Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2024, 16:17
Static task
static1
Behavioral task
behavioral1
Sample
f0907b48aecc2c1fe36c2463223cab296fd3210ee822f0d3e7101cc66832ec22.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
f0907b48aecc2c1fe36c2463223cab296fd3210ee822f0d3e7101cc66832ec22.exe
Resource
win10v2004-20240508-en
General
-
Target
f0907b48aecc2c1fe36c2463223cab296fd3210ee822f0d3e7101cc66832ec22.exe
-
Size
286KB
-
MD5
90c76a9f74c351ca109c78beac808b44
-
SHA1
f0f25993c79a7318d9fc71adba8383495e774746
-
SHA256
f0907b48aecc2c1fe36c2463223cab296fd3210ee822f0d3e7101cc66832ec22
-
SHA512
c8f5ee74e0c395d35843220b936d85771b01258d890c9c149a805e3e021f0238eaaeb39bc755ea61222c5082b13121cb28ff4c94c226510a2739edac32825e20
-
SSDEEP
6144:L6jmbBX0ZeLle3mNfnzrktMQiaXJI4sbN2dcc:LombB0ce3YnvXF8C4qc
Malware Config
Extracted
cobaltstrike
1580103824
http://-I�`�1��*�,1P��! pv���JzW����]��uY��主�!ex�Hb2��a912�A��`~�����x���PE:0
http://energy.stf.13.pttsecurity.ru:443/c/msdownload/update/others/2021/05/
-
access_type
512
-
beacon_type
2048
-
host
energy.stf.13.pttsecurity.ru,/c/msdownload/update/others/2021/05/
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAApTVMtQ1Y6IGRMVWpYSTNsaVVhVG03VEwuMi4wLjAuMi4yLjMuMS4xLjIAAAAKAAAAEUNvbm5lY3Rpb246IGNsb3NlAAAABwAAAAAAAAAPAAAADQAAAAEAAAAELmNhYgAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAARQ29ubmVjdGlvbjogY2xvc2UAAAAHAAAAAQAAAA8AAAANAAAAAQAAAAQuY2FiAAAADAAAAAcAAAAAAAAADwAAAA0AAAABAAAAEi4yLjAuMC4yLjIuMy4xLjEuMgAAAAYAAAAFTVMtQ1YAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
GET
-
jitter
2560
-
polling_time
1000
-
port_number
443
-
sc_process32
%windir%\syswow64\pcaui.exe
-
sc_process64
%windir%\sysnative\pcaui.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0qtJmA3UjakIHeANpfI/nhI373MjFvXI8xWTlDvF+DFgmQFisI2Ax7CX0kKUlgkfSgbt3BSUtTfvkrG8s9gdLYNlIcBX7hGBKzHJsObEW/cxO5/CjvOfUg22/NZEmjRN0s7CQ1n6kYlnAN421gw5/w4WIr0lTdyr9qqzGKCNHiwIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
2.01330688e+08
-
unknown2
AAAABAAAAAIAAAAEAAAADwAAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown3
1.610612736e+09
-
uri
/c/msdownload/update/defu/2021/05/
-
user_agent
Microsoft-Delivery-Optimization/10.0
-
watermark
1580103824
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1396 f0907b48aecc2c1fe36c2463223cab296fd3210ee822f0d3e7101cc66832ec22.exe 1396 f0907b48aecc2c1fe36c2463223cab296fd3210ee822f0d3e7101cc66832ec22.exe