Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
16/04/2024, 21:56
General
-
Target
2024-04-16_8077b6961a3b1255bcceb1be20a073d0_cobalt-strike_cobaltstrike.exe
-
Size
5.2MB
-
MD5
8077b6961a3b1255bcceb1be20a073d0
-
SHA1
756498a4c6f10a0af7c567cd1c15fee71f7d9f12
-
SHA256
8dc2c60e98190888a5f77949f0a5cb0291d90b1a9633e65d5de77f7ceb6f439f
-
SHA512
c3334eb0fdfec4c84aa466a26a7cdeb22dfa6302ab964c2dbf4daca64084036a6c0d92ba356af2a6f041137cd3c1f63e1bb9ac15312a6e125769f6b9621f6abf
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lY:RWWBibf56utgpPFotBER/mQ32lUs
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 49 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-16_8077b6961a3b1255bcceb1be20a073d0_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-16_8077b6961a3b1255bcceb1be20a073d0_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\CBSqzUo.exeC:\Windows\System\CBSqzUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EbwOhDB.exeC:\Windows\System\EbwOhDB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GvSSAuh.exeC:\Windows\System\GvSSAuh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fKbewkp.exeC:\Windows\System\fKbewkp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QOwpCcg.exeC:\Windows\System\QOwpCcg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FwYlugP.exeC:\Windows\System\FwYlugP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sjmDTWd.exeC:\Windows\System\sjmDTWd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fLhVypc.exeC:\Windows\System\fLhVypc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UcEZQAt.exeC:\Windows\System\UcEZQAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XMvJGzM.exeC:\Windows\System\XMvJGzM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\plnHklq.exeC:\Windows\System\plnHklq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tbWrQNw.exeC:\Windows\System\tbWrQNw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TspZluu.exeC:\Windows\System\TspZluu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tLXosyw.exeC:\Windows\System\tLXosyw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oxStvrQ.exeC:\Windows\System\oxStvrQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KdIyJsj.exeC:\Windows\System\KdIyJsj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sFvqgMS.exeC:\Windows\System\sFvqgMS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IcvWYBw.exeC:\Windows\System\IcvWYBw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FNDCnWZ.exeC:\Windows\System\FNDCnWZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UolDWTn.exeC:\Windows\System\UolDWTn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zXMYqJK.exeC:\Windows\System\zXMYqJK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f6409e08c12c834cdaf8ce19271dcb89
SHA12cecd754dc758693f29d66648647e2df21b2a63c
SHA2566e8a7e5ad3ea4d29d2c9f2c3ba7a6a2cf8a7d97377892cd6a4cfedb2cbd3d12a
SHA512010dbfb8e55606627089326432e694c82eeacff356e54bd60af8c30dc535a8f418800c195dc1db612ae90c409268632cd0853da1575cb2f41ac5dbe5e32be8c2
-
Filesize
5.2MB
MD570c6230d01adc6703bc933efd8fe99a1
SHA17d63a43426dbe4163be3797fd85961bcdb1f41a8
SHA2561b91e606656bf33122a6f509f7929e1f225b7764f225fc263a3cf43a00e0b927
SHA512c41f2edf94b6bb45a0a920223094a136e89272a4bf92e286d7ad472c10a150dc66d95d89efc4cca4758c9240ab52545e35f84c18a9516f7d0ffd22bec4d28540
-
Filesize
5.2MB
MD51f70a635f2167d228971df0ffbf56971
SHA18d18b85138cd7b50b04dda904817cd21c71e6cb0
SHA256e2840bbc37f65fa07f4e1c0a5e0485615866e741eb2b0d39cb7c72554c412bc5
SHA512546c3f7d45187363ff71be0fa595faed2b201517e81d91467b56e792a34bbe82149f5163644e4ccaaecc5b53662897be2af7fd387426cab8832a665b58413c65
-
Filesize
5.2MB
MD5276369ca4b7be961544909eb7c38e0ed
SHA1909aa00627a651b9d2959a2a473e89ef29191db1
SHA256ecab2f9700e748739cbf923760d1c1bf3be67b6156ee2796a3fe20ca8400538a
SHA512ac62c04f1e50b4cb9ce8ca67059dd6400ceee9a0337d76237357e74d377729d39c319829b10435206c9947645a3921b848366df8166a910e00e0d9ebe0b3b536
-
Filesize
5.2MB
MD5e31662c9607640a8ea75f784d7eca31e
SHA1b66d27b6978fb5f2838863f6d8ae1721da2570c1
SHA2561fc42ffb45eff38c3f9a3d4a14090384ec41f687dd73ab6b154efb656907c9d1
SHA512a8f7cb71059c740b17ca986b32419ecd0a2f9001b027adeaaff2bb84468eae3e859a02d3525773ad123b390564769ff7709e8b547df4de9aab41a58c2a01ba3f
-
Filesize
5.2MB
MD57587e34e72134433076f9be338f7bab6
SHA170712da3cb9ded7aef161e21f297701c72f30d25
SHA2566f2e053f38c9e91ef2bdbd21d0cd83e0a65e0d7b1c2e2a3263e6030013d9bc3e
SHA512834f2ca91974826b2cbe936514ee8e91499be54ed44ac63c537605d10c2d1a71ec44735e5a98c44a312106732297a47abaeeeae5e6fb62494f4430e3d111bbc6
-
Filesize
5.2MB
MD543ffeac7d1b36f79a193378d7159b3d4
SHA13cc4b3fd34e5817bfbd9ecaecc777f14690a20fb
SHA256e364ff020b1dfa5e66b6cd09f21eed16027879166f60837e38c12a9acb4c5ff0
SHA512f80041f3011012a2ce907725c959fc44698f5a3afe254456bbfaad2bf23935c41d6f0171a3af8983d025c581b161c406d9d1d2935e3e09db991f539637066db6
-
Filesize
5.2MB
MD5e67e29f82ceac4679c32729973a53be1
SHA118d4d432f78e262371cc55f3a1757b5a30efccc4
SHA2567bbf502578168aed78bcf0e83387cda055164d6dffe62a46866620f49b4c9da6
SHA512d0c2eadcaf54704618e099138f4fb26c26b55232237a3231f466ea4c7789452345d0f73a01779ff6d34fc04a679ba3db012ca39f61d2918faa6ab0dccc2df696
-
Filesize
5.2MB
MD55a9e6b4523732a69c213e2ebe5a94de2
SHA1ff05dcbb532f849b5cd575227231e055936aa446
SHA2569ba93f9af7fe418a478e53cbb61e7caa081909b0010aa7a10faacb2c3e85f4e1
SHA5122e3da32a1d01c9f89dca67424f170440752bc369c5d56f025fa56ef98a71fd6f3007530663bbe0bb9e6c51c94d6a197de5cfad0b7569a677feb46092d26f1305
-
Filesize
5.2MB
MD50153cde31964f960e83c2188ff33814e
SHA151f976dac7f1643a56f164dc671bd412af37bc3e
SHA256c0f35d1076963f119bfeb437c11b38c21a6532d656dde74677e79f6118e7747c
SHA5129a69c49f3ec428468c34c497ecc65521954441f481b8c5127493a36f06ad742dcde14276154dec5e34eef467d27fe944f7239c608b413e6a1dc3a4d949a3243c
-
Filesize
5.2MB
MD55ff6fc8c422e2b9ee5ae4b8319787361
SHA1b9d3e9c214d665edffa8b86fa4bb3f561cb14127
SHA2567710751a908476b1134160a6ecc850c9bc14f706b57c2354b2fe22def0eaf4b5
SHA512859570f738561471e056bea902e030df0dbdac9ef9b075b76a9b8cb54c96d0f36c3cefe3ceaa20a965f1b5e7ee6b2a64fd535b48553b55cb179afdf5dd33694c
-
Filesize
5.2MB
MD5e84e122aec014b1092fd49f8f7494b75
SHA17271eafa2eac7d1b84fd81cc4aee5f039070e917
SHA2569b066701f18f4663e6e365c9573a8d84748667385ae91ed417a211d5c64df43a
SHA512f3c5b26b1c0f1f7330241f9256ab00ed0accf0279304b6e468848b3ba8365529767cfc0ec448ff7fe55b08f7e07925f89983ca71bf9739d7d188380705801e9c
-
Filesize
5.2MB
MD546960fcc603e10dda42d1f5e4258666f
SHA158ec12bc81b203d8a66cad0531ca23c24554c720
SHA2566a0238671721a7fc201a2a869554f815a49a6691e9c5f8a1726f4f0513b21bb7
SHA51224867407dbecc94e0a8c186d24a2ad23b9efb0660f927de01f27cf8237dcfd42d16ed752e89ea6092d886b1149814438e19eedd38313da25847cdb0d402821bd
-
Filesize
5.2MB
MD55aa042068c1cce9600d25fd472887574
SHA150951fa54ebd96eb26a736b7df736976871a04e6
SHA2569da39e974c45e6b02bd5ad06ebdff876a5e621e3783133ffd364fa28317942e9
SHA512eb2d2a37e7f5e7d3148a730f374aa3615099177c467c0d3bf03da5843710cf645808f8ff3ad806c2f293a5b472f6079d04953b7e5f6b57e920f6daa1e0f9a6e0
-
Filesize
5.2MB
MD5f5f536ebfc3ac56cf43684b6b4f50d92
SHA18d982dd6de8c231aac82583c09c1b0d170d0893e
SHA256d87aafdffc8d6c8f9bd51f443f705d8c52311f4725a462675402d578607d87b5
SHA512decf12aa51d620f850004a0a1d778fb88e98ce138c84eab24ffa3da55aac2931122e86134336d6244f44e5f32f6e66a6fe902169ccf4424708e4b1d98939bf18
-
Filesize
5.2MB
MD5b9b401583d82b1de55f8380f04a4e04a
SHA1603ca60be22503bc786a792f6be8d7a30ecc99b0
SHA256b8afc47ec07e39f061543377d5830247306342d2bef88752ee4b4d481975613d
SHA512ff4289efa52ad6cc17b1c6217a6d6060bd93c34486cbcf0e5120c49b547a5a6b8180e0b33f2598b611653aaceeefcd9394f986c2bea443ad9769bb295dacd0f9
-
Filesize
5.2MB
MD5c88cf18f141faf9e699bf1284d5d12c1
SHA18e9a3a9c0bba32dee6b90da21c2a931a5a58ab90
SHA256ebecbba979bc7d433ac7fb4ebc3cff41707181e1391c021f793bed30e05779fa
SHA512a336814c2f1629425acd8377a19ea567f981e51a9d3a92ddfc801d7a611dfaa2799c4278fe55b897ab91207c1132ef602f06b45f90069d0db12f00fa4a7eb682
-
Filesize
5.2MB
MD58fafc5459cd3e461aa213f71efafecbf
SHA14efce48cd3c3fed7262fd938471df85430aa8e03
SHA256fcbc01f28d5ea3e400615f42dfec5f87cf04e4776ed921e98336acc7c6843f22
SHA512d800aebbe80da05d67756f1f73bc0651e32a8a078dab1a834785dd5691b8e9fd9ff762546b37f66ecc243a4084df4211b5f901878468336cf56260fd3ff16ab0
-
Filesize
5.2MB
MD51fbce60bcfcc82fc24b2dfdbd7446c44
SHA10c9ffded44dd51f04bc639a72a23e24d450e77a6
SHA256c6f8ad50b9acc580e138984d53f2b58a55078d0419b87529a5d53df6bf89cf38
SHA512edf334bad23dbcae3a039db7613960be5874dfeb66f2ce5d4e769bbfee82880cc0413b413812376416b52b4b592e0a02e477c91a58ae2a622dc39f1002ea6fe5
-
Filesize
5.2MB
MD53a40f374452e87eeda0f803616d81643
SHA122e6ce3e809d8151cded54cccc5dc06bc7a0074b
SHA2563df82f24b118968c8a0bf976b813d99189bcb2519c44c265a9bfb5b1295cd894
SHA5128c096fc78488eef202d79ac9f4c19a6e9807bb95444fac06f5cf34614d7026f5242c5766df210ea3c327dc1207acac0d4a842e00e5490cf820682111c43f0e0d
-
Filesize
5.2MB
MD54cf1169efea38079fcc016b3cb77fad8
SHA13270dd72d8f068484464f1bd768a270a9cf06c66
SHA25601cd14c3b4c03bbfb13c6d7d6603bb0a7bc9a0734652520a680a1f5996efae07
SHA512894c98b7d690678cc38eac582a936ab50e70eb258723c689a9f39ff497bbfd753885f8047b1473da6996be06a62e52a4fdfa294aa94169941fb3c213d183631d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB