bcbb4133f46caaa09b447c013d4002858195a9fae49d93a25b9ca27bbfb737a65acd9e7441c02ee9b615dadb3672c07b2a9f4927a529c950e712d
-
SSDEEP
98304:UrbgSYZm0VZ47d2LjXdY+WeqK35WW/TEhU3Gu22g:UrcnZFqd2LRPP3hYhQZg
Malware Config
Signatures
-
Glupteba payload 17 IoCs
resource yara_rule behavioral1/memory/5020-3-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1828-130-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/5020-146-0x00000000043D0000-0x0000000004CBB000-memory.dmp family_glupteba behavioral1/memory/5020-214-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral1/memory/1848-216-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-226-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-229-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-232-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-235-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-238-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-241-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-244-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-247-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-250-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-253-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-256-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba behavioral1/memory/1848-259-0x0000000000400000-0x0000000002361000-memory.dmp family_glupteba -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 628 netsh.exe -
resource yara_rule behavioral1/files/0x0012000000023493-222.dat upx behavioral1/memory/4352-224-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1912-223-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/1912-221-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4352-227-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral1/memory/4352-233-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1944 sc.exe -
pid Process 3836 powershell.exe 4312 powershell.exe 984 powershell.exe 4388 powershell.exe 3268 powershell.exe 4520 powershell.exe 1096 powershell.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4600 schtasks.exe 1696 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1661 = "Bahia Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 4520 powershell.exe 4520 powershell.exe 5020 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 5020 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 1096 powershell.exe 1096 powershell.exe 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 3836 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4520 powershell.exe Token: SeDebugPrivilege 5020 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Token: SeImpersonatePrivilege 5020 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe Token: SeDebugPrivilege 1096 powershell.exe Token: SeDebugPrivilege 3836 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 5020 wrote to memory of 4520 5020 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 84 PID 5020 wrote to memory of 4520 5020 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 84 PID 5020 wrote to memory of 4520 5020 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 84 PID 1828 wrote to memory of 1096 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 92 PID 1828 wrote to memory of 1096 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 92 PID 1828 wrote to memory of 1096 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 92 PID 1828 wrote to memory of 2268 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 94 PID 1828 wrote to memory of 2268 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 94 PID 2268 wrote to memory of 628 2268 cmd.exe 96 PID 2268 wrote to memory of 628 2268 cmd.exe 96 PID 1828 wrote to memory of 3836 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 97 PID 1828 wrote to memory of 3836 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 97 PID 1828 wrote to memory of 3836 1828 512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe"C:\Users\Admin\AppData\Local\Temp\512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
-
C:\Users\Admin\AppData\Local\Temp\512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe"C:\Users\Admin\AppData\Local\Temp\512c8ffe896415be7dc02ba37eb2cab5f84b114ecddb108a8ec7410ee75abb32.exe"2⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:628
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
PID:4312
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵PID:1848
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:984
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:4600
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵PID:4608
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:4388
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
PID:3268
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵PID:1088
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
PID:1696
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵PID:1912
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵PID:3276
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
PID:1944
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵PID:4352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD55c5eceaa26dcf516805f16f25cf5429e
SHA1a89b209d52a6ef0a70f57f6cd753b4627bc48d1a
SHA256a8d4b5dfccd3edee59f0128532959200b0ce35ca31ae9f61def1fcc81d65dc5d
SHA51274dba8201d74beee67fb02e5d8d3fcf19c29c40b52241d143b7b366604b9188bf4f23598d8b69e4071d7e10e227ba7b77274992e0e8d02755e3841f9579c1159
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5ca59ee6e68ad2ad54db0e39f781e5a8e
SHA1ef204711ae9beca2dffacc157b890d5be59665a7
SHA2564e2409df20f8a125f50d5d3cd088774846ab2c784be66645824cd53ea2b67360
SHA5121d9ee547a42010952b524525da23ec0f17ef5e0f51504a955802aa3f508ef2e8e1e87733911e03d98be3bcd3f28eeb2965be08c04cc688a4761de1a40bf132f6
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5967b8f2391316cc98de392624922bea0
SHA1ccbbb5d384d8caa1c1dd71186e9c7d29f095b583
SHA25623cfebb68dbd8b2775fcd720063a49f2a17282611e5a63dd1a015a3a07801363
SHA512c5ec9e3a7ca32faf8ec73e4ff0686830d9011b127484363b42c431c3c8b78a65322437197f155ed7f636a14bf87be7718369fdbeed674a8df813b59f7da3a65f
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD52b8ce3cd384d0df0cd12f941030ebe5b
SHA105edee8e201392dd9dc1065e713f4ed7222a856c
SHA256a70b6ac5fc526af619bc9e24c0a052ceb9aeabc67c4baebf681e00f48dfb02a1
SHA512786b6942c0bd50ae5a9258c4f566de1a47a2f510c567bbd26e5292a5815715b9f112d2ea749cd746e9fe3f65447194b1599e88c5e002b056a62cab545841acfc
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Filesize19KB
MD5dcf10ceb2c2a03e2832816270c2fddb8
SHA1c0d53580c08136468d691b2529382122f26b90af
SHA256d936987fe4f7982857829b2995a506eac5c6ae41694f120a2f97c8f364aed12b
SHA512d0f6405f679abea5954a2b94cfac26ba514f6ea08a942cc6d8894ce552c1cdf9cd3097a1c9844eca7d9d6b3ea51fcd1b27003699d9f6035b7241ad5f9bac6059
-
Filesize
2.1MB
MD5f1618d37e66bb72c397b54641a404d80
SHA13bac8ea393fa701248789376ea8aa4ddf34da1b5
SHA256819f9d82e2a831b81cc82e705104f7e44a1c8fefaa232b019c05c360c592c53d
SHA512712e1ca671d1896bfea2e8a38399e118a4c696c15cb16ef85ed8185844fbf59046d205d92ed6ce0ba482c50b8a6283342c3ea997bb7a4c23bb7ba360ed24fd4f
-
Filesize
3.6MB
MD575a0d99d9e95aac1c832406c28377368
SHA17bad2a160573bec856e99b5b49a313cc0dacaa9a
SHA256a6fd214ce932737775446d9de716a93b95b2adf2ea714e3a49e28a86479e4e28
SHA51278fd296e164d759776af57cd14a05b592b108fca53d78691a03d8ff6df919196e6be7c119beb24636357565f39dffb3c6285a1ebfa90253c1bcf58ff08a8541a
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec