Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
9s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
13/10/2023, 02:40
General
-
Target
JC_817492ecf2bf99cefbae7f2597ff273b62aaa0abde51176eabc89485840b10b7.exe
-
Size
4.2MB
-
MD5
902a6864c77a1156e2acf968217fc068
-
SHA1
c721a18cf0f7577f1b034c2867fa6e787d20b66a
-
SHA256
817492ecf2bf99cefbae7f2597ff273b62aaa0abde51176eabc89485840b10b7
-
SHA512
273c2e0ccf0fbd42611d1e190ce53620dac19b209a12840b8ca3ffc9744b271ca5246ff0ad269f57aa2cd7364f3642386bdde44beb3c566bf0f80bb0b90b77c8
-
SSDEEP
98304:v2LSaMsua00GVP4yTqyN9qqOwAlVOkMhr2c+PXxYGrYCnb5iVp8:uSaMsn00OaEsJO3hCc+Prbkg
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 10 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JC_817492ecf2bf99cefbae7f2597ff273b62aaa0abde51176eabc89485840b10b7.exe"C:\Users\Admin\AppData\Local\Temp\JC_817492ecf2bf99cefbae7f2597ff273b62aaa0abde51176eabc89485840b10b7.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\JC_817492ecf2bf99cefbae7f2597ff273b62aaa0abde51176eabc89485840b10b7.exe"C:\Users\Admin\AppData\Local\Temp\JC_817492ecf2bf99cefbae7f2597ff273b62aaa0abde51176eabc89485840b10b7.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
19KB
MD57d16a51c834b1cd8af786a5d8f583f36
SHA140595760747ff0b943a8d7736768cf13068115ab
SHA256991c70dae4c38088ca25dbe5abfa56be774a66287df7047a1108749a24eceb6a
SHA512b56d8302f248bcf98ffd412e38c1094d5b37f98ca96080de5cf42cc63c8bb877f83da016ef89635f7fcf362d704df44477a848b01db76ad82b9813e9bd922ff2
-
Filesize
19KB
MD5363717e2019e1859ebc947082dc14efd
SHA1e3bea8b8d8b7d8804ade9e9c612a16e8784c6473
SHA256a8d611b58d1df30c3ceac7ab7d2db92cf992cd954b43953770ec3d90384b344f
SHA5127100cbaf841e59b3a17f8a9af0ff44131a95972ff01e1f6360f685f09fa6ff82b868e10ee80fc693f54af6f09adffc67511f41094c96d0cbb92bd6e9bea0c944
-
Filesize
19KB
MD5cbb792a6cf6c6a78d7cd9abfa3ee6e03
SHA153d24315ff5201a095741580b25709bd6c2b168d
SHA2563fe0f4bb5acbc9e535b91f38de628c0e26e55b2e68d2efd63a37681ff9764a1a
SHA512fc9568dfa75fb084ff9f76744eeea2cca1aa3aa2f1f76d7001a08e5ebdcc56e904340f3f1a109268e60c964a9bad4da754da960ca8e86335e670c7417d89a448
-
Filesize
19KB
MD5c8a70ec10d08589bd7351161f7a6fcb5
SHA12bc4754cd0fba4716b8b4ce68ea62714356c7f59
SHA256362d63908d2aa6e54b9b7c89163d91fbea6b0073b9671dd0bf6217cf7ed41760
SHA51299132bf68ca4a94fcad6a379e03e0f0c4636cf3cf7ec8468255cfad7524c56c1cc2dd9bb8397e7073992cbb22b9913a7468b3dbbf52109caff4e11e47ca193a9
-
Filesize
19KB
MD57e85e2a91e6be1adb92c7e0b014d8a8f
SHA1539c890dc850fb0e07b7cdecb2cd0fbff35a05d4
SHA2561da2aa8daa22b9db6e9b4e4e4c8eeb0efde621c6664145e0ab61fb820273c26c
SHA512dd2630b8862d3eaf89b1be4d2bfe6354b4dc8a2b50b1cb582104f503deda7c606588487549150736ad205c33c8467bf9226843b1de40485a96d3350a6e98af77
-
Filesize
4.2MB
MD5902a6864c77a1156e2acf968217fc068
SHA1c721a18cf0f7577f1b034c2867fa6e787d20b66a
SHA256817492ecf2bf99cefbae7f2597ff273b62aaa0abde51176eabc89485840b10b7
SHA512273c2e0ccf0fbd42611d1e190ce53620dac19b209a12840b8ca3ffc9744b271ca5246ff0ad269f57aa2cd7364f3642386bdde44beb3c566bf0f80bb0b90b77c8
-
Filesize
4.2MB
MD5902a6864c77a1156e2acf968217fc068
SHA1c721a18cf0f7577f1b034c2867fa6e787d20b66a
SHA256817492ecf2bf99cefbae7f2597ff273b62aaa0abde51176eabc89485840b10b7
SHA512273c2e0ccf0fbd42611d1e190ce53620dac19b209a12840b8ca3ffc9744b271ca5246ff0ad269f57aa2cd7364f3642386bdde44beb3c566bf0f80bb0b90b77c8
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
36.1MB
-
Filesize
652KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
68KB
-
Filesize
7.7MB
-
Filesize
80KB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
32KB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
56KB
-
Filesize
7.7MB
-
Filesize
68KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
600KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
652KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
80KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
472KB
-
Filesize
64KB
-
Filesize
272KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
36.1MB
-
Filesize
4.0MB