Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14/05/2023, 21:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
30.dll
Resource
win7-20230220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
30.dll
Resource
win10v2004-20230221-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
30.dll
-
Size
1.3MB
-
MD5
708831126114de4b5e8084c339a2baaf
-
SHA1
8ca717a8ee422ff0690f7cb0c3ea9d9ac7dcb288
-
SHA256
fcdf4497184a11dda48b59d3e558b6a429b204cc80669f00920291f2b467a12d
-
SHA512
aeaa64ffc7c21a4d0d2dce18efa3942084cc67d6dcfb7496d680e8cbc98a9274763cd7f1c52a0691de8d7ac5add573e418063aa94402c26add98e50918a78a20
-
SSDEEP
24576:UyyKuj5NbJ51OG65IGC6V8u9gA3lob9Ov/U6mTRcaT2Cm:Uyy/NlOGYCT39O0vBSC
Score
10/10
Malware Config
Extracted
Family
cobaltstrike
Botnet
0
Attributes
-
watermark
0
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Blocklisted process makes network request 64 IoCs
flow pid Process 4 1108 rundll32.exe 5 1108 rundll32.exe 6 1108 rundll32.exe 7 1108 rundll32.exe 9 1108 rundll32.exe 10 1108 rundll32.exe 11 1108 rundll32.exe 13 1108 rundll32.exe 14 1108 rundll32.exe 15 1108 rundll32.exe 17 1108 rundll32.exe 19 1108 rundll32.exe 20 1108 rundll32.exe 22 1108 rundll32.exe 23 1108 rundll32.exe 25 1108 rundll32.exe 26 1108 rundll32.exe 27 1108 rundll32.exe 28 1108 rundll32.exe 30 1108 rundll32.exe 31 1108 rundll32.exe 32 1108 rundll32.exe 34 1108 rundll32.exe 35 1108 rundll32.exe 36 1108 rundll32.exe 38 1108 rundll32.exe 39 1108 rundll32.exe 40 1108 rundll32.exe 42 1108 rundll32.exe 43 1108 rundll32.exe 44 1108 rundll32.exe 46 1108 rundll32.exe 47 1108 rundll32.exe 49 1108 rundll32.exe 50 1108 rundll32.exe 51 1108 rundll32.exe 52 1108 rundll32.exe 54 1108 rundll32.exe 55 1108 rundll32.exe 56 1108 rundll32.exe 58 1108 rundll32.exe 59 1108 rundll32.exe 60 1108 rundll32.exe 62 1108 rundll32.exe 63 1108 rundll32.exe 64 1108 rundll32.exe 66 1108 rundll32.exe 67 1108 rundll32.exe 68 1108 rundll32.exe 70 1108 rundll32.exe 71 1108 rundll32.exe 72 1108 rundll32.exe 74 1108 rundll32.exe 75 1108 rundll32.exe 76 1108 rundll32.exe 78 1108 rundll32.exe 79 1108 rundll32.exe 80 1108 rundll32.exe 82 1108 rundll32.exe 83 1108 rundll32.exe 84 1108 rundll32.exe 86 1108 rundll32.exe 87 1108 rundll32.exe 89 1108 rundll32.exe