Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 18:57

General

  • Target

    24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe

  • Size

    477KB

  • MD5

    d56f6219a261d4738c459aea2c5a86e9

  • SHA1

    7c0bbd32d14fcc7dc99a9fd004c761d1a12290f5

  • SHA256

    24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226

  • SHA512

    cda623f402d468cbbf1ecc30df563d4f3c56697cb71f5093de6a37d392adecc32f2771c538c097ea108c1bbbc5f6caf191387e9ef9664a5cc2005f4611f71efd

  • SSDEEP

    12288:mCYtNDwqkXJAe4Q5oWqZPVyGDEQPJlhPVMq9QbPF7Nw:v8Dpte4Q9gtyGIkvhtMbU

Malware Config

Extracted

Family

cobaltstrike

C2

http://:0

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • UPX dump on OEP (original entry point) 2 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe
    "C:\Users\Admin\AppData\Local\Temp\24bc3419ed40e5dcc4b96bc41e6bf43763ec5442d465b681e19a32686d025226.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\System32\wusa.exe
      C:\Windows\System32\wusa.exe
      2⤵
        PID:208

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/208-1-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-2-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-4-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-3-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-6-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-7-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-5-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-8-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-10-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-9-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-12-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-13-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-11-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-14-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-15-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-16-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-17-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-18-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-19-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-20-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-21-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-22-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-23-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-25-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-26-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-27-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-28-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-29-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-30-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-31-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-32-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-33-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-34-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-36-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-35-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-37-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-38-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-39-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-40-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-41-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-42-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-43-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-51-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-50-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-53-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-52-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-49-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-54-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-55-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-56-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-48-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-58-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-59-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-57-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-47-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-46-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-45-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-44-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-60-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-61-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-62-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-63-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-64-0x000001C2C2000000-0x000001C2C2041000-memory.dmp

      Filesize

      260KB

    • memory/208-16457-0x000001C2C3AB0000-0x000001C2C3F22000-memory.dmp

      Filesize

      4.4MB

    • memory/208-16460-0x000001C2C3AB0000-0x000001C2C3F22000-memory.dmp

      Filesize

      4.4MB

    • memory/2680-0-0x00007FF7B01C0000-0x00007FF7B0284000-memory.dmp

      Filesize

      784KB

    • memory/2680-16453-0x00007FF7B01C0000-0x00007FF7B0284000-memory.dmp

      Filesize

      784KB