Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/02/2023, 13:16

General

  • Target

    31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175.exe

  • Size

    4.1MB

  • MD5

    173100d82ac3dbb1150765d3a043271c

  • SHA1

    36ad3575378d0ba93d0d8f490d32f462ffddb5b3

  • SHA256

    31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175

  • SHA512

    7a452b850f5a842f08d7ef055bad54676cbb7cd9cc4487232b937b82f873bb5af37949a29c0442f250d2c0f9d359da0492ab9368c83c545911afaa84b96c47e2

  • SSDEEP

    98304:UgN8QW+qXTin421gmRHd2QObzmTAiiDyrTnW:UgiDRTi4dmR92L3m0BWrTnW

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Windows security bypass 2 TTPs 7 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175.exe
    "C:\Users\Admin\AppData\Local\Temp\31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175.exe
      "C:\Users\Admin\AppData\Local\Temp\31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2620
      • C:\Users\Admin\AppData\Local\Temp\31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175.exe
        "C:\Users\Admin\AppData\Local\Temp\31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2884
        • C:\Users\Admin\AppData\Local\Temp\31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175.exe
          "C:\Users\Admin\AppData\Local\Temp\31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175.exe"
          4⤵
          • Windows security bypass
          • Windows security modification
          • Adds Run key to start application
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3156
          • C:\Windows\System32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4776
            • C:\Windows\system32\netsh.exe
              netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
              6⤵
              • Modifies Windows Firewall
              • Modifies data under HKEY_USERS
              PID:4956
          • C:\Windows\rss\csrss.exe
            C:\Windows\rss\csrss.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:400
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1160
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                7⤵
                • Creates scheduled task(s)
                PID:2536
              • C:\Windows\SYSTEM32\schtasks.exe
                schtasks /delete /tn ScheduledUpdate /f
                7⤵
                  PID:2576
                • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  PID:360
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  7⤵
                  • Creates scheduled task(s)
                  PID:5080

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\rss\csrss.exe

      Filesize

      4.1MB

      MD5

      173100d82ac3dbb1150765d3a043271c

      SHA1

      36ad3575378d0ba93d0d8f490d32f462ffddb5b3

      SHA256

      31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175

      SHA512

      7a452b850f5a842f08d7ef055bad54676cbb7cd9cc4487232b937b82f873bb5af37949a29c0442f250d2c0f9d359da0492ab9368c83c545911afaa84b96c47e2

    • C:\Windows\rss\csrss.exe

      Filesize

      4.1MB

      MD5

      173100d82ac3dbb1150765d3a043271c

      SHA1

      36ad3575378d0ba93d0d8f490d32f462ffddb5b3

      SHA256

      31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175

      SHA512

      7a452b850f5a842f08d7ef055bad54676cbb7cd9cc4487232b937b82f873bb5af37949a29c0442f250d2c0f9d359da0492ab9368c83c545911afaa84b96c47e2

    • C:\Windows\rss\csrss.exe

      Filesize

      4.1MB

      MD5

      173100d82ac3dbb1150765d3a043271c

      SHA1

      36ad3575378d0ba93d0d8f490d32f462ffddb5b3

      SHA256

      31629b56d890169679e720b896814a4d32fd3721fdef37c753d8de9066810175

      SHA512

      7a452b850f5a842f08d7ef055bad54676cbb7cd9cc4487232b937b82f873bb5af37949a29c0442f250d2c0f9d359da0492ab9368c83c545911afaa84b96c47e2

    • memory/400-385-0x0000000002F00000-0x00000000032EA000-memory.dmp

      Filesize

      3.9MB

    • memory/400-458-0x00000000032F0000-0x0000000003B67000-memory.dmp

      Filesize

      8.5MB

    • memory/1160-412-0x0000000000400000-0x0000000000C91000-memory.dmp

      Filesize

      8.6MB

    • memory/1160-462-0x0000000000400000-0x0000000000C91000-memory.dmp

      Filesize

      8.6MB

    • memory/2300-133-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-141-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-127-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-128-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-129-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-130-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-131-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-132-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-125-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-134-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-135-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-136-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-137-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-139-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-140-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-126-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-142-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-143-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-144-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-148-0x00000000028B0000-0x0000000002CA4000-memory.dmp

      Filesize

      4.0MB

    • memory/2300-151-0x0000000002CB0000-0x0000000003527000-memory.dmp

      Filesize

      8.5MB

    • memory/2300-124-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-123-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-122-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-120-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-121-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-119-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-118-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-117-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2300-116-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-157-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-178-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-160-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-161-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-162-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-163-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-164-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-166-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-167-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-165-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-159-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-168-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-169-0x0000000000400000-0x0000000000C91000-memory.dmp

      Filesize

      8.6MB

    • memory/2620-170-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-171-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-172-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-173-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-174-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-175-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-176-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-177-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-158-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-180-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-181-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-179-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-182-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-183-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-184-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-267-0x0000000000400000-0x0000000000C91000-memory.dmp

      Filesize

      8.6MB

    • memory/2620-145-0x0000000000400000-0x0000000000C91000-memory.dmp

      Filesize

      8.6MB

    • memory/2620-156-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-155-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-154-0x0000000000400000-0x0000000000C91000-memory.dmp

      Filesize

      8.6MB

    • memory/2620-147-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-152-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-150-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/2620-149-0x00000000779A0000-0x0000000077B2E000-memory.dmp

      Filesize

      1.6MB

    • memory/3156-315-0x0000000000400000-0x0000000000C91000-memory.dmp

      Filesize

      8.6MB

    • memory/3156-354-0x0000000000400000-0x0000000000C91000-memory.dmp

      Filesize

      8.6MB