Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    20s
  • platform
    windows10-1703_x64
  • resource
    win10-20231020-en
  • resource tags

    arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/11/2023, 17:20

General

  • Target

    e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe

  • Size

    4.1MB

  • MD5

    20346c14a5d6046612dfef269d0dddb0

  • SHA1

    544c70b6b4202706eafcd3cf8bf399a1bb113e72

  • SHA256

    e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2

  • SHA512

    03a6264cb1f3f54071bacf7d5c63ff5bb076e899d1b66ba8a0dd6debccf439f4615879fdf020ff116b758a4a384836d78639136b36891a960d4e0cd3bed78c44

  • SSDEEP

    98304:T4m/rubTkpC5ed0r3eLOS0vwOeytex7jRmkVQw7tg8Zt:sm/rubTXr3e7Dx7jM87tlH

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 10 IoCs
  • Windows security bypass 2 TTPs 7 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe
    "C:\Users\Admin\AppData\Local\Temp\e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4680
    • C:\Users\Admin\AppData\Local\Temp\e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe
      "C:\Users\Admin\AppData\Local\Temp\e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2.exe"
      2⤵
      • Windows security bypass
      • Windows security modification
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4312
      • C:\Windows\System32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4972
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4560
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3572
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        PID:3636
  • C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
    1⤵
    • Modifies Windows Firewall
    • Modifies data under HKEY_USERS
    PID:2032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_otkwuuj5.qwq.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    db01a2c1c7e70b2b038edf8ad5ad9826

    SHA1

    540217c647a73bad8d8a79e3a0f3998b5abd199b

    SHA256

    413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d

    SHA512

    c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6

  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

    Filesize

    18KB

    MD5

    594018989f661f76f2f92a28fd83bd8a

    SHA1

    5f5918a9a3df33b139f5c8dcebd5c72c565b3f5c

    SHA256

    8e3f7c34419d5ab090ec39f7cb98bf4382e8088cebc94bcd0ef6fa3a8e688689

    SHA512

    a6d13f5f7cd77337f06cd86171059da250c61c7095f4a55e3176c43ffbaa3a349f58e335b0510795ff2753bff9b580bf2e6d49e2ec7f7cdb2e3a839c92b50d05

  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

    Filesize

    18KB

    MD5

    f73adc7b9c010e89cfe048537064c9ea

    SHA1

    e2019cf23c3b856d42df1ce9d4609391cf16aed4

    SHA256

    7a07aa1b84b6b2eb3c4f4e4c499a51fc6573f2d9603cc046a39f5608810097c2

    SHA512

    e7ac26897cf4d50db118d8ba5c646ab2572860b311106ff30dc1b8918fb69a82ee8ecdc3cda1810750461240ed4a50b8f08e24a549b36f7dfc0f146543af2f63

  • C:\Windows\rss\csrss.exe

    Filesize

    4.1MB

    MD5

    20346c14a5d6046612dfef269d0dddb0

    SHA1

    544c70b6b4202706eafcd3cf8bf399a1bb113e72

    SHA256

    e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2

    SHA512

    03a6264cb1f3f54071bacf7d5c63ff5bb076e899d1b66ba8a0dd6debccf439f4615879fdf020ff116b758a4a384836d78639136b36891a960d4e0cd3bed78c44

  • C:\Windows\rss\csrss.exe

    Filesize

    4.1MB

    MD5

    20346c14a5d6046612dfef269d0dddb0

    SHA1

    544c70b6b4202706eafcd3cf8bf399a1bb113e72

    SHA256

    e5f35a540a59ceec36f25192fd501a85278b575cbff601980c946a373fc914b2

    SHA512

    03a6264cb1f3f54071bacf7d5c63ff5bb076e899d1b66ba8a0dd6debccf439f4615879fdf020ff116b758a4a384836d78639136b36891a960d4e0cd3bed78c44

  • memory/2776-306-0x0000000000400000-0x0000000000D1C000-memory.dmp

    Filesize

    9.1MB

  • memory/2776-305-0x0000000002A40000-0x0000000002E39000-memory.dmp

    Filesize

    4.0MB

  • memory/2776-1050-0x0000000000400000-0x0000000000D1C000-memory.dmp

    Filesize

    9.1MB

  • memory/2776-561-0x0000000002A40000-0x0000000002E39000-memory.dmp

    Filesize

    4.0MB

  • memory/2776-803-0x0000000000400000-0x0000000000D1C000-memory.dmp

    Filesize

    9.1MB

  • memory/2776-806-0x0000000000400000-0x0000000000D1C000-memory.dmp

    Filesize

    9.1MB

  • memory/3572-833-0x0000000006FA0000-0x0000000006FB0000-memory.dmp

    Filesize

    64KB

  • memory/3572-828-0x00000000700B0000-0x0000000070400000-memory.dmp

    Filesize

    3.3MB

  • memory/3572-807-0x0000000006FA0000-0x0000000006FB0000-memory.dmp

    Filesize

    64KB

  • memory/3572-805-0x0000000006FA0000-0x0000000006FB0000-memory.dmp

    Filesize

    64KB

  • memory/3572-804-0x0000000073330000-0x0000000073A1E000-memory.dmp

    Filesize

    6.9MB

  • memory/3572-827-0x0000000070060000-0x00000000700AB000-memory.dmp

    Filesize

    300KB

  • memory/3572-1046-0x0000000073330000-0x0000000073A1E000-memory.dmp

    Filesize

    6.9MB

  • memory/3636-1053-0x0000000002E00000-0x00000000031F9000-memory.dmp

    Filesize

    4.0MB

  • memory/3636-1054-0x0000000000400000-0x0000000000D1C000-memory.dmp

    Filesize

    9.1MB

  • memory/4204-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

    Filesize

    9.1MB

  • memory/4204-303-0x0000000002E70000-0x000000000375B000-memory.dmp

    Filesize

    8.9MB

  • memory/4204-2-0x0000000002E70000-0x000000000375B000-memory.dmp

    Filesize

    8.9MB

  • memory/4204-1-0x0000000002A70000-0x0000000002E70000-memory.dmp

    Filesize

    4.0MB

  • memory/4204-302-0x0000000000400000-0x0000000000D1C000-memory.dmp

    Filesize

    9.1MB

  • memory/4204-299-0x0000000002A70000-0x0000000002E70000-memory.dmp

    Filesize

    4.0MB

  • memory/4204-298-0x0000000000400000-0x0000000000D1C000-memory.dmp

    Filesize

    9.1MB

  • memory/4312-332-0x000000007F420000-0x000000007F430000-memory.dmp

    Filesize

    64KB

  • memory/4312-339-0x00000000091B0000-0x0000000009255000-memory.dmp

    Filesize

    660KB

  • memory/4312-340-0x00000000069B0000-0x00000000069C0000-memory.dmp

    Filesize

    64KB

  • memory/4312-333-0x0000000070060000-0x00000000700AB000-memory.dmp

    Filesize

    300KB

  • memory/4312-554-0x0000000073330000-0x0000000073A1E000-memory.dmp

    Filesize

    6.9MB

  • memory/4312-311-0x00000000069B0000-0x00000000069C0000-memory.dmp

    Filesize

    64KB

  • memory/4312-310-0x00000000069B0000-0x00000000069C0000-memory.dmp

    Filesize

    64KB

  • memory/4312-309-0x0000000073330000-0x0000000073A1E000-memory.dmp

    Filesize

    6.9MB

  • memory/4312-312-0x0000000007860000-0x0000000007BB0000-memory.dmp

    Filesize

    3.3MB

  • memory/4312-313-0x00000000081B0000-0x00000000081FB000-memory.dmp

    Filesize

    300KB

  • memory/4312-334-0x00000000700B0000-0x0000000070400000-memory.dmp

    Filesize

    3.3MB

  • memory/4560-581-0x0000000070060000-0x00000000700AB000-memory.dmp

    Filesize

    300KB

  • memory/4560-559-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

    Filesize

    64KB

  • memory/4560-800-0x0000000073330000-0x0000000073A1E000-memory.dmp

    Filesize

    6.9MB

  • memory/4560-587-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

    Filesize

    64KB

  • memory/4560-582-0x00000000700B0000-0x0000000070400000-memory.dmp

    Filesize

    3.3MB

  • memory/4560-558-0x0000000073330000-0x0000000073A1E000-memory.dmp

    Filesize

    6.9MB

  • memory/4560-560-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

    Filesize

    64KB

  • memory/4680-74-0x000000006FF40000-0x000000006FF8B000-memory.dmp

    Filesize

    300KB

  • memory/4680-35-0x0000000008DF0000-0x0000000008E2C000-memory.dmp

    Filesize

    240KB

  • memory/4680-76-0x000000000A860000-0x000000000A87E000-memory.dmp

    Filesize

    120KB

  • memory/4680-82-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/4680-83-0x000000000AAA0000-0x000000000AB34000-memory.dmp

    Filesize

    592KB

  • memory/4680-75-0x000000006FF90000-0x00000000702E0000-memory.dmp

    Filesize

    3.3MB

  • memory/4680-276-0x000000000AA40000-0x000000000AA5A000-memory.dmp

    Filesize

    104KB

  • memory/4680-281-0x000000000AA30000-0x000000000AA38000-memory.dmp

    Filesize

    32KB

  • memory/4680-301-0x0000000073230000-0x000000007391E000-memory.dmp

    Filesize

    6.9MB

  • memory/4680-73-0x000000000A880000-0x000000000A8B3000-memory.dmp

    Filesize

    204KB

  • memory/4680-66-0x0000000009AA0000-0x0000000009B16000-memory.dmp

    Filesize

    472KB

  • memory/4680-81-0x000000000A8C0000-0x000000000A965000-memory.dmp

    Filesize

    660KB

  • memory/4680-16-0x0000000008C20000-0x0000000008C6B000-memory.dmp

    Filesize

    300KB

  • memory/4680-15-0x00000000088E0000-0x00000000088FC000-memory.dmp

    Filesize

    112KB

  • memory/4680-14-0x0000000008470000-0x00000000087C0000-memory.dmp

    Filesize

    3.3MB

  • memory/4680-13-0x0000000007BE0000-0x0000000007C46000-memory.dmp

    Filesize

    408KB

  • memory/4680-12-0x0000000008400000-0x0000000008466000-memory.dmp

    Filesize

    408KB

  • memory/4680-11-0x0000000007B40000-0x0000000007B62000-memory.dmp

    Filesize

    136KB

  • memory/4680-10-0x0000000007C60000-0x0000000008288000-memory.dmp

    Filesize

    6.2MB

  • memory/4680-9-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/4680-8-0x00000000050A0000-0x00000000050B0000-memory.dmp

    Filesize

    64KB

  • memory/4680-7-0x0000000073230000-0x000000007391E000-memory.dmp

    Filesize

    6.9MB

  • memory/4680-6-0x0000000005480000-0x00000000054B6000-memory.dmp

    Filesize

    216KB