glupteba | 90107126b48282982d055662efcd5de71fb9da54ff6450d7c2da6a9127bcfd71

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/06/2026, 09:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tmpt9j67apq.exe
Size 4.1MB
Sample260602-lprcwsbv4k
SHA256 90107126b48282982d055662efcd5de71fb9da54ff6450d7c2da6a9127bcfd71
MD5 78dd3ea71596678b9bb21ce576319e39
SHA1 999ec23f4aec66d5f77cae137210945087c02d22
SHA512 eb6035cc96e6d803546c99dfe84d49c3900ac84339d78a44ca112405676948ef48af38e11e532f5386d3f0f1d32fbaa6490d4b71d2f85486f26756c035f6f97c
SSDEEP 98304:BN4WQa1F9Vqzjr660niixeJM6AlJSbw+NQ7bZ4j:BNsaX9If+PnvxeybSb/NQ7bZ4j
TLSH
T1681633302ED4A176E2B7677694F0DBBA4AE7FC515760354BEB9A22340E70B60631C31E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery dropper execution glupteba loader persistence privilege_escalation rootkit

Malware Config

Signatures

Family: Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 21 IoCs

resource	yara_rule
behavioral2/memory/4560-2-0x0000000002E40000-0x000000000372B000-memory.dmp	family_glupteba
behavioral2/memory/4560-46-0x0000000002E40000-0x000000000372B000-memory.dmp	family_glupteba
behavioral2/memory/4560-71-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1472-116-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/1628-172-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-250-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4656-279-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/2764-281-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/4480-282-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-283-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-287-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-291-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-295-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-299-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-303-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-307-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-311-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-315-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-319-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-323-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral2/memory/5096-327-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2304	netsh.exe

Executes dropped EXE 6 IoCs

pid	Process
5096	csrss.exe
1628	csrss.exe
2764	csrss.exe
4480	csrss.exe
4656	csrss.exe
1484	injector.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	tmpt9j67apq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit defense_evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	tmpt9j67apq.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	tmpt9j67apq.exe
File created	C:\Windows\rss\csrss.exe	tmpt9j67apq.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3744	powershell.exe
1148	powershell.exe
1064	powershell.exe
568	powershell.exe
3888	powershell.exe
2428	powershell.exe
4720	powershell.exe
1128	powershell.exe
1644	powershell.exe
1040	powershell.exe
4424	powershell.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
3792	4560	WerFault.exe	86
3788	4560	WerFault.exe	86
880	4560	WerFault.exe	86
412	4560	WerFault.exe	86
1240	4560	WerFault.exe	86
216	4560	WerFault.exe	86
2544	4560	WerFault.exe	86
4468	4560	WerFault.exe	86
4692	4560	WerFault.exe	86
3452	4560	WerFault.exe	86
3540	4560	WerFault.exe	86
4424	4560	WerFault.exe	86
3820	4560	WerFault.exe	86
3928	4560	WerFault.exe	86
4332	4560	WerFault.exe	86
1592	4560	WerFault.exe	86
1156	4560	WerFault.exe	86
4280	4560	WerFault.exe	86
4816	4560	WerFault.exe	86
712	1472	WerFault.exe	134
3000	1472	WerFault.exe	134
1044	1472	WerFault.exe	134
3888	1472	WerFault.exe	134
2624	1472	WerFault.exe	134
1048	1472	WerFault.exe	134
4124	1472	WerFault.exe	134
4056	1472	WerFault.exe	134
3468	1472	WerFault.exe	134
1576	5096	WerFault.exe	163
4608	5096	WerFault.exe	163
768	5096	WerFault.exe	163
3336	1628	WerFault.exe	170
4056	5096	WerFault.exe	163
3468	1628	WerFault.exe	170
3220	5096	WerFault.exe	163
216	1628	WerFault.exe	170
2108	5096	WerFault.exe	163
1616	1628	WerFault.exe	170
2408	5096	WerFault.exe	163
3116	5096	WerFault.exe	163
1644	1628	WerFault.exe	170
4220	1628	WerFault.exe	170
3096	1628	WerFault.exe	170
4008	5096	WerFault.exe	163
2152	1628	WerFault.exe	170
2472	1628	WerFault.exe	170
4880	5096	WerFault.exe	163
3328	5096	WerFault.exe	163
208	5096	WerFault.exe	163
3820	2764	WerFault.exe	226
4056	4480	WerFault.exe	229
1032	2764	WerFault.exe	226
3396	4480	WerFault.exe	229
3788	2764	WerFault.exe	226
3904	4480	WerFault.exe	229
2408	2764	WerFault.exe	226
4220	4480	WerFault.exe	229
2492	2764	WerFault.exe	226
3256	4480	WerFault.exe	229
4128	2764	WerFault.exe	226
1484	4480	WerFault.exe	229
3380	4480	WerFault.exe	229
2132	2764	WerFault.exe	226
4800	2764	WerFault.exe	226

System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpt9j67apq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpt9j67apq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csrss.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4404	schtasks.exe
1612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1128	powershell.exe
1128	powershell.exe
4560	tmpt9j67apq.exe
4560	tmpt9j67apq.exe
1644	powershell.exe
1644	powershell.exe
1472	tmpt9j67apq.exe
1472	tmpt9j67apq.exe
1472	tmpt9j67apq.exe
1472	tmpt9j67apq.exe
1472	tmpt9j67apq.exe
1472	tmpt9j67apq.exe
1472	tmpt9j67apq.exe
1472	tmpt9j67apq.exe
1472	tmpt9j67apq.exe
1472	tmpt9j67apq.exe
1148	powershell.exe
1148	powershell.exe
1040	powershell.exe
1040	powershell.exe
1064	powershell.exe
1064	powershell.exe
1064	powershell.exe
568	powershell.exe
568	powershell.exe
568	powershell.exe
3888	powershell.exe
3888	powershell.exe
3888	powershell.exe
1628	csrss.exe
1628	csrss.exe
2428	powershell.exe
2428	powershell.exe
4424	powershell.exe
4424	powershell.exe
2428	powershell.exe
4720	powershell.exe
4720	powershell.exe
4424	powershell.exe
4720	powershell.exe
4480	csrss.exe
4480	csrss.exe
3744	powershell.exe
3744	powershell.exe
1484	injector.exe
1484	injector.exe
3744	powershell.exe
1484	injector.exe
1484	injector.exe
1484	injector.exe
1484	injector.exe
5096	csrss.exe
5096	csrss.exe
1484	injector.exe
1484	injector.exe
1484	injector.exe
1484	injector.exe
1484	injector.exe
1484	injector.exe
5096	csrss.exe
5096	csrss.exe
1484	injector.exe
1484	injector.exe
1484	injector.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1128	powershell.exe
Token: SeDebugPrivilege	4560	tmpt9j67apq.exe
Token: SeImpersonatePrivilege	4560	tmpt9j67apq.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	568	powershell.exe
Token: SeDebugPrivilege	3888	powershell.exe
Token: SeDebugPrivilege	1628	csrss.exe
Token: SeImpersonatePrivilege	1628	csrss.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	4424	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	4480	csrss.exe
Token: SeImpersonatePrivilege	4480	csrss.exe
Token: SeSystemEnvironmentPrivilege	5096	csrss.exe
Token: SeDebugPrivilege	3744	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 1128	4560	tmpt9j67apq.exe	130
PID 1472 wrote to memory of 1644	1472	tmpt9j67apq.exe	153
PID 1472 wrote to memory of 3700	1472	tmpt9j67apq.exe	155
PID 3700 wrote to memory of 2304	3700	cmd.exe	157
PID 1472 wrote to memory of 1148	1472	tmpt9j67apq.exe	158
PID 1472 wrote to memory of 1040	1472	tmpt9j67apq.exe	160
PID 1472 wrote to memory of 5096	1472	tmpt9j67apq.exe	163
PID 5096 wrote to memory of 1064	5096	csrss.exe	199
PID 1628 wrote to memory of 568	1628	csrss.exe	205
PID 5096 wrote to memory of 3888	5096	csrss.exe	211
PID 5096 wrote to memory of 2428	5096	csrss.exe	260
PID 2764 wrote to memory of 4424	2764	csrss.exe	264
PID 4480 wrote to memory of 4720	4480	csrss.exe	268
PID 5096 wrote to memory of 1484	5096	csrss.exe	291
PID 4656 wrote to memory of 3744	4656	csrss.exe	295

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmpt9j67apq.exe
"C:\Users\Admin\AppData\Local\Temp\tmpt9j67apq.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 372
  2⤵
  - Program crash
  PID:3792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 388
  2⤵
  - Program crash
  PID:3788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 392
  2⤵
  - Program crash
  PID:880
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 620
  2⤵
  - Program crash
  PID:412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 708
  2⤵
  - Program crash
  PID:1240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 740
  2⤵
  - Program crash
  PID:216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 756
  2⤵
  - Program crash
  PID:2544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 752
  2⤵
  - Program crash
  PID:4468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 708
  2⤵
  - Program crash
  PID:4692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 812
  2⤵
  - Program crash
  PID:3452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 884
  2⤵
  - Program crash
  PID:3540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 816
  2⤵
  - Program crash
  PID:4424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 728
  2⤵
  - Program crash
  PID:3820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 888
  2⤵
  - Program crash
  PID:3928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 708
  2⤵
  - Program crash
  PID:4332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 876
  2⤵
  - Program crash
  PID:1592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 740
  2⤵
  - Program crash
  PID:1156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 640
  2⤵
  - Program crash
  PID:4280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 648
  2⤵
  - Program crash
  PID:4816
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1128
- C:\Users\Admin\AppData\Local\Temp\tmpt9j67apq.exe
  "C:\Users\Admin\AppData\Local\Temp\tmpt9j67apq.exe"
  2⤵
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 340
    3⤵
    - Program crash
    PID:712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 356
    3⤵
    - Program crash
    PID:3000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 372
    3⤵
    - Program crash
    PID:1044
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 644
    3⤵
    - Program crash
    PID:3888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 644
    3⤵
    - Program crash
    PID:2624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 704
    3⤵
    - Program crash
    PID:1048
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 704
    3⤵
    - Program crash
    PID:4124
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 744
    3⤵
    - Program crash
    PID:4056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 764
    3⤵
    - Program crash
    PID:3468
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2304
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1148
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5096
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 372
      4⤵
      Program crash
      PID:1576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 388
      4⤵
      Program crash
      PID:4608
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 392
      4⤵
      Program crash
      PID:768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 676
      4⤵
      Program crash
      PID:4056
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 688
      4⤵
      Program crash
      PID:3220
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 688
      4⤵
      Program crash
      PID:2108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 752
      4⤵
      Program crash
      PID:2408
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 760
      4⤵
      Program crash
      PID:3116
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 780
      4⤵
      Program crash
      PID:4008
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1064
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4404
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:1044
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3888
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 896
      4⤵
      Program crash
      PID:4880
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 840
      4⤵
      Program crash
      PID:3328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 840
      4⤵
      Program crash
      PID:208
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Drops file in System32 directory
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2428
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 972
      4⤵
      PID:3380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 988
      4⤵
      PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1484
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1612
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1080
      4⤵
      PID:3004
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5096 -s 1096
      4⤵
      PID:2624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4560 -ip 4560
1⤵
PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4560 -ip 4560
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4560 -ip 4560
1⤵
PID:1132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4560 -ip 4560
1⤵
PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4560 -ip 4560
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4560 -ip 4560
1⤵
PID:684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4560 -ip 4560
1⤵
PID:1084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4560 -ip 4560
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4560 -ip 4560
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4560 -ip 4560
1⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4560 -ip 4560
1⤵
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4560 -ip 4560
1⤵
PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4560 -ip 4560
1⤵
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4560 -ip 4560
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4560 -ip 4560
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4560 -ip 4560
1⤵
PID:3056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4560 -ip 4560
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4560 -ip 4560
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4560 -ip 4560
1⤵
PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1472 -ip 1472
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1472 -ip 1472
1⤵
PID:3776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1472 -ip 1472
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1472 -ip 1472
1⤵
PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1472 -ip 1472
1⤵
PID:3764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1472 -ip 1472
1⤵
PID:1484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 1472 -ip 1472
1⤵
PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1472 -ip 1472
1⤵
PID:3336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1472 -ip 1472
1⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5096 -ip 5096
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5096 -ip 5096
1⤵
PID:5048

C:\Windows\rss\csrss.exe
"C:\Windows\rss\csrss.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 340
  2⤵
  - Program crash
  PID:3336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 356
  2⤵
  - Program crash
  PID:3468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 360
  2⤵
  - Program crash
  PID:216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 644
  2⤵
  - Program crash
  PID:1616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 656
  2⤵
  - Program crash
  PID:1644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 656
  2⤵
  - Program crash
  PID:4220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 656
  2⤵
  - Program crash
  PID:3096
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 740
  2⤵
  - Program crash
  PID:2152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 764
  2⤵
  - Program crash
  PID:2472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:568
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 340
    3⤵
    - Program crash
    PID:3820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 344
    3⤵
    - Program crash
    PID:1032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 360
    3⤵
    - Program crash
    PID:3788
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 652
    3⤵
    - Program crash
    PID:2408
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 692
    3⤵
    - Program crash
    PID:2492
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 712
    3⤵
    - Program crash
    PID:4128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 704
    3⤵
    - Program crash
    PID:2132
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 700
    3⤵
    - Program crash
    PID:4800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 860
    3⤵
    PID:3332
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5096 -ip 5096
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5096 -ip 5096
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1628 -ip 1628
1⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1628 -ip 1628
1⤵
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5096 -ip 5096
1⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1628 -ip 1628
1⤵
PID:2300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5096 -ip 5096
1⤵
PID:2204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1628 -ip 1628
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5096 -ip 5096
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5096 -ip 5096
1⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1628 -ip 1628
1⤵
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1628 -ip 1628
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1628 -ip 1628
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5096 -ip 5096
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1628 -ip 1628
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1628 -ip 1628
1⤵
PID:3084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5096 -ip 5096
1⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5096 -ip 5096
1⤵
PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5096 -ip 5096
1⤵
PID:412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2764 -ip 2764
1⤵
PID:4436

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 340
  2⤵
  - Program crash
  PID:4056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 356
  2⤵
  - Program crash
  PID:3396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 356
  2⤵
  - Program crash
  PID:3904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 652
  2⤵
  - Program crash
  PID:4220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 656
  2⤵
  - Program crash
  PID:3256
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 656
  2⤵
  - Program crash
  PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 656
  2⤵
  - Program crash
  PID:3380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 728
  2⤵
  PID:3680
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 740
  2⤵
  PID:916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\rss\csrss.exe
  "C:\Windows\rss\csrss.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 340
    3⤵
    PID:4224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 356
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 356
    3⤵
    PID:2624
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 644
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 656
    3⤵
    PID:1944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 656
    3⤵
    PID:4220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 720
    3⤵
    PID:3288
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 728
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 744
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Drops file in System32 directory
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4480 -ip 4480
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2764 -ip 2764
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2764 -ip 2764
1⤵
PID:1048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4480 -ip 4480
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4480 -ip 4480
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2764 -ip 2764
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4480 -ip 4480
1⤵
PID:1092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2764 -ip 2764
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4480 -ip 4480
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2764 -ip 2764
1⤵
PID:1164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4480 -ip 4480
1⤵
PID:3356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2764 -ip 2764
1⤵
PID:2548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4480 -ip 4480
1⤵
PID:832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2764 -ip 2764
1⤵
PID:2508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4480 -ip 4480
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2764 -ip 2764
1⤵
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4480 -ip 4480
1⤵
PID:3000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5096 -ip 5096
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5096 -ip 5096
1⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4656 -ip 4656
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4656 -ip 4656
1⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4656 -ip 4656
1⤵
PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4656 -ip 4656
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4656 -ip 4656
1⤵
PID:916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4656 -ip 4656
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4656 -ip 4656
1⤵
PID:4884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4656 -ip 4656
1⤵
PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4656 -ip 4656
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5096 -ip 5096
1⤵
PID:4192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5096 -ip 5096
1⤵
PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 f019af2e5e74cdf13c963910500f9436c66b6f2901f5056d72f82310f20113b9
MD5 a6ea7bfcd3aac150c0caef765cb52281
SHA1 037dc22c46a0eb0b9ad4c74088129e387cffe96b
SHA512 c8d2d373b48a26cf6eec1f5cfc05819011a3fc49d863820ad07b6442dd6d5f64e27022a9e4c381eb58bf7f6b19f8e77d508734ff803073ec2fb32da9081b6f23
TLSH
T186518D303161A8D84D435F0205286ED5A3EF478AAFAC8F5CB529231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 a5217754b67a4529e2633ce0b1860e0857ec64ebb507fc89ed9be68282b3d7d4
MD5 abdcd4cabe0e1f14003b7d7c7ef3d9b4
SHA1 387eff45998359ff8de584d7a698310151f384e0
SHA512 ecffa46860f9f2d8cb7a5405c537e67a5b48d71d91cc16f30610a5d153ead5cccc36f458ae89bb07495415c52ebd46209f2ddb23e6e43bdfda826eb1c79130e0
SSDEEP 384:dsf+hoS9i+9TDaIEDUizJk+o9o2TpK6seYbneCx/xoTLYbLU06F5Lt9KqA/9JHAu:CfA1CZjejo2TpN+nl0Y/XgLt96fOKsM
TLSH
T1BAA2E65E618F1AC3C4865378D10B041FE8F2DD8D431926D8BB1F8F7B8AAC6BE6178548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 21KB
SHA256 5e34b490eeff7a45bde8bb8fcb1d7b0eedb6f9b614c6ae93d3871f7f0fc770d3
MD5 dd6669070a2e58ac136135b3fae6d1e5
SHA1 31ab4227e80fcb5d7799ed9b968a7d69b1613443
SHA512 37007b208bdba5d89a0a1b93a7c4373c873d6b2ee587c9dd6cb45fd940e6b22b28150d19bc8a259fe8294bbc303dffdb53f80d38e716e4e9ffe69c98eba6a3b4
SSDEEP 384:Qsf+hoh9iafZGrv3VBeuJk+o9o5AZNYFFNpfNFx/x6FnsXcSoUIKg5k1LYJYpB9/:dfAqw/VMTjo5AZN8FNpfVUFsaUBEqE69
TLSH
T1D2A22A5BA20F2A97D4991379C42607EFD4B0DDCE830017CD674A5A3716CEA7560F82E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_q50ntvje.wku.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q50ntvje.wku.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

injector.exe

Path C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
Size 281KB
SHA256 5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
MD5 d98e33b66343e7c96158444127a117f6
SHA1 bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA512 705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
SSDEEP 3072:qbHszDaOJ8u2HHFIWr6e29kOnK7qFQ8wMii5I7kGvNjzMuszHshoY46bEydJ+dK9:SA3IlIA6e29vngqS8wMmuooh8z+8F
TLSH
T17B546C5AB2A918F8ED77823CC8525516F672B8160730D6EF03A447672F276E09D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 16f7231a7ae6295294ee9fef1cdb58d0f4f4eb7cb917b4bc04eb3d3fb580ea5a
MD5 0e410bb6f2827be98ed997cb42c57bb2
SHA1 bb52dd3f447f6a1d298618ffd8a7f68ae5d27f28
SHA512 a799b757c8ba607d3c46adc7f607ebc27cce4161058c77e7968692a0e07ff2b2c1a53501194179acc9a0249479aef3714c9b2d009a6fc6fb1476dca7a673da71
SSDEEP 384:48sf+B2E9HeH3nqH9rRN0EQo9o58NYFFNpfNi7/IOiPMhbg1RG8+nFbOuj3lutbV:45f0eXnWj0Elo58N8FNpfQ7qYU1Rg4uS
TLSH
T1B792195D221F2A97E06523B4E42647DFF9B09ECFC34006DD67841E2B06DA776D4E81E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 a7515006dca918408c27cf14382fe0d7293c625cf48717bc6face309452db8f7
MD5 d08a0a469111506c54f59a87c438b0ee
SHA1 8760321090dcffa6ba49b1d785c4a73d0cba95cb
SHA512 19015ea27de026d7502be687d940c62ad8683d9c4587673dad5ee8351a780d8e34adbfb63307e1b40cc02dfafbf7207a4dc3be8a45b01caac8810eb81755b5a5
SSDEEP 384:D6+BgRBSmMhb5pTWKC9NYFFjffemxc7/IOqX1oWI1Rjxq+nFbOuj3lu3NOg:WJTO5hWKC9N8Fjffc7Mo1R54ublE
TLSH
T18392185D621F2A92E46613F4C02A87D7F9F09DCFC38046DD27865E2B06CF76684AC1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 60b4777c69c6cb0bba8c13159e9387dacdc3961a3016d29d451278fb50f0c603
MD5 e284aea462e4700fa346a4acfd93eb86
SHA1 4822e4f1eb50adc21607c5d3bfc3f881c54008b7
SHA512 5232e5525bf52ed139e90e7ba10db231dd547d9e166144a1bc66e8d52f7152157c8a8925bc78e3d6bf34a414ac010b702026ad6157d02acaa15917e4d10bcd2e
SSDEEP 384:hsf+Bl9RBirnWxmHiukgtuJk+o9o28KYYFFjffemRcUOoc/cMtoEL1fjaM+nFbO8:Gf4WiZCTjo28N8Fjffst/cct1fw4ubl7
TLSH
T15892075E221F2A97C06613F8D82A47DFE8709DCFC30407DD26856E3B16DA77584AC6E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 3530872f0d3f09b4ba64949b0b71d87a69d0367d2c49ba17f0a3b7d8eb92d0d5
MD5 90049e8ed702b879166b5e10b4c9594a
SHA1 bf3fe89fdb79c35244cfaee68037490963c4ab54
SHA512 41766311509e1109c9b18bc81604f50f1b2cbbc8dde0082a7f3dd9f08e3fe5a67dd928cecccb5af721942f34922bdc43210ecd589fb6f9e978ce78febc40fd02
SSDEEP 384:isf+BnRBkANHjFopR3bBzAZNYFFNpfemuUOi0hde1Rja8+nFbOuj3lup2Og:/fUkAzozVzAZN8FNpfEdU1Rg4ublH
TLSH
T18292295D611F3ADBD06623F8D42A47DBE9708DCFC30007DE2685692716CE7A684ED2E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 cb553ba9c3a967bff85c85e5a30b1325912c1656a79888f40dd1063ee6ce283e
MD5 ad30bdec33fbdf1125ad6b7af2702cbd
SHA1 6a041375a2c73e4f69b1d53851d996831f31c72d
SHA512 ab6a72728a532ae1fdc770baf020f27059779a648c328af20e565fdc3d1561b25c5ff117366a3cbbe4ecb7d60bd54fee4bf60d87e693c4aba850f7a02e0ee039
SSDEEP 384:/sf+BHRBsak6aXBbxRNj48Fjffem1w7AORw0tkod1R1P+nFbOuj3lu3cOg:0fEVkl7s8Fjff87x1Rs4ublT
TLSH
T14592285E622F1AD6F22213F8C43A4BDFF9F089CBC30485DD46805A3809DB26984ED5F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-Interactive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
Size 19KB
SHA256 2197866f975077665cf31d228134e7ab0468bb1d409000971c74707f83874c92
MD5 7fbcdd01082813421efb6de3f7577f10
SHA1 bbd0e0d5424324e37eae5880a8a11dd77477cfff
SHA512 5ee9c45c8154d5b714f8d17cde8ba0fbe22704f4cd79a0fb649990299611367ebc47dc0ac376ca714a5d2c36448b7cb907684140fedb103dec047f36e8846ef1
SSDEEP 384:Hsf+BW9m+VmD9pa4goDSvnx6Af3TpK6seYbnea0v/ZxwMH1OyEIjaL0PZbObTUSi:MfO9m+upf3TpN+ngvlOyEI5BqM42
TLSH
T1F492D65E211F16C3C4821378E117055FE8F2EE8D531A17D8AB5E9F3B8AACA9E813D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

csrss.exe

Path C:\Windows\rss\csrss.exe
Size 4.1MB
SHA256 90107126b48282982d055662efcd5de71fb9da54ff6450d7c2da6a9127bcfd71
MD5 78dd3ea71596678b9bb21ce576319e39
SHA1 999ec23f4aec66d5f77cae137210945087c02d22
SHA512 eb6035cc96e6d803546c99dfe84d49c3900ac84339d78a44ca112405676948ef48af38e11e532f5386d3f0f1d32fbaa6490d4b71d2f85486f26756c035f6f97c
SSDEEP 98304:BN4WQa1F9Vqzjr660niixeJM6AlJSbw+NQ7bZ4j:BNsaX9If+PnvxeybSb/NQ7bZ4j
TLSH
T1681633302ED4A176E2B7677694F0DBBA4AE7FC515760354BEB9A22340E70B60631C31E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/568-161-0x00000000064F0000-0x0000000006504000-memory.dmp

Download

memory/568-151-0x0000000074860000-0x00000000748AC000-memory.dmp

Download

memory/568-152-0x0000000070680000-0x00000000709D4000-memory.dmp

Download

memory/1040-103-0x00000000704D0000-0x0000000070824000-memory.dmp

Download

memory/1040-102-0x0000000070350000-0x000000007039C000-memory.dmp

Download

memory/1064-140-0x0000000070680000-0x00000000709D4000-memory.dmp

Download

memory/1064-139-0x0000000074860000-0x00000000748AC000-memory.dmp

Download

memory/1064-148-0x0000000007130000-0x00000000071D3000-memory.dmp

Download

memory/1064-129-0x00000000063D0000-0x000000000641C000-memory.dmp

Download

memory/1064-149-0x0000000005C90000-0x0000000005CA1000-memory.dmp

Download

memory/1064-120-0x0000000005830000-0x0000000005B84000-memory.dmp

Download

memory/1064-150-0x0000000005CD0000-0x0000000005CE4000-memory.dmp

Download

memory/1128-41-0x0000000007340000-0x00000000073D6000-memory.dmp

Download

memory/1128-18-0x0000000005B50000-0x0000000005B6E000-memory.dmp

Download

memory/1128-5-0x0000000004710000-0x0000000004720000-memory.dmp

Download

memory/1128-42-0x0000000007240000-0x0000000007251000-memory.dmp

Download

memory/1128-43-0x0000000007280000-0x000000000728E000-memory.dmp

Download

memory/1128-44-0x00000000072A0000-0x00000000072B4000-memory.dmp

Download

memory/1128-45-0x00000000072F0000-0x000000000730A000-memory.dmp

Download

memory/1128-40-0x0000000007230000-0x000000000723A000-memory.dmp

Download

memory/1128-47-0x00000000072E0000-0x00000000072E8000-memory.dmp

Download

memory/1128-6-0x0000000004D50000-0x0000000005378000-memory.dmp

Download

memory/1128-7-0x0000000004CB0000-0x0000000004CD2000-memory.dmp

Download

memory/1128-8-0x0000000005380000-0x00000000053E6000-memory.dmp

Download

memory/1128-9-0x00000000054A0000-0x0000000005506000-memory.dmp

Download

memory/1128-17-0x0000000005550000-0x00000000058A4000-memory.dmp

Download

memory/1128-4-0x00000000045D0000-0x0000000004606000-memory.dmp

Download

memory/1128-3-0x0000000004710000-0x0000000004720000-memory.dmp

Download

memory/1128-39-0x0000000007140000-0x00000000071E3000-memory.dmp

Download

memory/1128-19-0x0000000005BA0000-0x0000000005BEC000-memory.dmp

Download

memory/1128-33-0x0000000004710000-0x0000000004720000-memory.dmp

Download

memory/1128-20-0x00000000060C0000-0x0000000006104000-memory.dmp

Download

memory/1128-21-0x0000000006E90000-0x0000000006F06000-memory.dmp

Download

memory/1128-22-0x0000000007590000-0x0000000007C0A000-memory.dmp

Download

memory/1128-34-0x0000000004710000-0x0000000004720000-memory.dmp

Download

memory/1128-37-0x0000000007120000-0x000000000713E000-memory.dmp

Download

memory/1128-27-0x00000000704D0000-0x0000000070824000-memory.dmp

Download

memory/1128-23-0x0000000006F30000-0x0000000006F4A000-memory.dmp

Download

memory/1128-26-0x0000000070350000-0x000000007039C000-memory.dmp

Download

memory/1128-25-0x00000000070E0000-0x0000000007112000-memory.dmp

Download

memory/1128-24-0x000000007F790000-0x000000007F7A0000-memory.dmp

Download

memory/1148-85-0x0000000070AD0000-0x0000000070E24000-memory.dmp

Download

memory/1148-84-0x0000000070350000-0x000000007039C000-memory.dmp

Download

memory/1148-82-0x00000000056D0000-0x0000000005A24000-memory.dmp

Download

memory/1472-116-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1472-51-0x00000000029F0000-0x0000000002DF8000-memory.dmp

Download

memory/1628-172-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/1644-60-0x00000000704D0000-0x0000000070824000-memory.dmp

Download

memory/1644-68-0x0000000007490000-0x0000000007533000-memory.dmp

Download

memory/1644-69-0x0000000007790000-0x00000000077A1000-memory.dmp

Download

memory/1644-59-0x0000000070350000-0x000000007039C000-memory.dmp

Download

memory/1644-70-0x00000000077E0000-0x00000000077F4000-memory.dmp

Download

memory/2428-234-0x0000000006360000-0x0000000006374000-memory.dmp

Download

memory/2428-224-0x00000000079A0000-0x00000000079B1000-memory.dmp

Download

memory/2428-223-0x00000000077B0000-0x0000000007853000-memory.dmp

Download

memory/2428-215-0x0000000070470000-0x00000000707C4000-memory.dmp

Download

memory/2428-214-0x0000000074C10000-0x0000000074C5C000-memory.dmp

Download

memory/2428-189-0x0000000005EB0000-0x0000000006204000-memory.dmp

Download

memory/2428-205-0x00000000066A0000-0x00000000066EC000-memory.dmp

Download

memory/2764-281-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/3744-265-0x0000000006370000-0x00000000063BC000-memory.dmp

Download

memory/3744-263-0x0000000005760000-0x0000000005AB4000-memory.dmp

Download

memory/3744-277-0x0000000005C10000-0x0000000005C24000-memory.dmp

Download

memory/3744-276-0x0000000007370000-0x0000000007381000-memory.dmp

Download

memory/3744-266-0x00000000702B0000-0x00000000702FC000-memory.dmp

Download

memory/3744-267-0x0000000070A30000-0x0000000070D84000-memory.dmp

Download

memory/3744-275-0x0000000007060000-0x0000000007103000-memory.dmp

Download

memory/3888-187-0x00000000061F0000-0x0000000006204000-memory.dmp

Download

memory/3888-177-0x0000000074860000-0x00000000748AC000-memory.dmp

Download

memory/3888-178-0x0000000070680000-0x00000000709D4000-memory.dmp

Download

memory/3888-186-0x0000000007EA0000-0x0000000007EB1000-memory.dmp

Download

memory/4424-226-0x0000000070470000-0x00000000707C4000-memory.dmp

Download

memory/4424-225-0x0000000074C10000-0x0000000074C5C000-memory.dmp

Download

memory/4480-282-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/4560-71-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/4560-1-0x0000000002A40000-0x0000000002E3F000-memory.dmp

Download

memory/4560-2-0x0000000002E40000-0x000000000372B000-memory.dmp

Download

memory/4560-38-0x0000000002A40000-0x0000000002E3F000-memory.dmp

Download

memory/4560-46-0x0000000002E40000-0x000000000372B000-memory.dmp

Download

memory/4656-279-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/4720-236-0x0000000070470000-0x00000000707C4000-memory.dmp

Download

memory/4720-235-0x0000000074C10000-0x0000000074C5C000-memory.dmp

Download

memory/5096-299-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-283-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-287-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-291-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-295-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-250-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-303-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-307-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-311-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-315-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-319-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-323-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download

memory/5096-327-0x0000000000400000-0x0000000000D1C000-memory.dmp

Download