Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

GlobalProt...64.exe

windows7-x64

1

GlobalProt...64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    75s
  • max time network
    76s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/08/2024, 17:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    GlobalProtect64/GlobalProtect64.exe

  • Size

    359KB

  • MD5

    0ff2ca0c7b5c6e167d52cba95f00eec9

  • SHA1

    bfaa5eea2b921b7a0b801bda00f69196c213b880

  • SHA256

    bd8016b895b404f43e1d6614b564927385d74534cef319c0ea5236dd9ed00b2f

  • SHA512

    1630b14ba53d96369002d78e9f390119781203049a19d7d3e8002bb0103c1b91c746b73b80f9d7ffd1ec7c6caf66eb8f5c2df2d2d801c953941db3be0330273e

  • SSDEEP

    6144:J12UdfHkDSdefEvAxa1snobprfkj3d5Qz1zAyN0Pf2+kqE:T24V4Va2noNE3UzfQkqE

Score
10/10
wikiloaderbackdoorloader

Malware Config

Extracted

Family

wikiloader

C2

https://carniceriamartinezadria.com/wp-content/themes/twentytwentyfour/rleoec.php?id=1

https://jlholgado.com/wp-content/themes/twentytwentyfour/zca2ck.php?id=1

https://elpgtextil.com/wp-content/themes/twentytwentyfour/44snwx.php?id=1

https://arbeitsschutz-mmk.de/plugins/search/contacts/chrndi.php?id=1

Signatures

  • Wikiloader

    Wikiloader is a loader and backdoor written in C++.

    loaderbackdoorwikiloader
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3460
    • C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\GlobalProtect64.exe
      "C:\Users\Admin\AppData\Local\Temp\GlobalProtect64\GlobalProtect64.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4640
      • \??\c:\users\admin\appdata\local\temp\GLOBAL~1\jre\bin\java.exe
        c:\users\admin\appdata\local\temp\GLOBAL~1\jre\bin\java.exe -version
        3⤵
        • Checks processor information in registry
        PID:1264
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4188,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:8
    1⤵
      PID:64
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:2468

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1264-5-0x000001E04C060000-0x000001E04C2D0000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/1264-14-0x000001E04C5F0000-0x000001E04C860000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/1264-16-0x000001E053B20000-0x000001E053D90000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/1264-18-0x000001E053B20000-0x000001E053D90000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/1264-19-0x000001E04C5F0000-0x000001E04C860000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/1264-17-0x000001E04C060000-0x000001E04C2D0000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/3460-40-0x00000000027F0000-0x0000000002806000-memory.dmp

        Filesize

        88KB

        Download

      • memory/4640-37-0x000000000CAC0000-0x000000000CD30000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/4640-38-0x0000000013FF0000-0x0000000014260000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/4640-28-0x000000000C530000-0x000000000C7A0000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/4640-39-0x0000000024560000-0x000000002A4BF000-memory.dmp

        Filesize

        95.4MB

        Download

      • memory/4640-42-0x000000000C530000-0x000000000C7A0000-memory.dmp

        Filesize

        2.4MB

        Download

      • memory/4640-43-0x000000000CAC0000-0x000000000CD30000-memory.dmp

        Filesize

        2.4MB

        Download