Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
-
submitted
19/05/2024, 01:42 UTC
General
-
Target
fb5c5eb64b94fc54f3d3dc7e4aa3b814c471088b16dd3a9c95a9a5b7a3619336.exe
-
Size
4.1MB
-
MD5
1d376613cf4eaa65ecfb1c8fc808cb56
-
SHA1
4145872c7772abd537e707d2217cd71010140bae
-
SHA256
fb5c5eb64b94fc54f3d3dc7e4aa3b814c471088b16dd3a9c95a9a5b7a3619336
-
SHA512
262d3c00e2f28c65b73814bb28787b8fd00461162edf58bb5a6d35dd0e91706becc0841898597b25d6985895cb1b1313581413517be00d5002e683c7a11ca88d
-
SSDEEP
98304:CQGLdTw13YmTlGi/xMFRAVNS6wnhY59m5e0z8345g:CLpT0YNaxn5wu5s59YF
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 19 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory 7 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 4 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb5c5eb64b94fc54f3d3dc7e4aa3b814c471088b16dd3a9c95a9a5b7a3619336.exe"C:\Users\Admin\AppData\Local\Temp\fb5c5eb64b94fc54f3d3dc7e4aa3b814c471088b16dd3a9c95a9a5b7a3619336.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\fb5c5eb64b94fc54f3d3dc7e4aa3b814c471088b16dd3a9c95a9a5b7a3619336.exe"C:\Users\Admin\AppData\Local\Temp\fb5c5eb64b94fc54f3d3dc7e4aa3b814c471088b16dd3a9c95a9a5b7a3619336.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
-
DNSa3877b97-aeb7-4583-859a-5f7fa01d0516.uuid.alldatadump.orgRemote address:8.8.8.8:53Requesta3877b97-aeb7-4583-859a-5f7fa01d0516.uuid.alldatadump.orgIN TXTResponse -
DNSstun.sipgate.netRemote address:8.8.8.8:53Requeststun.sipgate.netIN AResponsestun.sipgate.netIN CNAMEstun.sipgate.cloudstun.sipgate.cloudIN CNAMEa6adcb4b9bf816abe.awsglobalaccelerator.coma6adcb4b9bf816abe.awsglobalaccelerator.comIN A15.197.250.192a6adcb4b9bf816abe.awsglobalaccelerator.comIN A3.33.249.248
-
DNSnexusrules.officeapps.live.comRemote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.243.29
-
DNSserver14.alldatadump.orgRemote address:8.8.8.8:53Requestserver14.alldatadump.orgIN AResponseserver14.alldatadump.orgIN A185.82.216.108
-
DNS29.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
DNScdn.discordapp.comRemote address:8.8.8.8:53Requestcdn.discordapp.comIN AResponsecdn.discordapp.comIN A162.159.130.233cdn.discordapp.comIN A162.159.134.233cdn.discordapp.comIN A162.159.129.233cdn.discordapp.comIN A162.159.133.233cdn.discordapp.comIN A162.159.135.233
-
DNScarsalessystem.comRemote address:8.8.8.8:53Requestcarsalessystem.comIN AResponsecarsalessystem.comIN A172.67.221.71carsalessystem.comIN A104.21.94.82
-
162.159.130.233:443cdn.discordapp.comtls
-
185.82.216.108:443server14.alldatadump.orgtls -
172.67.221.71:443carsalessystem.comtls
-
185.82.216.108:443server14.alldatadump.orgtls
-
52.111.236.21:443 -
185.82.216.108:443server14.alldatadump.orgtls
-
185.82.216.108:443server14.alldatadump.orgtls
-
127.0.0.1:31465
-
8.8.8.8:53a3877b97-aeb7-4583-859a-5f7fa01d0516.uuid.alldatadump.orgdns
DNS Request
a3877b97-aeb7-4583-859a-5f7fa01d0516.uuid.alldatadump.org
DNS Request
stun.sipgate.net
DNS Response
15.197.250.1923.33.249.248
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.243.29
-
8.8.8.8:53server14.alldatadump.orgdns
DNS Request
server14.alldatadump.org
DNS Response
185.82.216.108
DNS Request
29.243.111.52.in-addr.arpa
-
8.8.8.8:53cdn.discordapp.comdns
DNS Request
cdn.discordapp.com
DNS Response
162.159.130.233162.159.134.233162.159.129.233162.159.133.233162.159.135.233
DNS Request
carsalessystem.com
DNS Response
172.67.221.71104.21.94.82
-
15.197.250.192:3478stun.sipgate.net
-
8.8.8.8:53
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5ac4917a885cf6050b1a483e4bc4d2ea5
SHA1b1c0a9f27bd21c6bbb8e9be70db8777b4a2a640f
SHA256e39062a62c3c7617feeeff95ea8a0be51104a0d36f46e44eea22556fda74d8d9
SHA512092c67a3ecae1d187cad72a8ea1ea37cb78a0cf79c2cd7fb88953e5990669a2e871267015762fd46d274badb88ac0c1d73b00f1df7394d89bed48a3a45c2ba3d
-
Filesize
19KB
MD515db4618b715cbde3c64c6cce31beeb3
SHA12fcd9fd44cbb43df66d1f7966d262728417be604
SHA25662370d8837a0f2c473d0a8f1fda455efa2ea2927639b66f62afd066b29311cad
SHA512f23d584be707ab3080dc2b56f4912a0d5989f151ed21b29e534652167e5c38e871eb129c58dafe1c448af89fa56210d1390f97d605aae31573a31e2d18386287
-
Filesize
19KB
MD57077f5aa2984cf3e6b7ee2f7291010fd
SHA1aa797e846c3739c0a8dba7ad45da0e963c8f6daf
SHA256c64205b74215f638acf9562668c58f33ec95ce23cfbb8913c1b930ed454701b3
SHA51216d338bdc7f96ce39d9270b292c4d239fe492e46e1fa0dc97920f1827fc055038e4ee185facc345af34dad121593fd9890a346dfd5ac5cf7840e3439ebcbf6d9
-
Filesize
19KB
MD511604a0cd7916aef49d9adea150ca573
SHA1113a4dc4a84d84fa37c7c530ba7241e0fc43d023
SHA256e77e4ee24ceb7c777b46a9890ef6d85ac09e72388f6d37b1a871e58a6719c70a
SHA51250902d227590a646573d13de80f5db5feb45f12f55dd1fa6bff2fef4f02339e1cedbdec54898e04c04371c45a0accb345cc127c92e5a8b94fdcc1277daf4233d
-
Filesize
19KB
MD5fd9a3324f4a6cdc2745489b88f5ea53a
SHA1807f7427075a48042cc06915070b58725028b46d
SHA256fe46d2c3f8b0ba0713b2e25d982b24f1462cad1b0f2b7859a3aa8a2256a9a42d
SHA512ad382fc681e939cb138ea46dc27d4549e1da184dedb82b5a45974f9673dfc5da34c131a49ab1681520cc25915d8aa74eeb7166ed9ee30a2dc216d39cc0709276
-
Filesize
19KB
MD5106226c72bfdf0876d6a17e78a038b25
SHA1544ea0828035d2305cef8856bbc4cb0928d63db5
SHA256c316c9ad3b526c9979d43d195439e9ff2f0815d36182cfcc7fb1f0b95411a6c1
SHA51250b2af079170caa40fe1593e1f0d3cb0e40b16c9e8f7657337e8c526a43fca47432c04432eccdbcb0976470771e8d9ee740be9d27adf6e31777068acb05ca150
-
Filesize
4.1MB
MD51d376613cf4eaa65ecfb1c8fc808cb56
SHA14145872c7772abd537e707d2217cd71010140bae
SHA256fb5c5eb64b94fc54f3d3dc7e4aa3b814c471088b16dd3a9c95a9a5b7a3619336
SHA512262d3c00e2f28c65b73814bb28787b8fd00461162edf58bb5a6d35dd0e91706becc0841898597b25d6985895cb1b1313581413517be00d5002e683c7a11ca88d
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
656KB
-
Filesize
56KB
-
Filesize
280KB
-
Filesize
304KB
-
Filesize
208KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
84KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
136KB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
656KB
-
Filesize
84KB
-
Filesize
3.3MB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
84KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
656KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
8.9MB
-
Filesize
9.1MB
-
Filesize
4.0MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
35.2MB
-
Filesize
4.0MB
-
Filesize
35.2MB