Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-06-2024 00:38
Behavioral task
behavioral1
Sample
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe
-
Size
6.9MB
-
MD5
9327d8a117e01b69e61a7690fed88818
-
SHA1
394ab8c6728e2ffa1381e6afe3e52d15d44c6965
-
SHA256
b7691c583984fe210bbc5ce7291dd2a80dd969d7b33e25863c99311303febbc3
-
SHA512
b58962e98750064aa16e738b81ac76c39206ae6bb65c9ddf01a6cdd5bd2d979522bbb7a61544efe87ec0d6475965206d57459961214848d020acab25f113c47d
-
SSDEEP
98304:aQ8/Py9frbxvXKKkGxTVhG2+9Mpq6vQt/Ibt1YcyDgs:L8nylrZtjG9MpqINns
Malware Config
Signatures
-
Glupteba payload 1 IoCs
resource yara_rule behavioral2/files/0x00070000000233db-2.dat family_glupteba -
Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 3976 netsh.exe 2964 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 3728 csrss.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NamelessRain = "\"C:\\Windows\\rss\\csrss.exe\"" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe -
Drops file in System32 directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache csrss.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData csrss.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\rss 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe File created C:\Windows\rss\csrss.exe 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2531 = "Chatham Islands Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1871 = "Russia TZ 7 Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs csrss.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs csrss.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1912 = "Russia TZ 10 Standard Time" 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 3728 csrss.exe 3728 csrss.exe 3728 csrss.exe 3728 csrss.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe Token: SeImpersonatePrivilege 4644 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4548 wrote to memory of 1928 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 86 PID 4548 wrote to memory of 1928 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 86 PID 1928 wrote to memory of 2964 1928 cmd.exe 88 PID 1928 wrote to memory of 2964 1928 cmd.exe 88 PID 4548 wrote to memory of 1860 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 91 PID 4548 wrote to memory of 1860 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 91 PID 1860 wrote to memory of 3976 1860 cmd.exe 93 PID 1860 wrote to memory of 3976 1860 cmd.exe 93 PID 4548 wrote to memory of 3728 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 94 PID 4548 wrote to memory of 3728 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 94 PID 4548 wrote to memory of 3728 4548 9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9327d8a117e01b69e61a7690fed88818_JaffaCakes118.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:2964
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="CloudNet" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe" enable=yes4⤵
- Modifies Windows Firewall
PID:3976
-
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe ""3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3728
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.9MB
MD59327d8a117e01b69e61a7690fed88818
SHA1394ab8c6728e2ffa1381e6afe3e52d15d44c6965
SHA256b7691c583984fe210bbc5ce7291dd2a80dd969d7b33e25863c99311303febbc3
SHA512b58962e98750064aa16e738b81ac76c39206ae6bb65c9ddf01a6cdd5bd2d979522bbb7a61544efe87ec0d6475965206d57459961214848d020acab25f113c47d