Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2024, 08:11

General

  • Target

    a979d153e13b94f63576ced44c688ad0_NeikiAnalytics.exe

  • Size

    4.1MB

  • MD5

    a979d153e13b94f63576ced44c688ad0

  • SHA1

    6d008b9a63cba37e988b61749aae10a8717134f5

  • SHA256

    638d4b37b6220d2ecb3802f24363866bfcde78b5344fe4cb75b32450cc99ed66

  • SHA512

    9abca2b68f42fc6003cb5f9cdcc112d128378e7d11f93c80dd46ece306f3e663fc4dd36619a6cbc273496d3b2b06184e410f7e52e0211a92237fcb31be802073

  • SSDEEP

    98304:Q557or8YMdWV8xcrChUIDCoHczW4WQrxCgsiGsm1N9Zshd41TTimK:Q5w86GcrCCoczCJiGXN9ZshdAimK

Malware Config

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 18 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Manipulates WinMonFS driver. 1 IoCs

    Roottkits write to WinMonFS to hide directories/files from being detected.

  • Drops file in System32 directory 7 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Windows directory 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

    Using powershell.exe command.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\a979d153e13b94f63576ced44c688ad0_NeikiAnalytics.exe
    "C:\Users\Admin\AppData\Local\Temp\a979d153e13b94f63576ced44c688ad0_NeikiAnalytics.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4324
    • C:\Users\Admin\AppData\Local\Temp\a979d153e13b94f63576ced44c688ad0_NeikiAnalytics.exe
      "C:\Users\Admin\AppData\Local\Temp\a979d153e13b94f63576ced44c688ad0_NeikiAnalytics.exe"
      2⤵
      • Adds Run key to start application
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:432
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1612
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2588
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          PID:2560
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3244
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
        • Drops file in System32 directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4592
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Manipulates WinMonFS driver.
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -nologo -noprofile
          4⤵
          • Drops file in System32 directory
          • Command and Scripting Interpreter: PowerShell
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2208
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:4916
        • C:\Windows\SYSTEM32\schtasks.exe
          schtasks /delete /tn ScheduledUpdate /f
          4⤵
            PID:1108
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2368
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Drops file in System32 directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3876
          • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
            C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
            4⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:3568
          • C:\Windows\SYSTEM32\schtasks.exe
            schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
            4⤵
            • Creates scheduled task(s)
            PID:392

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0mm2tp5f.vlu.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

      Filesize

      281KB

      MD5

      d98e33b66343e7c96158444127a117f6

      SHA1

      bb716c5509a2bf345c6c1152f6e3e1452d39d50d

      SHA256

      5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

      SHA512

      705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      9be0e3bfd35928b1ba90eed8eb01dc5a

      SHA1

      5b20af9cc3ec03f1f69e93ebca67da0066c219b5

      SHA256

      397f79d15c72b99263053d6bf30c71675afa478b7160ceda5ac6f4eda829d224

      SHA512

      a0640605911de932b5abbf3e3bed14810d9ad8ce2eacaef9e7c6d58d5e45691f15bb52e3277fe56cb54016e52eba4a223a766c54a9f445550893c3d62c3e3c16

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      4ebe1ac8293c40eb1e73d198542ab4cb

      SHA1

      6c03f3cff872bfcd1816a3ec4cdba3a71d2cad9c

      SHA256

      494ddab353c131723ce68680feb14b1987de374ec6be089c9227740a83f34860

      SHA512

      0ee5346414d925a1e8378156b71ec1a3cd857d81442a9e80644932571772d0a8a18775b0c06282dfa5ee36031cde16d65edc90704b5e35037a1840a12ac4a57e

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      eebed5cd6150430e9f672d6d17656b67

      SHA1

      a0670cfff748713ede9664bdd8992554600acfdf

      SHA256

      f69cb01e6f7cbf3fb8402829e489a1945f20282f631ea91a51ce7c41f21a4b56

      SHA512

      053d8f79c36188fd4fe4424a9c63344bf806e1ffa42776cb4f35b959bbd1b1db5fade6495391be2616482b173649ad457ffa305795a23095603284bce69a889c

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      bd0320ce28f8668042fd3fe3cbcb9ad4

      SHA1

      75179ba0ca02ee755dc0f9843e746fecadc56e43

      SHA256

      dfa7b669fdb1e1ed93d62684e6153418f75173d98efc3a4abb28c8baf20a138d

      SHA512

      786c038d4d297c6270a01164b7c41ccd9385fa33d0f67a4be0af8f8307f7013c2af03d40e7ae31c8dc0b4168d5954b21ae8638396625589c9dec152eef6ee6fc

    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

      Filesize

      19KB

      MD5

      73ba0a859d06abcd9e2a1290b6aee43b

      SHA1

      a43ab72c7fb2a716aef679336d1a4454c847e3f6

      SHA256

      d218f70bf9732387ecb37cf643023b892b8f8dcc4f09d5cb8f1f179d4b91c86b

      SHA512

      5627aae0ff61599cf67893c5f668d1b82d63d5862dd0cf530ce66eba2649c3ec8e9b1813b0cf094d8a4ba6016fdb2bf11e616a7deaab4c4faf87dc75da6343ec

    • C:\Windows\rss\csrss.exe

      Filesize

      4.1MB

      MD5

      a979d153e13b94f63576ced44c688ad0

      SHA1

      6d008b9a63cba37e988b61749aae10a8717134f5

      SHA256

      638d4b37b6220d2ecb3802f24363866bfcde78b5344fe4cb75b32450cc99ed66

      SHA512

      9abca2b68f42fc6003cb5f9cdcc112d128378e7d11f93c80dd46ece306f3e663fc4dd36619a6cbc273496d3b2b06184e410f7e52e0211a92237fcb31be802073

    • memory/432-217-0x00000000029E0000-0x0000000002DDB000-memory.dmp

      Filesize

      4.0MB

    • memory/432-55-0x00000000029E0000-0x0000000002DDB000-memory.dmp

      Filesize

      4.0MB

    • memory/432-207-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/548-3-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/548-83-0x0000000002DC0000-0x00000000036AB000-memory.dmp

      Filesize

      8.9MB

    • memory/548-129-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/548-1-0x00000000029B0000-0x0000000002DB1000-memory.dmp

      Filesize

      4.0MB

    • memory/548-82-0x00000000029B0000-0x0000000002DB1000-memory.dmp

      Filesize

      4.0MB

    • memory/548-2-0x0000000002DC0000-0x00000000036AB000-memory.dmp

      Filesize

      8.9MB

    • memory/1612-77-0x00000000071A0000-0x0000000007243000-memory.dmp

      Filesize

      652KB

    • memory/1612-79-0x0000000007520000-0x0000000007534000-memory.dmp

      Filesize

      80KB

    • memory/1612-78-0x00000000074D0000-0x00000000074E1000-memory.dmp

      Filesize

      68KB

    • memory/1612-67-0x0000000070B00000-0x0000000070E54000-memory.dmp

      Filesize

      3.3MB

    • memory/1612-66-0x0000000070380000-0x00000000703CC000-memory.dmp

      Filesize

      304KB

    • memory/1612-61-0x0000000005910000-0x0000000005C64000-memory.dmp

      Filesize

      3.3MB

    • memory/2208-146-0x0000000070380000-0x00000000703CC000-memory.dmp

      Filesize

      304KB

    • memory/2208-147-0x0000000070B00000-0x0000000070E54000-memory.dmp

      Filesize

      3.3MB

    • memory/2368-183-0x00000000058D0000-0x00000000058E4000-memory.dmp

      Filesize

      80KB

    • memory/2368-182-0x0000000007030000-0x0000000007041000-memory.dmp

      Filesize

      68KB

    • memory/2368-181-0x0000000006D10000-0x0000000006DB3000-memory.dmp

      Filesize

      652KB

    • memory/2368-170-0x00000000702A0000-0x00000000702EC000-memory.dmp

      Filesize

      304KB

    • memory/2368-171-0x0000000070A30000-0x0000000070D84000-memory.dmp

      Filesize

      3.3MB

    • memory/2368-169-0x0000000005B30000-0x0000000005B7C000-memory.dmp

      Filesize

      304KB

    • memory/2368-163-0x0000000005440000-0x0000000005794000-memory.dmp

      Filesize

      3.3MB

    • memory/3244-94-0x0000000006480000-0x00000000067D4000-memory.dmp

      Filesize

      3.3MB

    • memory/3244-97-0x0000000070500000-0x0000000070854000-memory.dmp

      Filesize

      3.3MB

    • memory/3244-96-0x0000000070380000-0x00000000703CC000-memory.dmp

      Filesize

      304KB

    • memory/3876-197-0x0000000070A80000-0x0000000070DD4000-memory.dmp

      Filesize

      3.3MB

    • memory/3876-196-0x00000000702A0000-0x00000000702EC000-memory.dmp

      Filesize

      304KB

    • memory/3876-194-0x00000000059A0000-0x0000000005CF4000-memory.dmp

      Filesize

      3.3MB

    • memory/4324-10-0x0000000006230000-0x0000000006296000-memory.dmp

      Filesize

      408KB

    • memory/4324-49-0x0000000008070000-0x000000000808A000-memory.dmp

      Filesize

      104KB

    • memory/4324-29-0x0000000070380000-0x00000000703CC000-memory.dmp

      Filesize

      304KB

    • memory/4324-26-0x0000000008300000-0x000000000897A000-memory.dmp

      Filesize

      6.5MB

    • memory/4324-27-0x0000000007CA0000-0x0000000007CBA000-memory.dmp

      Filesize

      104KB

    • memory/4324-31-0x0000000070780000-0x0000000070AD4000-memory.dmp

      Filesize

      3.3MB

    • memory/4324-25-0x0000000007C00000-0x0000000007C76000-memory.dmp

      Filesize

      472KB

    • memory/4324-30-0x00000000744E0000-0x0000000074C90000-memory.dmp

      Filesize

      7.7MB

    • memory/4324-41-0x0000000007EA0000-0x0000000007EBE000-memory.dmp

      Filesize

      120KB

    • memory/4324-24-0x0000000006E70000-0x0000000006EB4000-memory.dmp

      Filesize

      272KB

    • memory/4324-4-0x00000000744EE000-0x00000000744EF000-memory.dmp

      Filesize

      4KB

    • memory/4324-5-0x0000000005330000-0x0000000005366000-memory.dmp

      Filesize

      216KB

    • memory/4324-23-0x0000000006910000-0x000000000695C000-memory.dmp

      Filesize

      304KB

    • memory/4324-22-0x00000000068E0000-0x00000000068FE000-memory.dmp

      Filesize

      120KB

    • memory/4324-21-0x0000000006310000-0x0000000006664000-memory.dmp

      Filesize

      3.3MB

    • memory/4324-45-0x00000000080C0000-0x0000000008156000-memory.dmp

      Filesize

      600KB

    • memory/4324-11-0x00000000062A0000-0x0000000006306000-memory.dmp

      Filesize

      408KB

    • memory/4324-43-0x00000000744E0000-0x0000000074C90000-memory.dmp

      Filesize

      7.7MB

    • memory/4324-9-0x0000000005A30000-0x0000000005A52000-memory.dmp

      Filesize

      136KB

    • memory/4324-42-0x0000000007EC0000-0x0000000007F63000-memory.dmp

      Filesize

      652KB

    • memory/4324-44-0x0000000007FB0000-0x0000000007FBA000-memory.dmp

      Filesize

      40KB

    • memory/4324-53-0x00000000744E0000-0x0000000074C90000-memory.dmp

      Filesize

      7.7MB

    • memory/4324-50-0x0000000008060000-0x0000000008068000-memory.dmp

      Filesize

      32KB

    • memory/4324-28-0x0000000007E60000-0x0000000007E92000-memory.dmp

      Filesize

      200KB

    • memory/4324-8-0x00000000744E0000-0x0000000074C90000-memory.dmp

      Filesize

      7.7MB

    • memory/4324-48-0x0000000008020000-0x0000000008034000-memory.dmp

      Filesize

      80KB

    • memory/4324-6-0x0000000005B50000-0x0000000006178000-memory.dmp

      Filesize

      6.2MB

    • memory/4324-47-0x0000000008000000-0x000000000800E000-memory.dmp

      Filesize

      56KB

    • memory/4324-46-0x0000000007FC0000-0x0000000007FD1000-memory.dmp

      Filesize

      68KB

    • memory/4324-7-0x00000000744E0000-0x0000000074C90000-memory.dmp

      Filesize

      7.7MB

    • memory/4592-119-0x0000000070B00000-0x0000000070E54000-memory.dmp

      Filesize

      3.3MB

    • memory/4592-118-0x0000000070380000-0x00000000703CC000-memory.dmp

      Filesize

      304KB

    • memory/4960-228-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-219-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-222-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-225-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-215-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-231-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-234-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-237-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-240-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-243-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-246-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB

    • memory/4960-252-0x0000000000400000-0x0000000000D1C000-memory.dmp

      Filesize

      9.1MB