Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2023, 16:27

General

  • Target

    06163599.exe

  • Size

    4.2MB

  • MD5

    f5908ce8f8ff0653624d84cad2001306

  • SHA1

    8f23b307dc68ab19bcbb60a4728f73bacc26c009

  • SHA256

    c59423f92f38d87d32c357ac16c4d0d5a229f04bf3c7d32dd17a7511a5cc22c4

  • SHA512

    8e0beb8089cb77dd8f76dde0d69b185dd4ce333b148b5bd98b10b5db1d45297290eb0eed6159daa03c9109913925d835d255907311466da371253373bce1b28d

  • SSDEEP

    98304:YS0/ZMi1k2Nd/mPNeMoK5qamQifu/bVE8Kyi/oUiJGnCD0IO+C:YS0/ui1vNd+oOqDuDVE8KlgxeatC

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 17 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\06163599.exe
    "C:\Users\Admin\AppData\Local\Temp\06163599.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3592
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1064
    • C:\Users\Admin\AppData\Local\Temp\06163599.exe
      "C:\Users\Admin\AppData\Local\Temp\06163599.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4356
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3740
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1760
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:2692
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2588
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3508
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:212
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1548
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:3800
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:1064
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3832
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4408
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:5028
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:3952

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jjvilhb0.kwo.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      d2068326127430f737f56df9a3e9e942

      SHA1

      2bfb7d4dedbb5b2b108c0d5bd71929b5091893d3

      SHA256

      8deeedefc7f07587c98e2a1b8c985b1355b5892bdd1dfbc017dde49305aceb57

      SHA512

      bff07ce41fdd82888d1f9747bf0dafaae2b6e32a1677d5150be0d5779e42e5741cf5a49083000ca46d083a6cc1f7228e9f08a4c7d731b97aa52cd1b6b6b8ffc1

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      f151be41e398798c02797e8111123fc2

      SHA1

      bc7650565a031d97e915f9531147c0602e564c03

      SHA256

      79b51d2e85e9de557d8269a8ec811a1ea8108e4c2d9bff1869e6a2bf42dc55d1

      SHA512

      2ff95f344ccead1375d86b1f7230be6cafa8231ace3caafa69ebba1f69ca2992cc2e34a216fd21593913c4c2972b08f65d839916a2c471cb804164b372b97855

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      8b71a990bf2e4ef64fef822b05ba37f1

      SHA1

      51ba28ed4c40ec1fe6c340dbecebe8305f6cd3f9

      SHA256

      5901a92006c1aa6c7239bb745737f3b7985dff3f1a486c801692a543c7e5035c

      SHA512

      7189ac9f92d4cc27e47662320b85e52d783f13ac94ebc726f5221ba14406390d80f69d69f9b7532fc6c3444cb8e08ead1a6361d0a3f944de53244e1deeb7e224

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      c3fa79ad83d3fd55c92d3b16af90ab36

      SHA1

      d3a1e234ae2a72c5850cef0344ac9cff8fd88663

      SHA256

      79a9ed6bbbb7ca6467d0f61b1ced2526f55d6f1947239843ced2fc7144ff5c2e

      SHA512

      c2e80c4fee7ba136553aee7106ebaa103cbe99f5d47fc60cdac73278da95f29607c6546039610512a58cc61f8740f84d94d103136ae6e643cce006daa220dc7f

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      159adaa02036ad549bbf8b947ebdb344

      SHA1

      c934dd03ed0578f5c2a911fbb96472f7932fa4d8

      SHA256

      d61d09786d9f1fb89b947ab4c6998a8c932e7e4ce22a7f3c285a9989180793b7

      SHA512

      6143f3dfe3bcac7b618c6025aaf655e82efde01aaf108cec2a5e8ac24ee71cd4f7b9905ea43adbe0bbdd2f92d083723bb123f0af9584f0d9bdd98ced55606997

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      f5908ce8f8ff0653624d84cad2001306

      SHA1

      8f23b307dc68ab19bcbb60a4728f73bacc26c009

      SHA256

      c59423f92f38d87d32c357ac16c4d0d5a229f04bf3c7d32dd17a7511a5cc22c4

      SHA512

      8e0beb8089cb77dd8f76dde0d69b185dd4ce333b148b5bd98b10b5db1d45297290eb0eed6159daa03c9109913925d835d255907311466da371253373bce1b28d

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      f5908ce8f8ff0653624d84cad2001306

      SHA1

      8f23b307dc68ab19bcbb60a4728f73bacc26c009

      SHA256

      c59423f92f38d87d32c357ac16c4d0d5a229f04bf3c7d32dd17a7511a5cc22c4

      SHA512

      8e0beb8089cb77dd8f76dde0d69b185dd4ce333b148b5bd98b10b5db1d45297290eb0eed6159daa03c9109913925d835d255907311466da371253373bce1b28d

    • memory/212-318-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/212-361-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/212-352-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/212-360-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/212-353-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/212-354-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/212-355-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/212-356-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/212-357-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/212-358-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/212-359-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/1064-153-0x0000000007530000-0x00000000075A6000-memory.dmp

      Filesize

      472KB

    • memory/1064-151-0x0000000006400000-0x000000000641E000-memory.dmp

      Filesize

      120KB

    • memory/1064-175-0x0000000007B60000-0x0000000007B7A000-memory.dmp

      Filesize

      104KB

    • memory/1064-176-0x0000000007B50000-0x0000000007B58000-memory.dmp

      Filesize

      32KB

    • memory/1064-173-0x0000000007BC0000-0x0000000007C56000-memory.dmp

      Filesize

      600KB

    • memory/1064-172-0x0000000007AB0000-0x0000000007ABA000-memory.dmp

      Filesize

      40KB

    • memory/1064-162-0x000000007FD10000-0x000000007FD20000-memory.dmp

      Filesize

      64KB

    • memory/1064-171-0x0000000007970000-0x000000000798E000-memory.dmp

      Filesize

      120KB

    • memory/1064-160-0x0000000070940000-0x0000000070C94000-memory.dmp

      Filesize

      3.3MB

    • memory/1064-159-0x00000000707C0000-0x000000007080C000-memory.dmp

      Filesize

      304KB

    • memory/1064-158-0x0000000007990000-0x00000000079C2000-memory.dmp

      Filesize

      200KB

    • memory/1064-157-0x00000000077E0000-0x00000000077FA000-memory.dmp

      Filesize

      104KB

    • memory/1064-156-0x0000000007E60000-0x00000000084DA000-memory.dmp

      Filesize

      6.5MB

    • memory/1064-155-0x00000000050D0000-0x00000000050E0000-memory.dmp

      Filesize

      64KB

    • memory/1064-152-0x0000000006950000-0x0000000006994000-memory.dmp

      Filesize

      272KB

    • memory/1064-174-0x0000000007B00000-0x0000000007B0E000-memory.dmp

      Filesize

      56KB

    • memory/1064-141-0x0000000005DB0000-0x0000000005E16000-memory.dmp

      Filesize

      408KB

    • memory/1064-140-0x00000000055D0000-0x0000000005636000-memory.dmp

      Filesize

      408KB

    • memory/1064-139-0x0000000005430000-0x0000000005452000-memory.dmp

      Filesize

      136KB

    • memory/1064-138-0x00000000050D0000-0x00000000050E0000-memory.dmp

      Filesize

      64KB

    • memory/1064-137-0x00000000050D0000-0x00000000050E0000-memory.dmp

      Filesize

      64KB

    • memory/1064-135-0x0000000002AC0000-0x0000000002AF6000-memory.dmp

      Filesize

      216KB

    • memory/1064-136-0x0000000005710000-0x0000000005D38000-memory.dmp

      Filesize

      6.2MB

    • memory/1548-281-0x0000000070820000-0x000000007086C000-memory.dmp

      Filesize

      304KB

    • memory/1548-280-0x0000000000D10000-0x0000000000D20000-memory.dmp

      Filesize

      64KB

    • memory/1548-279-0x0000000000D10000-0x0000000000D20000-memory.dmp

      Filesize

      64KB

    • memory/1548-278-0x0000000000D10000-0x0000000000D20000-memory.dmp

      Filesize

      64KB

    • memory/1548-282-0x0000000070FC0000-0x0000000071314000-memory.dmp

      Filesize

      3.3MB

    • memory/1548-292-0x000000007F6A0000-0x000000007F6B0000-memory.dmp

      Filesize

      64KB

    • memory/2588-233-0x000000007FC20000-0x000000007FC30000-memory.dmp

      Filesize

      64KB

    • memory/2588-210-0x0000000002780000-0x0000000002790000-memory.dmp

      Filesize

      64KB

    • memory/2588-209-0x0000000002780000-0x0000000002790000-memory.dmp

      Filesize

      64KB

    • memory/2588-221-0x0000000002780000-0x0000000002790000-memory.dmp

      Filesize

      64KB

    • memory/2588-222-0x00000000708C0000-0x000000007090C000-memory.dmp

      Filesize

      304KB

    • memory/2588-223-0x0000000071060000-0x00000000713B4000-memory.dmp

      Filesize

      3.3MB

    • memory/3508-250-0x0000000071080000-0x00000000713D4000-memory.dmp

      Filesize

      3.3MB

    • memory/3508-246-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

      Filesize

      64KB

    • memory/3508-245-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

      Filesize

      64KB

    • memory/3508-249-0x00000000708C0000-0x000000007090C000-memory.dmp

      Filesize

      304KB

    • memory/3508-248-0x000000007F370000-0x000000007F380000-memory.dmp

      Filesize

      64KB

    • memory/3508-247-0x0000000002CE0000-0x0000000002CF0000-memory.dmp

      Filesize

      64KB

    • memory/3592-134-0x0000000002FD0000-0x00000000038BB000-memory.dmp

      Filesize

      8.9MB

    • memory/3592-154-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/3592-179-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/3740-203-0x0000000004700000-0x0000000004710000-memory.dmp

      Filesize

      64KB

    • memory/3740-193-0x0000000071060000-0x00000000713B4000-memory.dmp

      Filesize

      3.3MB

    • memory/3740-204-0x000000007F1F0000-0x000000007F200000-memory.dmp

      Filesize

      64KB

    • memory/3740-192-0x00000000708C0000-0x000000007090C000-memory.dmp

      Filesize

      304KB

    • memory/3740-191-0x0000000004700000-0x0000000004710000-memory.dmp

      Filesize

      64KB

    • memory/3740-190-0x0000000004700000-0x0000000004710000-memory.dmp

      Filesize

      64KB

    • memory/3832-304-0x00000000029B0000-0x00000000029C0000-memory.dmp

      Filesize

      64KB

    • memory/3832-319-0x000000007F750000-0x000000007F760000-memory.dmp

      Filesize

      64KB

    • memory/3832-308-0x0000000070ED0000-0x0000000071224000-memory.dmp

      Filesize

      3.3MB

    • memory/3832-307-0x0000000070740000-0x000000007078C000-memory.dmp

      Filesize

      304KB

    • memory/3832-306-0x00000000029B0000-0x00000000029C0000-memory.dmp

      Filesize

      64KB

    • memory/3832-305-0x00000000029B0000-0x00000000029C0000-memory.dmp

      Filesize

      64KB

    • memory/4356-207-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/4356-260-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/4356-265-0x0000000000400000-0x0000000000D1B000-memory.dmp

      Filesize

      9.1MB

    • memory/4408-345-0x000000007F630000-0x000000007F640000-memory.dmp

      Filesize

      64KB

    • memory/4408-335-0x0000000070ED0000-0x0000000071224000-memory.dmp

      Filesize

      3.3MB

    • memory/4408-334-0x0000000070740000-0x000000007078C000-memory.dmp

      Filesize

      304KB

    • memory/4408-333-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

      Filesize

      64KB

    • memory/4408-332-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

      Filesize

      64KB

    • memory/4408-331-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

      Filesize

      64KB