Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 20:33

General

  • Target

    ccb2ddb153ce168d0542cc01061fa37025830cd8f01a5c368a58b8ae3d51cce5.exe

  • Size

    4.2MB

  • MD5

    a448b0a6b69956fa7cdc7f7b0c6eb8ed

  • SHA1

    30b76223109b5f320663ff670b722f2f59d5b524

  • SHA256

    ccb2ddb153ce168d0542cc01061fa37025830cd8f01a5c368a58b8ae3d51cce5

  • SHA512

    1227bf082b468e0c502a8070049e7e657407c0c55676d5da33881fdc0253e73816b81180af343c108c0b92db50f4baf2342cb189f6ea8be1beb092b4c653ae8a

  • SSDEEP

    98304:q2m5eOYCD1ID98VF2Kih+6YxfniOeVNR3JpIP6GA7sf3HgV11Gd:q2m5BYCDY8uVjYxfniXVNFJ2yR7sfQVM

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 18 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ccb2ddb153ce168d0542cc01061fa37025830cd8f01a5c368a58b8ae3d51cce5.exe
    "C:\Users\Admin\AppData\Local\Temp\ccb2ddb153ce168d0542cc01061fa37025830cd8f01a5c368a58b8ae3d51cce5.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1040
    • C:\Users\Admin\AppData\Local\Temp\ccb2ddb153ce168d0542cc01061fa37025830cd8f01a5c368a58b8ae3d51cce5.exe
      "C:\Users\Admin\AppData\Local\Temp\ccb2ddb153ce168d0542cc01061fa37025830cd8f01a5c368a58b8ae3d51cce5.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3748
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4840
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1072
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:4224
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3464
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2572
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1016
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3868
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:1956
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:1880
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4236
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1036
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:4232
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:2992

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ak2pgz1.2xe.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      67c73b66c838370424d0633dcd972c94

      SHA1

      2f1c5f99bdac55f6f7a5108f0d4ee0bb03be684a

      SHA256

      3765953d257f69715805bd1205da2341412172ffac8c004240bb099c2b8b8356

      SHA512

      e585af4a382f193978993a7fe487920ea45790a3338392d7b855f0f2e14451f577ab35b466ba8baf6f15d153e82cd1d488b4fce41034f603e3e608488192b896

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      e804e5fc36a8aa29eb900943ed5e16f6

      SHA1

      53bb85a39687e35155731e87586a1136bbdf65de

      SHA256

      52224d477201422531adf00a2a21d39454ca0b53f27133bce52a3a8ce459e660

      SHA512

      99825ceaeb33e19dfc929987dcc8c298955a23ca47b93a9148f8f320be6bb0f4b7a5bbb05bfce497440d653111ceec1041beab88a444be33188e81be3896588f

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      f862517dfd07585b7701b4395b8983f8

      SHA1

      cd8d8cd5bab40d2200b47a480159be1a2eb41ee2

      SHA256

      9b7ae21d19e900140a46564a9de50cd3d127b6e7b08d06d7d4bcdb8ccfd8f9d0

      SHA512

      5a2aed196f7443740fcea74b689f41f95a53b845f1f2318115bd4150ef433e405b793db86436480943ac823de51acabc5a1e59edf42d6191a5223f52f8b1dc59

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      12502663c8be17e2be80249910c0c4ac

      SHA1

      1c0f16d29d9dfe97d6fe2f1cee39742a406201fd

      SHA256

      a64dc7debd2527b0218b922dd359ca07f49ceadaa5f9cc5afe9d10672e9e1f0b

      SHA512

      18dbe4d89aa232c834252b7fc2dab77005ab68675f7eb6a4950fb485a4a8ac1e59ee920943014f1e64511ab198eb1f71f5710fc9d520dad1a1c5e4da95ed0883

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      7956c181520e9229fc8df66b01344756

      SHA1

      0811c64accc087038077421d2c1f074282bb1fb1

      SHA256

      9395e088f05c94cac636e091aee872e5635bd441ad23d90a27ec39ebffedfa95

      SHA512

      01f2574e540f0bbeecce87ee10bb722c30ec3ffdd092e7e8a5e46239e091f81b2b644615cba49b840bb1ea7eb03be0ff003d9ce0215e55784f1ec39a82f2b062

    • C:\Windows\rss\csrss.exe

      Filesize

      4.2MB

      MD5

      a448b0a6b69956fa7cdc7f7b0c6eb8ed

      SHA1

      30b76223109b5f320663ff670b722f2f59d5b524

      SHA256

      ccb2ddb153ce168d0542cc01061fa37025830cd8f01a5c368a58b8ae3d51cce5

      SHA512

      1227bf082b468e0c502a8070049e7e657407c0c55676d5da33881fdc0253e73816b81180af343c108c0b92db50f4baf2342cb189f6ea8be1beb092b4c653ae8a

    • memory/1016-157-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-236-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-226-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-223-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-220-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-218-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-215-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-246-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-244-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-233-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-228-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-238-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1016-241-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1036-197-0x0000000071120000-0x0000000071474000-memory.dmp

      Filesize

      3.3MB

    • memory/1036-196-0x0000000070990000-0x00000000709DC000-memory.dmp

      Filesize

      304KB

    • memory/1040-51-0x0000000074BD0000-0x0000000075380000-memory.dmp

      Filesize

      7.7MB

    • memory/1040-10-0x00000000053D0000-0x0000000005436000-memory.dmp

      Filesize

      408KB

    • memory/1040-44-0x0000000007960000-0x0000000007971000-memory.dmp

      Filesize

      68KB

    • memory/1040-45-0x00000000079A0000-0x00000000079AE000-memory.dmp

      Filesize

      56KB

    • memory/1040-46-0x00000000079B0000-0x00000000079C4000-memory.dmp

      Filesize

      80KB

    • memory/1040-47-0x0000000007AA0000-0x0000000007ABA000-memory.dmp

      Filesize

      104KB

    • memory/1040-48-0x00000000079F0000-0x00000000079F8000-memory.dmp

      Filesize

      32KB

    • memory/1040-42-0x0000000007940000-0x000000000794A000-memory.dmp

      Filesize

      40KB

    • memory/1040-41-0x0000000007850000-0x00000000078F3000-memory.dmp

      Filesize

      652KB

    • memory/1040-4-0x0000000002C70000-0x0000000002CA6000-memory.dmp

      Filesize

      216KB

    • memory/1040-40-0x0000000007830000-0x000000000784E000-memory.dmp

      Filesize

      120KB

    • memory/1040-30-0x0000000070BF0000-0x0000000070F44000-memory.dmp

      Filesize

      3.3MB

    • memory/1040-29-0x0000000070A70000-0x0000000070ABC000-memory.dmp

      Filesize

      304KB

    • memory/1040-28-0x00000000077F0000-0x0000000007822000-memory.dmp

      Filesize

      200KB

    • memory/1040-27-0x0000000007640000-0x000000000765A000-memory.dmp

      Filesize

      104KB

    • memory/1040-26-0x0000000007CA0000-0x000000000831A000-memory.dmp

      Filesize

      6.5MB

    • memory/1040-25-0x00000000075A0000-0x0000000007616000-memory.dmp

      Filesize

      472KB

    • memory/1040-7-0x0000000005010000-0x0000000005020000-memory.dmp

      Filesize

      64KB

    • memory/1040-6-0x0000000005010000-0x0000000005020000-memory.dmp

      Filesize

      64KB

    • memory/1040-24-0x00000000067D0000-0x0000000006814000-memory.dmp

      Filesize

      272KB

    • memory/1040-5-0x0000000074BD0000-0x0000000075380000-memory.dmp

      Filesize

      7.7MB

    • memory/1040-8-0x0000000005650000-0x0000000005C78000-memory.dmp

      Filesize

      6.2MB

    • memory/1040-23-0x0000000006320000-0x000000000636C000-memory.dmp

      Filesize

      304KB

    • memory/1040-22-0x0000000006260000-0x000000000627E000-memory.dmp

      Filesize

      120KB

    • memory/1040-9-0x00000000052B0000-0x00000000052D2000-memory.dmp

      Filesize

      136KB

    • memory/1040-43-0x0000000007A00000-0x0000000007A96000-memory.dmp

      Filesize

      600KB

    • memory/1040-11-0x0000000005C80000-0x0000000005CE6000-memory.dmp

      Filesize

      408KB

    • memory/1040-21-0x0000000005EC0000-0x0000000006214000-memory.dmp

      Filesize

      3.3MB

    • memory/1596-155-0x00000000064A0000-0x0000000006D8B000-memory.dmp

      Filesize

      8.9MB

    • memory/1596-2-0x00000000064A0000-0x0000000006D8B000-memory.dmp

      Filesize

      8.9MB

    • memory/1596-153-0x00000000047F0000-0x0000000004BF1000-memory.dmp

      Filesize

      4.0MB

    • memory/1596-3-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1596-63-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/1596-1-0x00000000047F0000-0x0000000004BF1000-memory.dmp

      Filesize

      4.0MB

    • memory/2572-114-0x00000000711F0000-0x0000000071544000-memory.dmp

      Filesize

      3.3MB

    • memory/2572-113-0x0000000070A70000-0x0000000070ABC000-memory.dmp

      Filesize

      304KB

    • memory/3464-91-0x0000000070A70000-0x0000000070ABC000-memory.dmp

      Filesize

      304KB

    • memory/3464-92-0x00000000711F0000-0x0000000071544000-memory.dmp

      Filesize

      3.3MB

    • memory/3748-152-0x0000000000400000-0x0000000004420000-memory.dmp

      Filesize

      64.1MB

    • memory/3868-141-0x0000000070BF0000-0x0000000070F44000-memory.dmp

      Filesize

      3.3MB

    • memory/3868-140-0x0000000070A70000-0x0000000070ABC000-memory.dmp

      Filesize

      304KB

    • memory/4236-172-0x0000000071120000-0x0000000071474000-memory.dmp

      Filesize

      3.3MB

    • memory/4236-184-0x00000000060C0000-0x00000000060D4000-memory.dmp

      Filesize

      80KB

    • memory/4236-183-0x0000000007840000-0x0000000007851000-memory.dmp

      Filesize

      68KB

    • memory/4236-182-0x0000000007500000-0x00000000075A3000-memory.dmp

      Filesize

      652KB

    • memory/4236-171-0x0000000070990000-0x00000000709DC000-memory.dmp

      Filesize

      304KB

    • memory/4236-170-0x0000000006320000-0x000000000636C000-memory.dmp

      Filesize

      304KB

    • memory/4236-164-0x0000000005BC0000-0x0000000005F14000-memory.dmp

      Filesize

      3.3MB

    • memory/4840-77-0x0000000007920000-0x0000000007934000-memory.dmp

      Filesize

      80KB

    • memory/4840-76-0x00000000078D0000-0x00000000078E1000-memory.dmp

      Filesize

      68KB

    • memory/4840-75-0x00000000075A0000-0x0000000007643000-memory.dmp

      Filesize

      652KB

    • memory/4840-65-0x00000000711F0000-0x0000000071544000-memory.dmp

      Filesize

      3.3MB

    • memory/4840-64-0x0000000070A70000-0x0000000070ABC000-memory.dmp

      Filesize

      304KB

    • memory/4840-53-0x0000000005D60000-0x00000000060B4000-memory.dmp

      Filesize

      3.3MB