Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
18/05/2023, 14:00
General
-
Target
e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46.exe
-
Size
4.2MB
-
MD5
11ab111ec46b24ac0e8822e3f1a88ffe
-
SHA1
80ae5ba81f6edab19dd3eefdab3de31ffd252ba0
-
SHA256
e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46
-
SHA512
08b7b061b32de65126bd22c8e04a917332c78e8fb77b660e35ebccf5cdfd5fbd07fb7f76efbb221da0f2cdc5a279aac6a26e8c0749b6dd862a9791da1b7274cb
-
SSDEEP
98304:eRm1FI4Ofs4hghp/MO0myowzLWwPA6QaCj20M9u8R69Afm/Q:km0lfCbR/wzqGAbaCjcQC
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 2 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46.exe"C:\Users\Admin\AppData\Local\Temp\e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46.exe"C:\Users\Admin\AppData\Local\Temp\e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "ScheduledUpdate" /f5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "csrss" /f5⤵
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
Filesize
3.2MB
MD5f801950a962ddba14caaa44bf084b55c
SHA17cadc9076121297428442785536ba0df2d4ae996
SHA256c3946ec89e15b24b743c46f9acacb58cff47da63f3ce2799d71ed90496b8891f
SHA5124183bc76bdc84fb779e2e573d9a63d7de47096b63b945f9e335bee95ae28eb208f5ee15f6501ac59623b97c5b77f3455ca313512e7d9803e1704ae22a52459c5
-
Filesize
99KB
MD509031a062610d77d685c9934318b4170
SHA1880f744184e7774f3d14c1bb857e21cc7fe89a6d
SHA256778bd69af403df3c4e074c31b3850d71bf0e64524bea4272a802ca9520b379dd
SHA5129a276e1f0f55d35f2bf38eb093464f7065bdd30a660e6d1c62eed5e76d1fb2201567b89d9ae65d2d89dc99b142159e36fb73be8d5e08252a975d50544a7cda27
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
19KB
MD55e6b709bdab63fd6d128f6b85d35f53c
SHA103c483486ca42c912740efee3ef1e09011c421c3
SHA25631a6b280972ed46f34cf31ce399df066011bb4d9cdf4aa20a6f9eb99d2b66e08
SHA5123401f03ec79d59242c97165450b4e59ebda5720fb9d0678e9e6dd1cd5c5e323132290b3cc45e81b609a5c68a5f46ba8f7539cd75656a6fa4b65a7d2f4a7f1766
-
Filesize
19KB
MD5bffd5c4458688245ec4e580ce6e8da18
SHA1a9e8a94c785f32507ddfc05edd8e3ee752f80e98
SHA25686e93b886746d483fd9a70232a2e59c72c7a955c4ebdb5672d6a32d480471819
SHA5121b18b6fd0b49afbb4a72867057f5cd98e3c9164625b2228a2bcd294cff94385370f6c96bb81b1e35b575cac5e618c70bf5cb28dd562c9878cb0e21f22b273651
-
Filesize
19KB
MD5fb9ee1cb7e2cb3ea9f151c19e612c9f8
SHA15bb127c21aef468b79afb8e1ae99cb5e0b5b698c
SHA256e79ff0182ce4b70696a78e8c3e209ce9014fa6b8af68ac38dc876a6649b88543
SHA5124a482005e3abe7252595fbe5fe68600634cf45962ea907c110274f864cf0d5fd995eb97a269dbf861e5b3e820e76c4b34330dc85bd7dce8eced50f5af2d1481f
-
Filesize
19KB
MD58e65dfdea4a70f82a4b6e9e86ead82c9
SHA1646d42b1aeaf10782b92de5a9341e96fee22ff10
SHA256329f1eb8ce84459a3abf89b6e5a4eee826388125a62912ce2070c82a4ab82fc9
SHA512dd39fbfbe2431493502339989b7c932d5955046b3ad91d60a7adb0a0a8a43cfd048503630673695c5d68ede64cc08a11335c6e0d7cfbac57c282c002a9cd1478
-
Filesize
19KB
MD579ad5cb28ae9b11b2147e11c8908fe65
SHA18df0c3d226b59065379ff6bd82e200638808a0fc
SHA2563364607441b516ac76ccfce60bd1f5b61a09265b5d181979226bd58f91d62f42
SHA512d89d00fe63f67a3c7d7155181b4f8c32e839cead0fb1d84cbcfd9a731281461b4baa62b99ba35dccdfbae3e6628b18043c11ee1d5ea2cce9944e50996eba712a
-
Filesize
4.1MB
MD5f02a2a85716ac52ce4d99ab948364b6e
SHA19608371f18305316aa8995fa3be54f96fccd3ade
SHA2564f859516ca5062c171f79192909a794b52b9b28be05ed611003814c9da21c898
SHA512ca7938eba0692967a1cf717e3ddf5f4b7a414ac45dcea4b47ac3c80a143a5a2c01d7f039f2e8121b1e88ad947b463f365244bd21f10d6f718da74c81af8d1fe6
-
Filesize
4.2MB
MD511ab111ec46b24ac0e8822e3f1a88ffe
SHA180ae5ba81f6edab19dd3eefdab3de31ffd252ba0
SHA256e58a15345e96ddefc00b5e356a26743d9cda21b64b42f305e0b46d0db9cf6c46
SHA51208b7b061b32de65126bd22c8e04a917332c78e8fb77b660e35ebccf5cdfd5fbd07fb7f76efbb221da0f2cdc5a279aac6a26e8c0749b6dd862a9791da1b7274cb
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
8.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
6.2MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
272KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
600KB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
120KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
472KB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
4.9MB