Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2024, 01:41

General

  • Target

    811e781c0daf7f48574648d645cfe18748f98050cd0e9082c0cb6bad733e73b9.exe

  • Size

    4.1MB

  • MD5

    e28c736b12b9ffec924ee1ce8d2f3874

  • SHA1

    d35c058e813ad02bd2b9950b3c7500d8847320c0

  • SHA256

    811e781c0daf7f48574648d645cfe18748f98050cd0e9082c0cb6bad733e73b9

  • SHA512

    52970ae631da7a457c0d9a78cdb7783570dddb2f78bd060a68b777a89e803bfd1958b1e7cd64d0c12e4a58abbd716abc8a710499c96eee04d9ee2e1a2803f8a8

  • SSDEEP

    98304:SQGLdTw13YmTlGi/xMFRAVNS6wnhY59m5e0z8345l:SLpT0YNaxn5wu5s59Y4

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 15 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\811e781c0daf7f48574648d645cfe18748f98050cd0e9082c0cb6bad733e73b9.exe
    "C:\Users\Admin\AppData\Local\Temp\811e781c0daf7f48574648d645cfe18748f98050cd0e9082c0cb6bad733e73b9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1008
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3900
    • C:\Users\Admin\AppData\Local\Temp\811e781c0daf7f48574648d645cfe18748f98050cd0e9082c0cb6bad733e73b9.exe
      "C:\Users\Admin\AppData\Local\Temp\811e781c0daf7f48574648d645cfe18748f98050cd0e9082c0cb6bad733e73b9.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3340
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4920
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1524
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:5072
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3920
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1432
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3528
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4020
          • C:\Windows\System32\Conhost.exe
            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            5⤵
              PID:3900
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:4172
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /delete /tn ScheduledUpdate /f
            4⤵
              PID:4764
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Drops file in System32 directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:696
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              4⤵
              • Drops file in System32 directory
              • Command and Scripting Interpreter: PowerShell
              • Modifies data under HKEY_USERS
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3192
            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              PID:4280
            • C:\Windows\SYSTEM32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              4⤵
              • Creates scheduled task(s)
              PID:5028
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                5⤵
                  PID:1432

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5v3wqdgj.yl5.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

          Filesize

          281KB

          MD5

          d98e33b66343e7c96158444127a117f6

          SHA1

          bb716c5509a2bf345c6c1152f6e3e1452d39d50d

          SHA256

          5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

          SHA512

          705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          968cb9309758126772781b83adb8a28f

          SHA1

          8da30e71accf186b2ba11da1797cf67f8f78b47c

          SHA256

          92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

          SHA512

          4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

          Filesize

          19KB

          MD5

          955076451562ff1aad6dd1687bb33020

          SHA1

          a132f109982c5bb93814141d8bfbf07981373f35

          SHA256

          5ad6809191d792e7e0bf9807e022401f9228a5df6b44c7d8dfa8a27526248f65

          SHA512

          0999e979b0ef3294c307f7478860ae5919353723ac30840d78414269d48f6d71339114f02e464bce50cf928117057af066a516bb05ee1df4ac8a01b2d4c6d482

        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

          Filesize

          19KB

          MD5

          4723769211a8548d0fbba2c09a0f3bf5

          SHA1

          b8903ed7045de3394767532c36938e281653d91c

          SHA256

          aeacfa894766966723692a3ff50e363a97db83799419751253ff9f2ef1c4b50b

          SHA512

          cf9c3153e5e6de02ef868500df8c2af84dd1c51acfaef44686b014418273f7d38e2b145319db9f0c5a0a56394f9d322a6998baf4a1bc912458e864988cd796f8

        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

          Filesize

          19KB

          MD5

          7905e531a1838db86bcd01b07710f4f9

          SHA1

          53e71b227614ce12142dc22390362a52e56bb043

          SHA256

          8bebb91234cc11046429e866f9f985f30cdab74e1f1173dd26999fcbfde2a3de

          SHA512

          21b8f3a8cb1f48afcfc0315f4835beddc33660f9753cb55ddf883c69a41764180fbe912aa9d59175f28ac3394aca63989002c9c87e710307bf548fde0ccfb290

        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

          Filesize

          19KB

          MD5

          7cf4320cca122dc75ab2180f3d83cd3d

          SHA1

          884dc905bc5a5c1644244b4d571b146f476c2714

          SHA256

          dab17a39fbd514260b9e2a3fd714bb4282c421ab83cb449587db6d7f620a3c97

          SHA512

          3b948f14dadd6256f1d2fc26e1b943780f2eb570869b83d6b52fb0614e9ae706ee7026d0d39ef6d1575c5d03079a41ee6d5a7cb81c5712d0baea21e0d3c907f3

        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

          Filesize

          19KB

          MD5

          73b9c537ddea836dc722f73d423570e9

          SHA1

          29c2368f5d54095b5058a326fe5b83d3d6b7193c

          SHA256

          1589387ce323606cb1cc28698be8ddafcf70a5e7f8ad62621afde8b1d7ebaa5a

          SHA512

          e4246b170df77760c367ac168e5092646422ea8f8834b59c527b1a2099b6bb15543381cca8ba36625c7e9c49040675a0b3190c471da9351035a92afea32dab3c

        • C:\Windows\rss\csrss.exe

          Filesize

          4.1MB

          MD5

          e28c736b12b9ffec924ee1ce8d2f3874

          SHA1

          d35c058e813ad02bd2b9950b3c7500d8847320c0

          SHA256

          811e781c0daf7f48574648d645cfe18748f98050cd0e9082c0cb6bad733e73b9

          SHA512

          52970ae631da7a457c0d9a78cdb7783570dddb2f78bd060a68b777a89e803bfd1958b1e7cd64d0c12e4a58abbd716abc8a710499c96eee04d9ee2e1a2803f8a8

        • memory/696-178-0x0000000070770000-0x0000000070AC4000-memory.dmp

          Filesize

          3.3MB

        • memory/696-177-0x00000000705F0000-0x000000007063C000-memory.dmp

          Filesize

          304KB

        • memory/696-190-0x0000000005B30000-0x0000000005B44000-memory.dmp

          Filesize

          80KB

        • memory/696-174-0x0000000005730000-0x0000000005A84000-memory.dmp

          Filesize

          3.3MB

        • memory/696-176-0x0000000006090000-0x00000000060DC000-memory.dmp

          Filesize

          304KB

        • memory/696-189-0x0000000007250000-0x0000000007261000-memory.dmp

          Filesize

          68KB

        • memory/696-188-0x0000000006F40000-0x0000000006FE3000-memory.dmp

          Filesize

          652KB

        • memory/1008-54-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/1008-57-0x0000000004A80000-0x000000000536B000-memory.dmp

          Filesize

          8.9MB

        • memory/1008-56-0x0000000000400000-0x0000000000D1C000-memory.dmp

          Filesize

          9.1MB

        • memory/1008-1-0x0000000004680000-0x0000000004A7A000-memory.dmp

          Filesize

          4.0MB

        • memory/1008-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

          Filesize

          9.1MB

        • memory/1008-2-0x0000000004A80000-0x000000000536B000-memory.dmp

          Filesize

          8.9MB

        • memory/1432-118-0x0000000006010000-0x0000000006364000-memory.dmp

          Filesize

          3.3MB

        • memory/1432-120-0x0000000070770000-0x00000000707BC000-memory.dmp

          Filesize

          304KB

        • memory/1432-121-0x0000000070900000-0x0000000070C54000-memory.dmp

          Filesize

          3.3MB

        • memory/3192-203-0x00000000705F0000-0x000000007063C000-memory.dmp

          Filesize

          304KB

        • memory/3192-204-0x0000000070DA0000-0x00000000710F4000-memory.dmp

          Filesize

          3.3MB

        • memory/3192-201-0x0000000005EA0000-0x00000000061F4000-memory.dmp

          Filesize

          3.3MB

        • memory/3340-135-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-226-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-222-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-223-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-224-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-225-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-221-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-227-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-228-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-229-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-230-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-231-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-220-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3528-232-0x0000000000400000-0x0000000002732000-memory.dmp

          Filesize

          35.2MB

        • memory/3900-47-0x0000000007470000-0x000000000747E000-memory.dmp

          Filesize

          56KB

        • memory/3900-10-0x0000000005650000-0x00000000056B6000-memory.dmp

          Filesize

          408KB

        • memory/3900-9-0x00000000055B0000-0x00000000055D2000-memory.dmp

          Filesize

          136KB

        • memory/3900-8-0x00000000747D0000-0x0000000074F80000-memory.dmp

          Filesize

          7.7MB

        • memory/3900-26-0x0000000007760000-0x0000000007DDA000-memory.dmp

          Filesize

          6.5MB

        • memory/3900-45-0x00000000074D0000-0x0000000007566000-memory.dmp

          Filesize

          600KB

        • memory/3900-7-0x00000000747D0000-0x0000000074F80000-memory.dmp

          Filesize

          7.7MB

        • memory/3900-53-0x00000000747D0000-0x0000000074F80000-memory.dmp

          Filesize

          7.7MB

        • memory/3900-28-0x00000000072C0000-0x00000000072F2000-memory.dmp

          Filesize

          200KB

        • memory/3900-11-0x0000000005730000-0x0000000005796000-memory.dmp

          Filesize

          408KB

        • memory/3900-21-0x00000000058A0000-0x0000000005BF4000-memory.dmp

          Filesize

          3.3MB

        • memory/3900-6-0x0000000004E10000-0x0000000005438000-memory.dmp

          Filesize

          6.2MB

        • memory/3900-22-0x0000000005D40000-0x0000000005D5E000-memory.dmp

          Filesize

          120KB

        • memory/3900-42-0x0000000007320000-0x00000000073C3000-memory.dmp

          Filesize

          652KB

        • memory/3900-5-0x00000000047A0000-0x00000000047D6000-memory.dmp

          Filesize

          216KB

        • memory/3900-44-0x0000000007410000-0x000000000741A000-memory.dmp

          Filesize

          40KB

        • memory/3900-43-0x00000000747D0000-0x0000000074F80000-memory.dmp

          Filesize

          7.7MB

        • memory/3900-41-0x0000000007300000-0x000000000731E000-memory.dmp

          Filesize

          120KB

        • memory/3900-31-0x00000000747D0000-0x0000000074F80000-memory.dmp

          Filesize

          7.7MB

        • memory/3900-30-0x00000000707F0000-0x0000000070B44000-memory.dmp

          Filesize

          3.3MB

        • memory/3900-29-0x0000000070670000-0x00000000706BC000-memory.dmp

          Filesize

          304KB

        • memory/3900-23-0x0000000005D80000-0x0000000005DCC000-memory.dmp

          Filesize

          304KB

        • memory/3900-4-0x00000000747DE000-0x00000000747DF000-memory.dmp

          Filesize

          4KB

        • memory/3900-24-0x0000000006300000-0x0000000006344000-memory.dmp

          Filesize

          272KB

        • memory/3900-25-0x0000000007060000-0x00000000070D6000-memory.dmp

          Filesize

          472KB

        • memory/3900-50-0x00000000074C0000-0x00000000074C8000-memory.dmp

          Filesize

          32KB

        • memory/3900-49-0x0000000007570000-0x000000000758A000-memory.dmp

          Filesize

          104KB

        • memory/3900-48-0x0000000007480000-0x0000000007494000-memory.dmp

          Filesize

          80KB

        • memory/3900-27-0x0000000007100000-0x000000000711A000-memory.dmp

          Filesize

          104KB

        • memory/3900-46-0x0000000007430000-0x0000000007441000-memory.dmp

          Filesize

          68KB

        • memory/3920-97-0x0000000070770000-0x00000000707BC000-memory.dmp

          Filesize

          304KB

        • memory/3920-98-0x0000000070D60000-0x00000000710B4000-memory.dmp

          Filesize

          3.3MB

        • memory/3920-95-0x0000000005EE0000-0x0000000006234000-memory.dmp

          Filesize

          3.3MB

        • memory/4020-163-0x0000000005FC0000-0x0000000005FD4000-memory.dmp

          Filesize

          80KB

        • memory/4020-162-0x0000000007720000-0x0000000007731000-memory.dmp

          Filesize

          68KB

        • memory/4020-161-0x00000000073F0000-0x0000000007493000-memory.dmp

          Filesize

          652KB

        • memory/4020-150-0x00000000706D0000-0x000000007071C000-memory.dmp

          Filesize

          304KB

        • memory/4020-151-0x0000000070E90000-0x00000000711E4000-memory.dmp

          Filesize

          3.3MB

        • memory/4020-149-0x0000000006730000-0x000000000677C000-memory.dmp

          Filesize

          304KB

        • memory/4020-138-0x0000000005AF0000-0x0000000005E44000-memory.dmp

          Filesize

          3.3MB

        • memory/4920-70-0x0000000070F10000-0x0000000071264000-memory.dmp

          Filesize

          3.3MB

        • memory/4920-67-0x0000000006040000-0x0000000006394000-memory.dmp

          Filesize

          3.3MB

        • memory/4920-68-0x00000000066C0000-0x000000000670C000-memory.dmp

          Filesize

          304KB

        • memory/4920-69-0x0000000070770000-0x00000000707BC000-memory.dmp

          Filesize

          304KB

        • memory/4920-82-0x0000000007BE0000-0x0000000007BF4000-memory.dmp

          Filesize

          80KB

        • memory/4920-80-0x0000000007880000-0x0000000007923000-memory.dmp

          Filesize

          652KB

        • memory/4920-81-0x0000000007B90000-0x0000000007BA1000-memory.dmp

          Filesize

          68KB