Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
25/05/2024, 15:23
General
-
Target
2024-05-25_77b0eeffdcde9e87823dfdde0e436d7b_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
77b0eeffdcde9e87823dfdde0e436d7b
-
SHA1
25de9721ed2203d6c4e716e872d0a4b33c148402
-
SHA256
1175fe857654c399c724e4e19074290bd75dc133f9bbc8460e979ee9972fd37d
-
SHA512
6ac30e89dcde642a5142c23a83bca253d5dab04c2227b91ff804cb9620c3b5a27d7710775b58c9da35bc8263e8d71d4fa961060552640081d2af8c0374391ca0
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUR:Q+856utgpPF8u/7R
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 55 IoCs
-
XMRig Miner payload 60 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_77b0eeffdcde9e87823dfdde0e436d7b_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_77b0eeffdcde9e87823dfdde0e436d7b_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nsKZNpf.exeC:\Windows\System\nsKZNpf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uDouGko.exeC:\Windows\System\uDouGko.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YGWcFal.exeC:\Windows\System\YGWcFal.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qNYOfPQ.exeC:\Windows\System\qNYOfPQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fBxdPJS.exeC:\Windows\System\fBxdPJS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KoiIMsS.exeC:\Windows\System\KoiIMsS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hCLhjfu.exeC:\Windows\System\hCLhjfu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XgKcGTS.exeC:\Windows\System\XgKcGTS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kATeXYu.exeC:\Windows\System\kATeXYu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yqqWoLC.exeC:\Windows\System\yqqWoLC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\frJgmoA.exeC:\Windows\System\frJgmoA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RkFoZqO.exeC:\Windows\System\RkFoZqO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RsEBWBt.exeC:\Windows\System\RsEBWBt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmBorrD.exeC:\Windows\System\FmBorrD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Ferzrsc.exeC:\Windows\System\Ferzrsc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TOJtNiW.exeC:\Windows\System\TOJtNiW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jSzFnew.exeC:\Windows\System\jSzFnew.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sKCvpEm.exeC:\Windows\System\sKCvpEm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xKgwMmp.exeC:\Windows\System\xKgwMmp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TSlYYsY.exeC:\Windows\System\TSlYYsY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HMjHqSa.exeC:\Windows\System\HMjHqSa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD52f7b79474d871d3a3d1a3568580f12d8
SHA19cf722d5741b844a92229aa9e3fc0f65fac2010f
SHA25618ea12819f7f3409091f71c5a4ae57c1994566a577a9ee42ea74a81fda824e27
SHA512e6f17911aef2273bf846537f418605896bc0563e02601e96bf57475a195b362c0cb082b9f632431750187bdc3423f28024f8c2670e440e48efccfdc64e1e3311
-
Filesize
5.9MB
MD5f805a25bc4a930da1c587d030629b20d
SHA19c843f8843f55b15d0ed26cdcc330cd563c2b5aa
SHA2560df5d9532b2067cc7b8d24227103d88eda2c1bff98f7b571a47d5fc18213f58c
SHA512c74dc01afa4c51caef37de83391d666bafc1f28903a4dee751cea6eb2b008371ad5b69f8d303417332311550118c5238b4984486ee882227f3e8d05c3c11cde4
-
Filesize
5.9MB
MD54b208de24ecd1d5d7b72e510e47cf419
SHA1bf486189cb6e38eda977d1a04abfb7e4b7257543
SHA2565ebd8d9193bdeb8dcb5c4694645460c1baa30da409e9a61964d1e03b07140b77
SHA512de928cc65680c6a90a04619ed2a266396d17f4655babc361d7762be46d5f7d6b543d20beffea7aa44395418524db82a42abec06607bc235db2dc6841deae3719
-
Filesize
5.9MB
MD5c80a33da50cf0d7484deacabfa820a00
SHA1f3e39f5a57388c1a9035aecf6ab9a170252ae0b9
SHA256946bbf3ac109feb22f51264cfe879bc51dc4ea0161fcd3ef4509f25de0c5ab26
SHA5120dd98a48acf4e9aebe1ab40cee41d45892c81fa14b1857a73e05f26da30e85a0a459169d4d0122e92da772f2f38531f4e480e1d01f9ff884ef9301287ba16968
-
Filesize
5.9MB
MD51069c1a4498510990f2fa5895c5a45e2
SHA10324c84d2a4e083a0f2f885aa26302d6e3126754
SHA256445bd01008820febd1adfd1d7d2ce7fbed5e05025307cfd0351aa2d84d461ebd
SHA512c92399abe85ee5c77ac6d42e136c84eac6b441de000d8465cd9c1a8146d18ef5d573c873920441c36ade544bab6d910decb364717abf9264f3c8c7ab7bed96fe
-
Filesize
5.9MB
MD57606c825524e7dff9f0d2d5dd055032d
SHA16c7ce36263edc3caa56d0506ee0ee7dccf699bd4
SHA256ab6ab378435dc2785c8b7977e65c21db7b80b3c1eb9ba307f5bdadf2860ccb9c
SHA51269a0cc7c130a07ce688968a152cb0e3c2adee2540cfea62c15bcaa80057b593fa4fa2d1414ed33d554672340fffea972a60392c8279fd8abdd67ac5ccefb8277
-
Filesize
5.9MB
MD5e7398fad780a7df97150c1f6a28afaad
SHA1007d17c2c506fa2e54de58d46408edd3583a8193
SHA256f7a22c05982bf64a6aa66991a80fd84bb596f5ced17a146ca273e9558e50a48f
SHA5128b2c73cac5cae6171cd9418b4ee53a2e5a44fbb6a12a1b47ef982c6bb2c234cb59a9bb51c87cc00ca3159a77b2f791b866054651810a9176df74d689b80894f7
-
Filesize
5.9MB
MD590a10a7f7f5160830b280cc690db36ef
SHA1aa74f39e947037fefe60d63f6d0f76aa5438d296
SHA256d6b6c01b551e5e8967f6a6671acd93dda7feb7dce6f5cf29dbadda1801d61b1a
SHA5120d947397d2d1f4d702a9730bbd696892b865803248c491c03f8b5739e6d64ce29e37c60a87d9e3ccd9681fdcf273671ad689ea73837ca9cb1e667c853f5d6702
-
Filesize
5.9MB
MD55a82c99a6d7a2fa38825c126e43da7f5
SHA1db4918c25b0fa4b7e28d379095d8be6eefa62e6f
SHA256e99cc74a693216b317e12ddfbe0324ce9f9523c5314bc009487457b8e4da6040
SHA512acbd6ca4a065ba27e419eb60971db9ff06a6246248687652b57ef9ea51946d54a415f239ade593448ef20ddbbf7896ad8eff1405d85092ff0222bf6e4bca37df
-
Filesize
5.9MB
MD5453e100a5af0683255c8b4c2cc0db03a
SHA1d56bcc48d6b79b420e181153ac5586760d4e5dea
SHA2568f439bac237b46445879df46ead91647993dcee5cf3dc86eeeb3d7c14af704a2
SHA51200213eb1c00331625f78036268a16b1f0ee3c0d9460343d90d30e6fce0eb61e838a6a421100b5b1a9cf5a2b076add78843bbc6469367c93f742229e227d2c8cc
-
Filesize
5.9MB
MD5ae4fbee4f525934e1ee6cb86c5cd0d96
SHA137f0e650e5326e3af89317a38f7cc5533c05ebdd
SHA25656276a959f59fb46065bfec8ab2160b05ca2cca7aa39d47d79ec3347c298247d
SHA512851af1dcbc9129426d798939e1411eb723ff6eafbab1a7f4be4f43a8b74690843977a1297052631dffe93bd018b5a440626e4c07859c7a9dc313388f487890d7
-
Filesize
5.9MB
MD5996e8d7f4e2f45f927fdb1e49b997666
SHA19b4a32900495e315a57e956bc0ea3568caacb037
SHA25693e6e575afb8a1ed33103e5f0ca63ba4a8404746bd1f929d14bc8b59d488efa6
SHA512f245818ea420efc69df8bd96ad90cc49686626dffe489dbd4be5d1cb3909463d26499bde4458ac82782b5723929c5a4fe9803ac3d90c84601d4d7998d28b9219
-
Filesize
5.9MB
MD52a7e219914c9d73f74bd3580ad1a88a5
SHA16099fa0f3eed593ca196246cb0f1ef5fed794ed7
SHA256654fe4b4f21e134f1b42683e19fa0a153eff1ad2c7d078b75cf96c75b5c093dc
SHA512a0838b81df7f5aca6f746aab7bda0448ecf25ec3e0bf8af94a4f657bd189f0faf4b9873cd5f0fc2d683a9c0a7012c2ce7132d42bbcfda127b97d5c469a472576
-
Filesize
5.9MB
MD5c3538a2499bae672a63e5d5c74b6593f
SHA138c2b03c08d9a51abbadbc251333e831ae52fd9b
SHA256f81a461d50d8c65c4af09b9b57986aedfb745e0ac96759960997374682bac9c8
SHA512b6de9dc1e40ea4a3bb057099bbfa8b0d67141d23ab22dd0dddc87abf5a7f2da3d374dbab1d04121d29360905034bcbf0aac3da70a5b82dc2a45c39f9d1233046
-
Filesize
5.9MB
MD5c4e449c14766983b9f799a1076166d86
SHA128dd31dc5e85fb9a619e67f6df9b94736fc6095b
SHA256050036f56df99474c1649c998452281b45d19025a56d455af5f7ac40bb984bc7
SHA512c5cbc0fb3667d7fe25fa583287425c47d9cb1aecafcfae95443b9737d935d8b8a26b1a0baf5c68362ac829381a50a20094a5a07d8f50946d1a3505ff1b24a02b
-
Filesize
5.9MB
MD50229095cddc449588226b156728af038
SHA12dcf65477b7b9b5e4e14370124a4b753ca86e1f5
SHA2560a1bccb3d02a5d66fe98fece0c723ec9fd52d52bf790ff44ab6956b737cc4e7e
SHA5122f8196affddef1db6d7f2112ee11c3582e16d3e91d1ffd43b9f73c78fe87d3ac764d6cb4de63e93ff5580662f304e549ef024f26ac224ed6fad29b14f7eb29b7
-
Filesize
5.9MB
MD553fe11e954d2fb13775a156d31b6c2e1
SHA16b72f230d6f24eb4fb8d252e9227cc5566756bc1
SHA256020b5c7b3674acbb7102a0041e80a18ff883d73bc19219cb513e2b32445365e3
SHA512eadceff0316e4b01dcfe783fd27cd921791663e6e14695809ba4f139ea38fc6386e109d1cdaff0e31117e48e90abe97807cdef96556cbce9ad2f64a9ba79ff8d
-
Filesize
5.9MB
MD51163e4e2813427d9dbfc28eb38a33609
SHA11a9072cfa624f955107022ffdf341afdaca7561a
SHA2568587c83cfe5bb47e277534713b7307f46f6c4479bf8e783a4ac1455222c2bb3f
SHA51217db6d7bb630b950aec65f1e738e14b3eb75fe2da4826c9eef842d6aaa18a40f540bc43544c8f0e922d2e9522ac36bf67529c2e1560a443adf7579f9577c66c8
-
Filesize
5.9MB
MD5ef6da47b49384f92e6dd1713aa878b64
SHA195998db508d7052b911eed34bc94a805cb27a898
SHA25680ae0f36cda9260c1c006a990d8cbb54b03823ebaac83b3debf5920de1a35e22
SHA512880423a87ac007435a2c4359ae868747effe7dab6603248eaecf646147dc5130843802193c38d914a723f865943d63df399999c8ba58539ea363749556c727df
-
Filesize
5.9MB
MD546798ed08206fc5c84464267f462469c
SHA1ad6926c861bdd3e4a56278adcec451e9a55cda0d
SHA2565c6cc0eafe4e27d6683f4d81049562e8c8d276cb8ab355984de17517a94ebee6
SHA51238d45d856cebebe15ce057296e39fe0a7c1b78149a61b541c1ea0375226e466b49ace015d033b203548f1c7f356f8356ead193e2ca47969b03e4bb4507d79179
-
Filesize
5.9MB
MD51797c7494b62f923d1dd0c06c3a86f3c
SHA1512d7c234b4aeeac6a8cb5f6756f39cbcdaa52d2
SHA25666f977149952d4a2eedd734053a9505a22d70f5069dfb17510ab10d203a78fc8
SHA512b0247452e1ff974a389efc87a76b44cf421dfdc7a3ffd84cc30661eb91a0aead1d72001ceb42b789b18df1738f9ef47a06929ef3a8dd0ffba4ed6556ff1bd6ea
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB