Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/05/2024, 21:57

General

  • Target

    c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe

  • Size

    4.1MB

  • MD5

    5d554990f88d73556fb9c539884a5ebe

  • SHA1

    627b5540b78befb90725af0a8ec5ce3c57e08c72

  • SHA256

    c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03

  • SHA512

    f3282bdc6aff8380863d48dfa1ffec51e6405d91c1698a9964c04ef858dd9cf826a98d89e4bbe80c94e5a928aed93772599507e93913e816db6fcf73fe499291

  • SSDEEP

    98304:BsVQ+hudF4keJeyEqK0evsENr9r54Wa5Cc1nHXivv:Bs5hioeyE6OsERj43n4

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

Processes

  • C:\Users\Admin\AppData\Local\Temp\c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
    "C:\Users\Admin\AppData\Local\Temp\c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe"
    1⤵
      PID:5032
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4364
      • C:\Users\Admin\AppData\Local\Temp\c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe
        "C:\Users\Admin\AppData\Local\Temp\c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03.exe"
        2⤵
          PID:4560
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:2304
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            3⤵
              PID:1572
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                4⤵
                • Modifies Windows Firewall
                PID:1848
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1400
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:5024
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              3⤵
                PID:1612
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2072
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  4⤵
                  • Creates scheduled task(s)
                  PID:1404
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  4⤵
                    PID:2508
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:3592
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4388
                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                    4⤵
                      PID:4256
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      4⤵
                      • Creates scheduled task(s)
                      PID:2724
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      4⤵
                        PID:1456
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          5⤵
                            PID:3448
                            • C:\Windows\SysWOW64\sc.exe
                              sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              6⤵
                              • Launches sc.exe
                              PID:60
                  • C:\Windows\windefender.exe
                    C:\Windows\windefender.exe
                    1⤵
                      PID:4844

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t35ac2pl.tbb.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                      Filesize

                      281KB

                      MD5

                      d98e33b66343e7c96158444127a117f6

                      SHA1

                      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                      SHA256

                      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                      SHA512

                      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      968cb9309758126772781b83adb8a28f

                      SHA1

                      8da30e71accf186b2ba11da1797cf67f8f78b47c

                      SHA256

                      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                      SHA512

                      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      7a7822b45c2deb915acd35c3d72c919d

                      SHA1

                      49045328667c7c9febcb9d7c2c956a4618d8f44b

                      SHA256

                      2db27a059d467a0be956a9fcf2b986b98e3486e6ff93d49b2952387ef200759f

                      SHA512

                      9d5a5ed784fe27117c8550a86fb8cbb51f6d69bca3f0c152cd6a77a58409012a5f78a8ab6c2c7fb92d169d2a2952b46406fffd9e504cbeaf38218f823bd18ed1

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      6cb8ddad4e0649361dffa1bb820504c4

                      SHA1

                      e2ca564a6b5a659f7a9bff26d57851ae87b7c824

                      SHA256

                      24ad414704094cf91df381fd0ccd9d16910a61c3cf13fb493dc675428d80edc5

                      SHA512

                      6cc3cf88db12764c04b04eb3d2467fa5ab0e705fe1792de683ede21d367cefb406f2e3f05137b937e708fcf2822a9cb3b42b4b0524667ca384ca2f96b3c70109

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      bb8b4572f00024f6bbb4172107f19933

                      SHA1

                      fdf7b9ef270920d451ba6752611d3a7ace11cf93

                      SHA256

                      e22810a525c4125aae57275d2bbd2eec993c5abf59e82153ff39a02a2cd5dbb7

                      SHA512

                      dcf2a891886d93fd7c709078cb1083f17d1b7c889696dd4837e22ce9887a2ebe095925da6e026c663f7b9de9914f68e3ed8c654ba240c6f6cf151a20204a38da

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      fce78c9bd6e306662efdb1ee147de24d

                      SHA1

                      4522535b2531c3498d60c11ac7ee3020992fe5fc

                      SHA256

                      8518986813e5089e7575e2dcf157f791deaa46d23906b0e00813013e50e8e83a

                      SHA512

                      8f257c878e1c4d798fa3d818647b68aa77c2d70578c0cb276ee445dc47131de18c25d8742d139894714c9714af78ddb150a62a6d2c783a3a576ae935fac7200b

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      d7bf965bdde9679c879c6015e5dfadcf

                      SHA1

                      0940be174f08f599d27d8693f89540e089da08c3

                      SHA256

                      7ba11869f3dd8ffc5ea5e9872ab0c84da2ecb44f8f6a7feed3acf617ad1d58de

                      SHA512

                      64f86032489c4961c7311a94f9facce5d5bf37458cf1cc5657850f579c89f9f5e6df50bfb6f8a1acf1d5ac6e684ba2148bde1d5b2758a4eb485561a00677bf07

                    • C:\Windows\rss\csrss.exe

                      Filesize

                      4.1MB

                      MD5

                      5d554990f88d73556fb9c539884a5ebe

                      SHA1

                      627b5540b78befb90725af0a8ec5ce3c57e08c72

                      SHA256

                      c36653cb7df6edcb4bbf29043ffed14e9c229c4b46858323e9d00aebef1e0f03

                      SHA512

                      f3282bdc6aff8380863d48dfa1ffec51e6405d91c1698a9964c04ef858dd9cf826a98d89e4bbe80c94e5a928aed93772599507e93913e816db6fcf73fe499291

                    • C:\Windows\windefender.exe

                      Filesize

                      2.0MB

                      MD5

                      8e67f58837092385dcf01e8a2b4f5783

                      SHA1

                      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                      SHA256

                      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                      SHA512

                      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                    • memory/1400-95-0x00000000058E0000-0x0000000005C34000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/1400-98-0x0000000070DC0000-0x0000000071114000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/1400-97-0x0000000070C40000-0x0000000070C8C000-memory.dmp

                      Filesize

                      304KB

                    • memory/1456-227-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/1456-224-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/1612-261-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-228-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-218-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-252-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-231-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-249-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-246-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-243-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-240-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-237-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-234-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-258-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/1612-255-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/2072-161-0x0000000005E40000-0x0000000005E54000-memory.dmp

                      Filesize

                      80KB

                    • memory/2072-145-0x0000000005A40000-0x0000000005D94000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2072-147-0x0000000006100000-0x000000000614C000-memory.dmp

                      Filesize

                      304KB

                    • memory/2072-149-0x0000000070D40000-0x0000000071094000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2072-159-0x00000000072C0000-0x0000000007363000-memory.dmp

                      Filesize

                      652KB

                    • memory/2072-148-0x0000000070BA0000-0x0000000070BEC000-memory.dmp

                      Filesize

                      304KB

                    • memory/2072-160-0x00000000075E0000-0x00000000075F1000-memory.dmp

                      Filesize

                      68KB

                    • memory/2304-81-0x0000000007480000-0x0000000007491000-memory.dmp

                      Filesize

                      68KB

                    • memory/2304-82-0x00000000074D0000-0x00000000074E4000-memory.dmp

                      Filesize

                      80KB

                    • memory/2304-58-0x0000000005920000-0x0000000005C74000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/2304-68-0x00000000062F0000-0x000000000633C000-memory.dmp

                      Filesize

                      304KB

                    • memory/2304-69-0x0000000070C40000-0x0000000070C8C000-memory.dmp

                      Filesize

                      304KB

                    • memory/2304-80-0x0000000007160000-0x0000000007203000-memory.dmp

                      Filesize

                      652KB

                    • memory/2304-70-0x00000000713E0000-0x0000000071734000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3592-188-0x00000000063D0000-0x00000000063E4000-memory.dmp

                      Filesize

                      80KB

                    • memory/3592-172-0x00000000064C0000-0x0000000006814000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3592-187-0x0000000007E90000-0x0000000007EA1000-memory.dmp

                      Filesize

                      68KB

                    • memory/3592-175-0x0000000070AC0000-0x0000000070B0C000-memory.dmp

                      Filesize

                      304KB

                    • memory/3592-176-0x0000000070C40000-0x0000000070F94000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3592-186-0x0000000007B80000-0x0000000007C23000-memory.dmp

                      Filesize

                      652KB

                    • memory/3592-174-0x0000000006950000-0x000000000699C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4364-44-0x0000000007B70000-0x0000000007B7A000-memory.dmp

                      Filesize

                      40KB

                    • memory/4364-50-0x0000000007C10000-0x0000000007C18000-memory.dmp

                      Filesize

                      32KB

                    • memory/4364-4-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

                      Filesize

                      4KB

                    • memory/4364-47-0x0000000007BC0000-0x0000000007BCE000-memory.dmp

                      Filesize

                      56KB

                    • memory/4364-46-0x0000000007B80000-0x0000000007B91000-memory.dmp

                      Filesize

                      68KB

                    • memory/4364-45-0x0000000007C80000-0x0000000007D16000-memory.dmp

                      Filesize

                      600KB

                    • memory/4364-5-0x0000000004F30000-0x0000000004F66000-memory.dmp

                      Filesize

                      216KB

                    • memory/4364-28-0x0000000007A20000-0x0000000007A52000-memory.dmp

                      Filesize

                      200KB

                    • memory/4364-29-0x0000000070B40000-0x0000000070B8C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4364-30-0x0000000071280000-0x00000000715D4000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4364-43-0x0000000074CA0000-0x0000000075450000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4364-40-0x0000000007A60000-0x0000000007A7E000-memory.dmp

                      Filesize

                      120KB

                    • memory/4364-41-0x0000000007A80000-0x0000000007B23000-memory.dmp

                      Filesize

                      652KB

                    • memory/4364-48-0x0000000007BE0000-0x0000000007BF4000-memory.dmp

                      Filesize

                      80KB

                    • memory/4364-49-0x0000000007C20000-0x0000000007C3A000-memory.dmp

                      Filesize

                      104KB

                    • memory/4364-22-0x00000000064B0000-0x00000000064CE000-memory.dmp

                      Filesize

                      120KB

                    • memory/4364-53-0x0000000074CA0000-0x0000000075450000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4364-6-0x0000000074CA0000-0x0000000075450000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4364-7-0x0000000005630000-0x0000000005C58000-memory.dmp

                      Filesize

                      6.2MB

                    • memory/4364-8-0x0000000074CA0000-0x0000000075450000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4364-42-0x0000000074CA0000-0x0000000075450000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4364-9-0x00000000055E0000-0x0000000005602000-memory.dmp

                      Filesize

                      136KB

                    • memory/4364-10-0x0000000005CD0000-0x0000000005D36000-memory.dmp

                      Filesize

                      408KB

                    • memory/4364-26-0x0000000007EC0000-0x000000000853A000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/4364-11-0x0000000005E70000-0x0000000005ED6000-memory.dmp

                      Filesize

                      408KB

                    • memory/4364-27-0x0000000007860000-0x000000000787A000-memory.dmp

                      Filesize

                      104KB

                    • memory/4364-25-0x0000000007540000-0x00000000075B6000-memory.dmp

                      Filesize

                      472KB

                    • memory/4364-24-0x00000000069A0000-0x00000000069E4000-memory.dmp

                      Filesize

                      272KB

                    • memory/4364-21-0x0000000005EE0000-0x0000000006234000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4364-23-0x00000000064E0000-0x000000000652C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4388-201-0x0000000070C40000-0x0000000070F94000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4388-200-0x0000000070AC0000-0x0000000070B0C000-memory.dmp

                      Filesize

                      304KB

                    • memory/4560-217-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/4844-226-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/4844-236-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/4844-230-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/5024-119-0x0000000070C40000-0x0000000070C8C000-memory.dmp

                      Filesize

                      304KB

                    • memory/5024-120-0x0000000070DC0000-0x0000000071114000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/5032-1-0x0000000004250000-0x0000000004649000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/5032-56-0x0000000000400000-0x0000000000D1C000-memory.dmp

                      Filesize

                      9.1MB

                    • memory/5032-57-0x0000000004750000-0x000000000503B000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/5032-54-0x0000000000400000-0x0000000002732000-memory.dmp

                      Filesize

                      35.2MB

                    • memory/5032-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

                      Filesize

                      9.1MB

                    • memory/5032-2-0x0000000004750000-0x000000000503B000-memory.dmp

                      Filesize

                      8.9MB