Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

artifact.exe

windows7-x64

10

artifact.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    artifact.exe

  • Size

    19KB

  • Sample

    240526-phzmgacf62

  • MD5

    47c0dc53f54b3a92e64e1149b1c2601b

  • SHA1

    830480099b5a8987d718fa96f6df2a5102b24427

  • SHA256

    24cf29f4b81ebd7622b0f75705971a265f7604fb3a47bb764ab917ed22287232

  • SHA512

    e1c61644331b5c42358bef2a45355acec47f0dc8fc71ace14946b0a05095c2b35582410e990df17e7517a2bf597c15eba4069835e16aaef9da27c748be86d999

  • SSDEEP

    192:TV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2IhFsWF8qa1Dojjgi:9qaCF31cix+Dc4zjX3JFF46gi

Score
10/10
cobaltstrike987654321backdoortrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://47.116.125.180:9999/orC9

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko

Extracted

Family

cobaltstrike

Botnet

987654321

C2

http://47.116.125.180:9999/load

Attributes
  • access_type

    512

  • host

    47.116.125.180,/load

  • http_header1

    AAAABwAAAAAAAAADAAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_header2

    AAAACgAAACZDb250ZW50LVR5cGU6IGFwcGxpY2F0aW9uL29jdGV0LXN0cmVhbQAAAAcAAAAAAAAABQAAAAJpZAAAAAcAAAABAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

  • http_method1

    GET

  • http_method2

    POST

  • polling_time

    60000

  • port_number

    9999

  • sc_process32

    %windir%\syswow64\rundll32.exe

  • sc_process64

    %windir%\sysnative\rundll32.exe

  • state_machine

    MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC9y9YUQt5CjtgTzMKS2PUq43kUmu2m06OMz8TGQl+WS2NI2K17C1CwH9Cfx52X+oZpvA+e0Lb0pxih8lT/2y5FQcl/keDy9RzhRynTofgxo9Bikv03/4CQKIypZFYZzLP4WsCXhW8IP6K1usX5VU44zkToTmsfhAf3hGWhni4iuQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • unknown1

    4096

  • unknown2

    AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

  • uri

    /submit.php

  • user_agent

    Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0; Touch)

  • watermark

    987654321

Targets

    • Target

      artifact.exe

    • Size

      19KB

    • MD5

      47c0dc53f54b3a92e64e1149b1c2601b

    • SHA1

      830480099b5a8987d718fa96f6df2a5102b24427

    • SHA256

      24cf29f4b81ebd7622b0f75705971a265f7604fb3a47bb764ab917ed22287232

    • SHA512

      e1c61644331b5c42358bef2a45355acec47f0dc8fc71ace14946b0a05095c2b35582410e990df17e7517a2bf597c15eba4069835e16aaef9da27c748be86d999

    • SSDEEP

      192:TV7qaCF6Op1t2dobVXujRDcBaXWQjwOT/2IhFsWF8qa1Dojjgi:9qaCF31cix+Dc4zjX3JFF46gi

    Score
    10/10
    cobaltstrike987654321backdoortrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks