Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
c76123f9b3ffb4c9da8a5e70e0ba45fa0a8a0760f84ff8c38ed2f7eb37f73dae
-
Size
270KB
-
Sample
240418-cvjqkagf46
-
MD5
6ab6084c5b47459f03b90f6c1bdd850d
-
SHA1
023f004f20473aa73d406efe1eacfac20860673c
-
SHA256
c76123f9b3ffb4c9da8a5e70e0ba45fa0a8a0760f84ff8c38ed2f7eb37f73dae
-
SHA512
53e4627bbbda6ad96928bcabc947ac406525401494bfa5d3f77052671572acbdf6db29f7c46cf9ecd2b27e7c03a434a11a27fd606acc0c9e2bd9a492da987484
-
SSDEEP
3072:rzbINhWl+CIbfqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnL7z+GIkfhUYJF6vzHks:rzbUWootfDCvT4ZTXzCLdIk5UDvrKM
Behavioral task
behavioral1
Sample
c76123f9b3ffb4c9da8a5e70e0ba45fa0a8a0760f84ff8c38ed2f7eb37f73dae.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c76123f9b3ffb4c9da8a5e70e0ba45fa0a8a0760f84ff8c38ed2f7eb37f73dae.dll
Resource
win10v2004-20240412-en
Malware Config
Extracted
cobaltstrike
391144938
http://192.168.59.144:11/pixel
-
access_type
512
-
host
192.168.59.144,/pixel
-
http_header1
AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
polling_time
60000
-
port_number
11
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCZve0datSf0ZeKMpTLGfINhbrBpEx67Agq/OlNVaOoB98rgcWCFWHmkCts3aQfFBn8RK54X8iG4AGo/NkUHZHeYCwjG6RqX/tSoKXc93jWejhm2jkdP2D2dT5OiMpaROHT+eLeB+c349fg0+iLQi6o0FvvRVB7QE6wlk/mXoXN2wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/submit.php
-
user_agent
Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)
-
watermark
391144938
Extracted
cobaltstrike
0
-
watermark
0
Targets
-
-
Target
c76123f9b3ffb4c9da8a5e70e0ba45fa0a8a0760f84ff8c38ed2f7eb37f73dae
-
Size
270KB
-
MD5
6ab6084c5b47459f03b90f6c1bdd850d
-
SHA1
023f004f20473aa73d406efe1eacfac20860673c
-
SHA256
c76123f9b3ffb4c9da8a5e70e0ba45fa0a8a0760f84ff8c38ed2f7eb37f73dae
-
SHA512
53e4627bbbda6ad96928bcabc947ac406525401494bfa5d3f77052671572acbdf6db29f7c46cf9ecd2b27e7c03a434a11a27fd606acc0c9e2bd9a492da987484
-
SSDEEP
3072:rzbINhWl+CIbfqqEVxtfg8jtfDCJS4l9JTFyG+JteEzCnL7z+GIkfhUYJF6vzHks:rzbUWootfDCvT4ZTXzCLdIk5UDvrKM
Score10/10 -