Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
-
submitted
19/05/2024, 16:27 UTC
General
-
Target
c21ef752a75a4589bd911b41e893846eb2589fb386606e7000472e714c83b601.exe
-
Size
4.1MB
-
MD5
3f2d5b5b9aeadc636dbf6ea91c17c16f
-
SHA1
c1cc44feff2001f206f488898546827c6f8727d6
-
SHA256
c21ef752a75a4589bd911b41e893846eb2589fb386606e7000472e714c83b601
-
SHA512
da9b633b0bcc5154ae2a9f7423210bb80bff599d30ee29866c0924cb2cd591881c06d11c5c3b799468972f3b089387fc6ba2a19449647e22c1b69303784c1ddb
-
SSDEEP
98304:5vHfbigA34ifkpJZQU0TgaIfW6UkFHwAhDtgwFW+12:5vHfb2IifudqhIuUHwAjW+M
Malware Config
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 20 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
-
Drops file in System32 directory 7 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Windows directory 4 IoCs
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c21ef752a75a4589bd911b41e893846eb2589fb386606e7000472e714c83b601.exe"C:\Users\Admin\AppData\Local\Temp\c21ef752a75a4589bd911b41e893846eb2589fb386606e7000472e714c83b601.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\c21ef752a75a4589bd911b41e893846eb2589fb386606e7000472e714c83b601.exe"C:\Users\Admin\AppData\Local\Temp\c21ef752a75a4589bd911b41e893846eb2589fb386606e7000472e714c83b601.exe"2⤵
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes4⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f4⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
Network
-
DNSa68ce113-51f8-459d-aa66-7b9af55bbf01.uuid.realupdate.ruRemote address:8.8.8.8:53Requesta68ce113-51f8-459d-aa66-7b9af55bbf01.uuid.realupdate.ruIN TXTResponse -
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
DNSstun3.l.google.comRemote address:8.8.8.8:53Requeststun3.l.google.comIN AResponsestun3.l.google.comIN A74.125.250.129
-
DNS129.250.125.74.in-addr.arpaRemote address:8.8.8.8:53Request129.250.125.74.in-addr.arpaIN PTRResponse
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
DNScdn.discordapp.comRemote address:8.8.8.8:53Requestcdn.discordapp.comIN AResponsecdn.discordapp.comIN A162.159.129.233cdn.discordapp.comIN A162.159.134.233cdn.discordapp.comIN A162.159.133.233cdn.discordapp.comIN A162.159.135.233cdn.discordapp.comIN A162.159.130.233
-
DNScarsalessystem.comRemote address:8.8.8.8:53Requestcarsalessystem.comIN AResponsecarsalessystem.comIN A104.21.94.82carsalessystem.comIN A172.67.221.71
-
DNS96.216.82.185.in-addr.arpaRemote address:8.8.8.8:53Request96.216.82.185.in-addr.arpaIN PTRResponse96.216.82.185.in-addr.arpaIN PTRdedic-mariadebommarez-1201693hosted-by-itldccom
-
DNSserver12.realupdate.ruRemote address:8.8.8.8:53Requestserver12.realupdate.ruIN AResponseserver12.realupdate.ruIN A185.82.216.96
-
DNS233.129.159.162.in-addr.arpaRemote address:8.8.8.8:53Request233.129.159.162.in-addr.arpaIN PTRResponse
-
DNSnexusrules.officeapps.live.comRemote address:8.8.8.8:53Requestnexusrules.officeapps.live.comIN AResponsenexusrules.officeapps.live.comIN CNAMEprod.nexusrules.live.com.akadns.netprod.nexusrules.live.com.akadns.netIN A52.111.227.14
-
DNS82.94.21.104.in-addr.arpaRemote address:8.8.8.8:53Request82.94.21.104.in-addr.arpaIN PTRResponse
-
162.159.129.233:443cdn.discordapp.comtls
-
185.82.216.96:443server12.realupdate.rutls -
104.21.94.82:443carsalessystem.comtls
-
185.82.216.96:443server12.realupdate.rutls
-
185.82.216.96:443server12.realupdate.rutls
-
8.8.8.8:53a68ce113-51f8-459d-aa66-7b9af55bbf01.uuid.realupdate.rudns
DNS Request
a68ce113-51f8-459d-aa66-7b9af55bbf01.uuid.realupdate.ru
DNS Request
8.8.8.8.in-addr.arpa
DNS Request
stun3.l.google.com
DNS Response
74.125.250.129
DNS Request
129.250.125.74.in-addr.arpa
DNS Request
14.227.111.52.in-addr.arpa
-
8.8.8.8:53cdn.discordapp.comdns
DNS Request
cdn.discordapp.com
DNS Response
162.159.129.233162.159.134.233162.159.133.233162.159.135.233162.159.130.233
DNS Request
carsalessystem.com
DNS Response
104.21.94.82172.67.221.71
DNS Request
96.216.82.185.in-addr.arpa
-
8.8.8.8:53server12.realupdate.rudns
DNS Request
server12.realupdate.ru
DNS Response
185.82.216.96
DNS Request
233.129.159.162.in-addr.arpa
DNS Request
nexusrules.officeapps.live.com
DNS Response
52.111.227.14
-
74.125.250.129:19302stun3.l.google.com
-
8.8.8.8:5382.94.21.104.in-addr.arpadns
DNS Request
82.94.21.104.in-addr.arpa
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
Filesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
Filesize
19KB
MD5c5c3c546a0659126ebbc5307e3e31ff8
SHA1bdbcc5e5e6d152a7d6aa087bcf11872c4c7587ad
SHA25688ec28401e15f025bab2fe7a5e67bec1d0aee7d3bf775458f634e3b0630f30e9
SHA512545dc70e24fd2e14b02edd84014b0a3cfa00cf4155750421199e49849756511cfac227a62fc27714d4dcbe83b29510c99f0b53c6af51648b5768d69b1191943d
-
Filesize
19KB
MD52863d30bc1b060a084c7d56d8fb33933
SHA1ee29edb6376cbcecde77dd70fb3f56447d9cee6f
SHA256b2630c191c5cbd0d25b6fa47c801ff702bc0c4d75c1a7b9e6ab420eaf6b0787c
SHA512254c4b2b5690994730b46bcd4ae6774aacf6961b76cc842893f05e757b95e15bd115a1e399547b6109d5dbbb2cb273d39c949e100f0aca7307564d6bfbed076f
-
Filesize
19KB
MD5b880b45f810e88fe76fef96cd8aac845
SHA1c820319015e6cf7dd821dee6a07e68a34cb495de
SHA25689fdbe695a127b63a559543f41be58fb291eba6ba17baa7269214012a6fd401a
SHA512999737825872771d39140eee6fc9fc3d49a0c8e1a3bff0804732ee3ba1b3344102d8f7f526ba3f504c6dbd7d8eb625ff8913b06c01162aec08dd3220117c7289
-
Filesize
19KB
MD5d935783b9ca67d6645dfe2756daa9833
SHA1852d1c02e8eb46f9db7cfd1d7fda48e214be9303
SHA25632325ace886295d976140542d838946dcb3ec4aefdc18638e1286bdde40558ef
SHA5127225bc24216a928377d0288fdafb6ec598eef6a5c8f4cf897a08c931f4410b158ff591ff5d180bd8ed8af2478671f3b5ff1a8eac5815678cf85931bead7b0cec
-
Filesize
19KB
MD5949379832aa895e255509d3ff8c87f3f
SHA1ab508288e907d8a1cd0c8166b8463933cbe6e3e5
SHA25645595efa873c87c5f6e89c89d5d10d8a4bdf48e6076a2615c7749a6fa3a8cab5
SHA512d062ec735c1fbc112a066b8e49b579817799d2e94bdc19d1b9ac8f1a8eb47a9b88ff73ad81cf7c006b1adc73d90ed011041b3a9ad57b922d846c7f03ee08bb0c
-
Filesize
4.1MB
MD53f2d5b5b9aeadc636dbf6ea91c17c16f
SHA1c1cc44feff2001f206f488898546827c6f8727d6
SHA256c21ef752a75a4589bd911b41e893846eb2589fb386606e7000472e714c83b601
SHA512da9b633b0bcc5154ae2a9f7423210bb80bff599d30ee29866c0924cb2cd591881c06d11c5c3b799468972f3b089387fc6ba2a19449647e22c1b69303784c1ddb
-
Filesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
40KB
-
Filesize
600KB
-
Filesize
68KB
-
Filesize
56KB
-
Filesize
84KB
-
Filesize
104KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
6.5MB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
120KB
-
Filesize
656KB
-
Filesize
3.3MB
-
Filesize
208KB
-
Filesize
4KB
-
Filesize
304KB
-
Filesize
280KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
216KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
7.7MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
4.9MB
-
Filesize
84KB
-
Filesize
656KB
-
Filesize
3.3MB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
35.2MB
-
Filesize
35.2MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
4.0MB
-
Filesize
8.9MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
35.2MB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
656KB
-
Filesize
68KB
-
Filesize
304KB
-
Filesize
84KB
-
Filesize
3.3MB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
304KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
656KB
-
Filesize
68KB
-
Filesize
84KB