glupteba | 073ffe51172562a79a5978403de4149834b3f2506c72451485b2889edcc1929e

Analysis

max time kernel
9s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
11-10-2024 15:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7725eaa6592c80f8124e769b4e8a07f7[1].exe
Size

4.2MB
MD5

32ddef87207fd48862944757fe21f2ab
SHA1

53942206c163d02c299e851def37791cda3ef7e1
SHA256

073ffe51172562a79a5978403de4149834b3f2506c72451485b2889edcc1929e
SHA512

896dc54f1b8e0b5a02c70502e29be9ca12619052dda9d8a17a31c47a6b2fb1487fc2c871a33e47e5a7d8d7835ece33a3d973549043c05a9aad2e228105756143
SSDEEP

98304:E9zsQ68NZJAUQvS0gtKx7M125D/72Q5Z9pvPsrDHphmEIUQTq:E9zDHXJT0SKx71Dj2SnqJNpt

Score

10^/10

glupteba discovery dropper evasion execution loader

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1124-2-0x0000000003050000-0x000000000393B000-memory.dmp	family_glupteba
behavioral2/memory/1124-3-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/1124-46-0x0000000003050000-0x000000000393B000-memory.dmp	family_glupteba
behavioral2/memory/1124-55-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

2628 netsh.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4388 powershell.exe
4788 powershell.exe
4188 powershell.exe
4672 powershell.exe

pid	process
2628	netsh.exe

pid	process
4388	powershell.exe
4788	powershell.exe
4188	powershell.exe
4672	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.exe7725eaa6592c80f8124e769b4e8a07f7[1].exepowershell.exe7725eaa6592c80f8124e769b4e8a07f7[1].exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7725eaa6592c80f8124e769b4e8a07f7[1].exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

7725eaa6592c80f8124e769b4e8a07f7[1].exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-891 = "Morocco Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exe7725eaa6592c80f8124e769b4e8a07f7[1].exepowershell.exe

pid	process
4788	powershell.exe
4788	powershell.exe
1124	7725eaa6592c80f8124e769b4e8a07f7[1].exe
1124	7725eaa6592c80f8124e769b4e8a07f7[1].exe
4188	powershell.exe
4188	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exe7725eaa6592c80f8124e769b4e8a07f7[1].exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	1124	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Token: SeImpersonatePrivilege	1124	7725eaa6592c80f8124e769b4e8a07f7[1].exe
Token: SeDebugPrivilege	4188	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

7725eaa6592c80f8124e769b4e8a07f7[1].exe7725eaa6592c80f8124e769b4e8a07f7[1].exe

description	pid	process	target process
PID 1124 wrote to memory of 4788	1124	7725eaa6592c80f8124e769b4e8a07f7[1].exe	powershell.exe
PID 1124 wrote to memory of 4788	1124	7725eaa6592c80f8124e769b4e8a07f7[1].exe	powershell.exe
PID 1124 wrote to memory of 4788	1124	7725eaa6592c80f8124e769b4e8a07f7[1].exe	powershell.exe
PID 236 wrote to memory of 4188	236	7725eaa6592c80f8124e769b4e8a07f7[1].exe	powershell.exe
PID 236 wrote to memory of 4188	236	7725eaa6592c80f8124e769b4e8a07f7[1].exe	powershell.exe
PID 236 wrote to memory of 4188	236	7725eaa6592c80f8124e769b4e8a07f7[1].exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\7725eaa6592c80f8124e769b4e8a07f7[1].exe
"C:\Users\Admin\AppData\Local\Temp\7725eaa6592c80f8124e769b4e8a07f7[1].exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Users\Admin\AppData\Local\Temp\7725eaa6592c80f8124e769b4e8a07f7[1].exe
  "C:\Users\Admin\AppData\Local\Temp\7725eaa6592c80f8124e769b4e8a07f7[1].exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:2932
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:2628
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4672
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4388
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jfypzcpc.usn.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d0c46cad6c0778401e21910bd6b56b70

SHA1
7be418951ea96326aca445b8dfe449b2bfa0dca6

SHA256
9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02

SHA512
057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
6d337240b9b4f32aecdee211344807e1

SHA1
c5a3d8db89fe85af56511c459bb7622ae036f50e

SHA256
4387f34ae1a9cfe82249dea6ef7a3d5650c8f7c33843a800911d898071269873

SHA512
9366f78ba191248e12f20f69e7389e1469cb86bb7ff7b2023103383d61153f5b285366aceb35fbfc2d15c450cf4eb087a493c0790f3c89f25f7fae829070a335

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
88b92c177e7eca399e14269c09913fef

SHA1
36558bf4c0f9a17307a97f4a5d6797d111c28687

SHA256
c8c584b8c7a30668a49949c32e9078c36b4b720539b59e179ec20e6f35f6a994

SHA512
a6a741e73eb5b4b55c212600c84c540ea0d0a182ec2290587a71a67a4c31a697cfb6be6768623225c169ce8ddc8cf7edb73eeb446bdc125968dd1ed4de906baf

Download Submit
C:\Windows\rss\csrss.exe

Filesize
3.8MB

MD5
03c2a26d8e2cf5cb9d5cd8caf5e55553

SHA1
f7cd30ea9115bb16e83dd15d2a1ce09d704e02c1

SHA256
e6b08e7bea23b0bd77dacea25f5f2ce04fc90332d89ed13d17b0c971d00d8151

SHA512
798b28491f440a772c98898de6c05cd30183f1f2669eaf568ae4820586b23bde5448c899049318dd7e5ca14988fb482ebbc870eeb57b111c84f0ca1d1bf02eda

Download Submit
C:\Windows\rss\csrss.exe

Filesize
1.7MB

MD5
bafb8f05377bbc77c5c14feb3d23a45a

SHA1
ff261b34b0b580e87e4a40d2170dc5e2584cf98d

SHA256
6f22640ce0ec3b080434c8864c5dac3c1580f0b8efa18e2c6343beffc565d210

SHA512
4ebdeba0185424a7ad21849fb806b0ad172210a0699ec2247d9869a63cb3f8f554155af30480f1bc61853c58dcb02d7c28a36e77a558c83719e2059a50fc5089

Download Submit
memory/236-57-0x0000000002A60000-0x0000000002E64000-memory.dmp

Filesize
4.0MB

Download
memory/1124-55-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1124-1-0x0000000002C50000-0x000000000304D000-memory.dmp

Filesize
4.0MB

Download
memory/1124-44-0x0000000002C50000-0x000000000304D000-memory.dmp

Filesize
4.0MB

Download
memory/1124-46-0x0000000003050000-0x000000000393B000-memory.dmp

Filesize
8.9MB

Download
memory/1124-3-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/1124-2-0x0000000003050000-0x000000000393B000-memory.dmp

Filesize
8.9MB

Download
memory/4188-68-0x0000000070520000-0x000000007056C000-memory.dmp

Filesize
304KB

Download
memory/4188-80-0x00000000070B0000-0x00000000070C5000-memory.dmp

Filesize
84KB

Download
memory/4188-79-0x0000000007060000-0x0000000007071000-memory.dmp

Filesize
68KB

Download
memory/4188-78-0x0000000006D40000-0x0000000006DE4000-memory.dmp

Filesize
656KB

Download
memory/4188-69-0x0000000070770000-0x0000000070AC7000-memory.dmp

Filesize
3.3MB

Download
memory/4188-67-0x0000000006070000-0x00000000060BC000-memory.dmp

Filesize
304KB

Download
memory/4188-60-0x0000000005590000-0x00000000058E7000-memory.dmp

Filesize
3.3MB

Download
memory/4388-113-0x0000000070520000-0x000000007056C000-memory.dmp

Filesize
304KB

Download
memory/4388-114-0x0000000070770000-0x0000000070AC7000-memory.dmp

Filesize
3.3MB

Download
memory/4672-93-0x0000000070520000-0x000000007056C000-memory.dmp

Filesize
304KB

Download
memory/4672-94-0x0000000070770000-0x0000000070AC7000-memory.dmp

Filesize
3.3MB

Download
memory/4788-21-0x00000000064A0000-0x00000000064BE000-memory.dmp

Filesize
120KB

Download
memory/4788-38-0x00000000079B0000-0x0000000007A54000-memory.dmp

Filesize
656KB

Download
memory/4788-42-0x00000000741A0000-0x0000000074951000-memory.dmp

Filesize
7.7MB

Download
memory/4788-43-0x0000000007B20000-0x0000000007B2A000-memory.dmp

Filesize
40KB

Download
memory/4788-40-0x0000000007AE0000-0x0000000007AFA000-memory.dmp

Filesize
104KB

Download
memory/4788-45-0x0000000007C30000-0x0000000007CC6000-memory.dmp

Filesize
600KB

Download
memory/4788-39-0x0000000008120000-0x000000000879A000-memory.dmp

Filesize
6.5MB

Download
memory/4788-47-0x0000000007B40000-0x0000000007B51000-memory.dmp

Filesize
68KB

Download
memory/4788-48-0x0000000007B90000-0x0000000007B9E000-memory.dmp

Filesize
56KB

Download
memory/4788-49-0x0000000007BA0000-0x0000000007BB5000-memory.dmp

Filesize
84KB

Download
memory/4788-50-0x0000000007BF0000-0x0000000007C0A000-memory.dmp

Filesize
104KB

Download
memory/4788-51-0x0000000007C10000-0x0000000007C18000-memory.dmp

Filesize
32KB

Download
memory/4788-54-0x00000000741A0000-0x0000000074951000-memory.dmp

Filesize
7.7MB

Download
memory/4788-36-0x0000000007990000-0x00000000079AE000-memory.dmp

Filesize
120KB

Download
memory/4788-37-0x00000000741A0000-0x0000000074951000-memory.dmp

Filesize
7.7MB

Download
memory/4788-41-0x00000000741A0000-0x0000000074951000-memory.dmp

Filesize
7.7MB

Download
memory/4788-25-0x0000000007930000-0x0000000007964000-memory.dmp

Filesize
208KB

Download
memory/4788-27-0x0000000070660000-0x00000000709B7000-memory.dmp

Filesize
3.3MB

Download
memory/4788-26-0x0000000070410000-0x000000007045C000-memory.dmp

Filesize
304KB

Download
memory/4788-24-0x00000000741A0000-0x0000000074951000-memory.dmp

Filesize
7.7MB

Download
memory/4788-23-0x0000000006A60000-0x0000000006AA6000-memory.dmp

Filesize
280KB

Download
memory/4788-22-0x00000000064E0000-0x000000000652C000-memory.dmp

Filesize
304KB

Download
memory/4788-20-0x0000000005F80000-0x00000000062D7000-memory.dmp

Filesize
3.3MB

Download
memory/4788-11-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/4788-10-0x0000000005680000-0x00000000056E6000-memory.dmp

Filesize
408KB

Download
memory/4788-9-0x00000000055D0000-0x00000000055F2000-memory.dmp

Filesize
136KB

Download
memory/4788-8-0x00000000741A0000-0x0000000074951000-memory.dmp

Filesize
7.7MB

Download
memory/4788-6-0x0000000005850000-0x0000000005E7A000-memory.dmp

Filesize
6.2MB

Download
memory/4788-7-0x00000000741A0000-0x0000000074951000-memory.dmp

Filesize
7.7MB

Download
memory/4788-5-0x0000000002C80000-0x0000000002CB6000-memory.dmp

Filesize
216KB

Download
memory/4788-4-0x00000000741AE000-0x00000000741AF000-memory.dmp

Filesize
4KB

Download