Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    0s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2024, 01:54

General

  • Target

    2296e560d7406d3172f1f4507378a40339747a581aae2d44fb4be4230f835a87.exe

  • Size

    4.1MB

  • MD5

    83914fd3d4f9293a5c787200efeacd07

  • SHA1

    af8b198fbe498b090d821060a25db0d14b29264d

  • SHA256

    2296e560d7406d3172f1f4507378a40339747a581aae2d44fb4be4230f835a87

  • SHA512

    0959187faf2e458aae20b6aff41c67cba2eb84843dd745ff941969175baa873f87d982f6cffa917f5a4e9b72211b702c9fe020bda1edae39f59dc12ac4f69e97

  • SSDEEP

    98304:ErbgSYZm0VZ47d2LjXdY+WeqK35WW/TEhU3Gu22l:ErcnZFqd2LRPP3hYhQZl

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 17 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

Processes

  • C:\Users\Admin\AppData\Local\Temp\2296e560d7406d3172f1f4507378a40339747a581aae2d44fb4be4230f835a87.exe
    "C:\Users\Admin\AppData\Local\Temp\2296e560d7406d3172f1f4507378a40339747a581aae2d44fb4be4230f835a87.exe"
    1⤵
      PID:1144
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:4232
      • C:\Users\Admin\AppData\Local\Temp\2296e560d7406d3172f1f4507378a40339747a581aae2d44fb4be4230f835a87.exe
        "C:\Users\Admin\AppData\Local\Temp\2296e560d7406d3172f1f4507378a40339747a581aae2d44fb4be4230f835a87.exe"
        2⤵
          PID:3152
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:3480
          • C:\Windows\system32\cmd.exe
            C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
            3⤵
              PID:3688
              • C:\Windows\system32\netsh.exe
                netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                4⤵
                • Modifies Windows Firewall
                PID:3236
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:4360
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              3⤵
              • Command and Scripting Interpreter: PowerShell
              PID:1104
            • C:\Windows\rss\csrss.exe
              C:\Windows\rss\csrss.exe
              3⤵
                PID:1736
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  4⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:1196
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                  4⤵
                  • Creates scheduled task(s)
                  PID:1884
                • C:\Windows\SYSTEM32\schtasks.exe
                  schtasks /delete /tn ScheduledUpdate /f
                  4⤵
                    PID:2516
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:868
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:468
                  • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                    C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                    4⤵
                      PID:4860
                    • C:\Windows\SYSTEM32\schtasks.exe
                      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                      4⤵
                      • Creates scheduled task(s)
                      PID:3116
                    • C:\Windows\windefender.exe
                      "C:\Windows\windefender.exe"
                      4⤵
                        PID:4272
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                          5⤵
                            PID:1656
                            • C:\Windows\SysWOW64\sc.exe
                              sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                              6⤵
                              • Launches sc.exe
                              PID:2640
                  • C:\Windows\windefender.exe
                    C:\Windows\windefender.exe
                    1⤵
                      PID:1672

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2rgi4kbe.rps.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                      Filesize

                      281KB

                      MD5

                      d98e33b66343e7c96158444127a117f6

                      SHA1

                      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                      SHA256

                      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                      SHA512

                      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                      Filesize

                      2KB

                      MD5

                      968cb9309758126772781b83adb8a28f

                      SHA1

                      8da30e71accf186b2ba11da1797cf67f8f78b47c

                      SHA256

                      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                      SHA512

                      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      a98b224a7fbdf6cf12b5339e528c7b76

                      SHA1

                      902731d0bf26a21940570c531bc44d12ef51abe5

                      SHA256

                      bf9103f7246ca514b9d9fabcdf39e8122c40c5728404dc7a09af64aefca8a2e2

                      SHA512

                      df1a7f33272c534d130f58ed5c4bf13714235eb9479a920ca9e21af85b2f7e71c33e2e6810172061c6d4b056ac64ddeb23b7448401c0865de5025da0cb2dad0c

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      d596255ea3888af282ad325129bac171

                      SHA1

                      9f33bb259005e00d379d74a16e13a45deb2d9a02

                      SHA256

                      037920ae7505262faef05847fd658063643901a461ea6e54e5805c944f58ab67

                      SHA512

                      712a075463f6ddff091d2e24a8500e0cbdbc637d15ccadc2cc7c0a81007c5c3306e3fcd2a1c6ff7c092c82fbd6ed32172979f88b6504c2e4a2ddb7d1d7a0d1cc

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      ae558ac7e4a960edbf07513c25d37151

                      SHA1

                      582d0fd405fcf5aa04bbe3e8d26ed4ad4d1a73ee

                      SHA256

                      8c821bd89085b376b244feb0823e64b2960a59ccac501492e39cfa60cbda20a3

                      SHA512

                      c741106a0b5bd40a5d027db7807d8f5f93ddb92be8eda524150f5c29463b9a519cf670e8892bfb7a15ac23dad30a0f97d25989bc8127312be743b335c93249d8

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      8190f9b5aaa0023d958b9dc4d298a697

                      SHA1

                      45a9fb91cd6e733089bd668f665d9a5ccdf8f4d9

                      SHA256

                      7709e39cbec2e84281188ebb7e72f7f1c6a6b412a71abcaeed9ac78a21d2701d

                      SHA512

                      abe8f3fb0cff2f8a5d19976cfbaec4d49bb3cb1201d3e7f2fe19a31b3ea06b2b2c36be5cf78b2ad38b52701952275b560c0e92dbaaae564687b06d1f81fb013b

                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      19KB

                      MD5

                      edb54323b6fdca8edbe38f2d781045d7

                      SHA1

                      57e29e5a2e8f0ea836935aab775ebeb7aaa70de9

                      SHA256

                      8a3db4c1932c386620655ca7564f895d289ad0135cb838ce4d8f4826b54b0f09

                      SHA512

                      ce3c52e005c320f76ebbac0978bb6ece84b3ddfb3f61feae26cef3aabdd15a34c1aa7674af7b3471e6b5ff854a59e8484aba88c37661408be65940784472a25e

                    • C:\Windows\rss\csrss.exe

                      Filesize

                      4.1MB

                      MD5

                      83914fd3d4f9293a5c787200efeacd07

                      SHA1

                      af8b198fbe498b090d821060a25db0d14b29264d

                      SHA256

                      2296e560d7406d3172f1f4507378a40339747a581aae2d44fb4be4230f835a87

                      SHA512

                      0959187faf2e458aae20b6aff41c67cba2eb84843dd745ff941969175baa873f87d982f6cffa917f5a4e9b72211b702c9fe020bda1edae39f59dc12ac4f69e97

                    • C:\Windows\windefender.exe

                      Filesize

                      2.0MB

                      MD5

                      8e67f58837092385dcf01e8a2b4f5783

                      SHA1

                      012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                      SHA256

                      166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                      SHA512

                      40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                    • memory/468-195-0x0000000070650000-0x00000000709A4000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/468-194-0x000000006FEC0000-0x000000006FF0C000-memory.dmp

                      Filesize

                      304KB

                    • memory/868-164-0x0000000005C20000-0x0000000005F74000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/868-181-0x0000000007820000-0x0000000007831000-memory.dmp

                      Filesize

                      68KB

                    • memory/868-170-0x0000000070650000-0x00000000709A4000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/868-168-0x0000000006840000-0x000000000688C000-memory.dmp

                      Filesize

                      304KB

                    • memory/868-182-0x00000000060A0000-0x00000000060B4000-memory.dmp

                      Filesize

                      80KB

                    • memory/868-180-0x0000000007510000-0x00000000075B3000-memory.dmp

                      Filesize

                      652KB

                    • memory/868-169-0x000000006FEC0000-0x000000006FF0C000-memory.dmp

                      Filesize

                      304KB

                    • memory/1104-115-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

                      Filesize

                      304KB

                    • memory/1104-116-0x0000000070120000-0x0000000070474000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/1144-2-0x0000000004520000-0x0000000004E0B000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/1144-153-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1144-1-0x0000000004110000-0x0000000004516000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1144-212-0x0000000000400000-0x0000000000D1C000-memory.dmp

                      Filesize

                      9.1MB

                    • memory/1144-154-0x0000000004110000-0x0000000004516000-memory.dmp

                      Filesize

                      4.0MB

                    • memory/1144-155-0x0000000004520000-0x0000000004E0B000-memory.dmp

                      Filesize

                      8.9MB

                    • memory/1144-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

                      Filesize

                      9.1MB

                    • memory/1196-143-0x0000000070740000-0x0000000070A94000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/1196-142-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

                      Filesize

                      304KB

                    • memory/1672-222-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/1672-248-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/1672-228-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/1672-236-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/1736-242-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-246-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-270-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-266-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-262-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-257-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-254-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-250-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-214-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-226-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-230-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-234-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/1736-237-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/3152-211-0x0000000000400000-0x0000000002361000-memory.dmp

                      Filesize

                      31.4MB

                    • memory/3480-66-0x0000000070740000-0x0000000070A94000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3480-64-0x0000000005A40000-0x0000000005D94000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3480-78-0x00000000075B0000-0x00000000075C4000-memory.dmp

                      Filesize

                      80KB

                    • memory/3480-77-0x0000000007560000-0x0000000007571000-memory.dmp

                      Filesize

                      68KB

                    • memory/3480-65-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

                      Filesize

                      304KB

                    • memory/3480-76-0x0000000007260000-0x0000000007303000-memory.dmp

                      Filesize

                      652KB

                    • memory/4232-43-0x0000000074100000-0x00000000748B0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4232-23-0x00000000068B0000-0x00000000068FC000-memory.dmp

                      Filesize

                      304KB

                    • memory/4232-4-0x000000007410E000-0x000000007410F000-memory.dmp

                      Filesize

                      4KB

                    • memory/4232-5-0x00000000052D0000-0x0000000005306000-memory.dmp

                      Filesize

                      216KB

                    • memory/4232-53-0x0000000074100000-0x00000000748B0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4232-50-0x0000000007FE0000-0x0000000007FE8000-memory.dmp

                      Filesize

                      32KB

                    • memory/4232-49-0x0000000007FF0000-0x000000000800A000-memory.dmp

                      Filesize

                      104KB

                    • memory/4232-48-0x0000000007FA0000-0x0000000007FB4000-memory.dmp

                      Filesize

                      80KB

                    • memory/4232-47-0x0000000007F80000-0x0000000007F8E000-memory.dmp

                      Filesize

                      56KB

                    • memory/4232-28-0x0000000007DE0000-0x0000000007E12000-memory.dmp

                      Filesize

                      200KB

                    • memory/4232-46-0x0000000007F40000-0x0000000007F51000-memory.dmp

                      Filesize

                      68KB

                    • memory/4232-30-0x0000000074100000-0x00000000748B0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4232-45-0x0000000008040000-0x00000000080D6000-memory.dmp

                      Filesize

                      600KB

                    • memory/4232-31-0x0000000070120000-0x0000000070474000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4232-44-0x0000000007F30000-0x0000000007F3A000-memory.dmp

                      Filesize

                      40KB

                    • memory/4232-41-0x0000000007E20000-0x0000000007E3E000-memory.dmp

                      Filesize

                      120KB

                    • memory/4232-42-0x0000000007E40000-0x0000000007EE3000-memory.dmp

                      Filesize

                      652KB

                    • memory/4232-7-0x0000000074100000-0x00000000748B0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4232-29-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

                      Filesize

                      304KB

                    • memory/4232-6-0x0000000005940000-0x0000000005F68000-memory.dmp

                      Filesize

                      6.2MB

                    • memory/4232-26-0x00000000082A0000-0x000000000891A000-memory.dmp

                      Filesize

                      6.5MB

                    • memory/4232-27-0x0000000007C20000-0x0000000007C3A000-memory.dmp

                      Filesize

                      104KB

                    • memory/4232-25-0x0000000007BA0000-0x0000000007C16000-memory.dmp

                      Filesize

                      472KB

                    • memory/4232-24-0x0000000006DB0000-0x0000000006DF4000-memory.dmp

                      Filesize

                      272KB

                    • memory/4232-22-0x0000000006870000-0x000000000688E000-memory.dmp

                      Filesize

                      120KB

                    • memory/4232-8-0x0000000074100000-0x00000000748B0000-memory.dmp

                      Filesize

                      7.7MB

                    • memory/4232-21-0x0000000006280000-0x00000000065D4000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4232-9-0x00000000058B0000-0x00000000058D2000-memory.dmp

                      Filesize

                      136KB

                    • memory/4232-10-0x00000000061A0000-0x0000000006206000-memory.dmp

                      Filesize

                      408KB

                    • memory/4232-11-0x0000000006210000-0x0000000006276000-memory.dmp

                      Filesize

                      408KB

                    • memory/4272-224-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/4272-219-0x0000000000400000-0x00000000008DF000-memory.dmp

                      Filesize

                      4.9MB

                    • memory/4360-93-0x000000006FFA0000-0x000000006FFEC000-memory.dmp

                      Filesize

                      304KB

                    • memory/4360-91-0x00000000055C0000-0x0000000005914000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/4360-94-0x0000000070390000-0x00000000706E4000-memory.dmp

                      Filesize

                      3.3MB