Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
27/05/2024, 00:43
General
-
Target
2024-05-27_1ecb9d0787b6b3d13e1e185bd91ee021_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
1ecb9d0787b6b3d13e1e185bd91ee021
-
SHA1
db0ced9c7d323267c7b693a8e0cfcbc50155601e
-
SHA256
b0e1026312a3cb1967f8d3f60c9e4dc24f6b524bc8492b992802c9d6f82894c4
-
SHA512
d5caab03dcf66f5fd91301991fe6d41aebf01be33dec63233a622c52f6bc1610c29aec559aa225e7eadadc6ffbdeee6665de583d04ba29b50a73d514dab04106
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 61 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_1ecb9d0787b6b3d13e1e185bd91ee021_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_1ecb9d0787b6b3d13e1e185bd91ee021_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\MpOBvuO.exeC:\Windows\System\MpOBvuO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\suBxfNV.exeC:\Windows\System\suBxfNV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eQXbKpt.exeC:\Windows\System\eQXbKpt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SgErRwc.exeC:\Windows\System\SgErRwc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BPCWheu.exeC:\Windows\System\BPCWheu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JPSCVGV.exeC:\Windows\System\JPSCVGV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GlhqbrL.exeC:\Windows\System\GlhqbrL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IDbojfs.exeC:\Windows\System\IDbojfs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PoUpUok.exeC:\Windows\System\PoUpUok.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NjiBGej.exeC:\Windows\System\NjiBGej.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cvvwfyu.exeC:\Windows\System\cvvwfyu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CotfPxd.exeC:\Windows\System\CotfPxd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZRGUSKX.exeC:\Windows\System\ZRGUSKX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RFIPrga.exeC:\Windows\System\RFIPrga.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\neNgwua.exeC:\Windows\System\neNgwua.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wgzftMf.exeC:\Windows\System\wgzftMf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QfFUPjL.exeC:\Windows\System\QfFUPjL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tfejFnn.exeC:\Windows\System\tfejFnn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hbmitfT.exeC:\Windows\System\hbmitfT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tkIbfXP.exeC:\Windows\System\tkIbfXP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LqkBUGR.exeC:\Windows\System\LqkBUGR.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56f925102819d5afcb0cf8ffce80d6a8e
SHA188b87b6d2e2b1819fad5bcd3fb293e7f7a77b03b
SHA256993e5b4b39ab7436e36fbe6e0e8bbbe83daa27f98abbe69b8ae44c1158019f7f
SHA51241d3dcdb5f6d4724cd23acd7cf728220221710f4896efc0485e77d1df2d2328179f19c65c0eb34d802bdb9d1c41350b01b9fe4da352d0861ef1569a23c50ed83
-
Filesize
5.9MB
MD508883cb7d125940d27367db12f21111e
SHA135b984f59880588ca9746f8e1da9116c95ab58eb
SHA256285f448d084d3f390b39a237dc325b4f30ba01e47fdfefcd01c9b167a009d068
SHA512d4f60b0e4191e4f3452157a09aa022ccbf5d0ac7626cfa0b40a2949adee7c05b5b99c224edb2fed42c7f23483d7b63090603b8926134db5abef94bc81b1e1af7
-
Filesize
5.9MB
MD5eadeebe8c05d63b54c0745470974db71
SHA1f885ebf6476a611ee834c56be043047d09033a7d
SHA256f707ea9f8070c7d0f8ff23177f391b457b4ab7bf4a2ef5044ce2851a32ca19db
SHA512a6d2de0364ce6b2216cd2cc803f91fb60c4c1eca5ce2131cf4b04255afc4b8d0ad288a200bd3798cc45679d33b0e6d8148963db462b924b92fd03b9e41a6aaf6
-
Filesize
5.9MB
MD59e7207d32b9f4c669d1834d9acd55dca
SHA1c4ff6843a95cde216d6ff2c90b1c5f10d2890bbc
SHA256abae3d7691e0775f2a859ccbd93784862d03beff9564bb3eefae9375d0241154
SHA512ffae2b51a2ecf3d6bfd947923273204540bea745c0e386bcc783b1d75c6f3deac649fea1a557227ee3fcf5293cc92a3b7a982c32681e7477a5d7fd7afa934b60
-
Filesize
5.9MB
MD55f93c0dd9033f3dc7865a14141283f55
SHA15175739639cf6d31963ca2d114b5a595f2324731
SHA256adda733f6486d3b96252ed788b566d9b3d2cbb1f9fc0552618e31f417cac38b4
SHA5125d8547a46cf41fb5daa890aaa8b787a840ac1bbfeb073af2f9533bccfeb3558db762b48cc12b27c850fdebda458ea864eeadce99cc21f2e4799fe48a522500b5
-
Filesize
5.9MB
MD5a41d186499893936115808dcc9fb1e95
SHA1b52fe048da96c56e6c27d33e9124eb3c95f0ca8e
SHA256a87ced25020a5950a403978ed96d456b81c11993443c73ba3acb954c6e466ed3
SHA51224594e026d6f95e6d2ca86d3283306b53f2199aa8d46cd16ec2a4627af28afa4acb931f51c2f4258d0975c684a90f32dc900905f3d9e9e7fdee6eb3eab5bd240
-
Filesize
5.9MB
MD5d0c04bc8c5e3776f1f294fd7ccc86e78
SHA1dfe5d8e26f141a250f9e3d908102084d704ba903
SHA2560f4e6bde676cf6a2d0912f91058b4b1dd3a11db8d055724fa953895138477cf0
SHA5123dfa30adf26da9e025ef7abbc37bcc0a8e4ae873e037566012457f1fd550e20cb0fae96c8d9a1581d5d6b2fd03c3ac783e619b096175a4b9ada09e922127334e
-
Filesize
5.9MB
MD5d206e687cf2a3e59551eddad7101331d
SHA1e340559670a097c1013603974f3164c9d0fcdc6c
SHA2560c4bcf73c543507491d1f18998c04a449d37baef18d060d88d191618a9d0c6e1
SHA512c4e284844e5022d422e02105678197c74438d8d2185fdf1d483e9977d813da068c6acdd93100a344eed838807b9227146e11bbf0c30e1fbea3dd20d9c2eb9456
-
Filesize
5.9MB
MD5fae83343a29a4b1aabcd1290d7f710f1
SHA15ad079b8bf70de0df10401234617931c97e4799e
SHA2567795948d325fb2e137779c84b49201fbd06ccfa8c77de59f4ffc612cfd07c9e6
SHA512b71e069b2082dcdae7da04aa3a621c212c03d829a859ca3654ed50e5f383f682bc7e1890989261e5441055506ed184c2bd14a3a8204a44f5153e885d0171c3e5
-
Filesize
5.9MB
MD5750ed18f0b372ac2d4e000a3e514aba1
SHA1f051fb9ab1271b405dba1326a09d5c5377091d13
SHA256baafbde4451d7b97e6c942f2c671a0891204deaa926217f14b2cc320c3ea4f2c
SHA512095fb549c554f7a6fd7c54c266ae9625009d8537e2619c4dc93349321703df3004915fbe20051407ece44c682b4b4e5ae9f0ef77b2ad6ee391b23aac397d5a1f
-
Filesize
5.9MB
MD59be80039eb5e5426fc6eff846e32e97a
SHA1465ffa27279031b70deab31a745ca57605af7d04
SHA25611f70425f7c70f0fa4247a5ce5819f84c941ca66bce84fd7f57c3b40c442c101
SHA51289d692a1ad0fd9a74693a308c78c4737bcfc5c5281d175fe351a16c9a58bf1bfc403a011dd2a2fd4cf8ba176ef3a975154edb7d8ca963426b8a7585dcc73118b
-
Filesize
5.9MB
MD5c6106934c4c82cafee66a6ffbcee1283
SHA143250a596b56c222a0854a7a3e0587a1b9d3b2c6
SHA256564d60d5ce8632a99bc42e0247986731b874bf86973806d2b7de03047883caa6
SHA512c6fdcc6ddda64f11ea8a5db9bad3b72267a6c0a0e3789066681b7ab3a3206b895789a1bd060130b9230529a21c0879ede0932d0bef0cc3571220a399b211bfd0
-
Filesize
5.9MB
MD5668929de178a6c4cd2d3af617309d75a
SHA184b65d222c949b83f6405f8b3228ee336abbf0b5
SHA256049c5e10e5a8037eba26a13e9581778e2c840ee431d97d1252ba126c10d8216d
SHA512cb8a61b0b8bdeb2df11c5e2e09375da7a5e6666fb2092064671812c05a45e09fcf3788577dfa5ed7cc6d4d7ad45b7b5436bc9240ed2957748f8b13edde371a62
-
Filesize
5.9MB
MD5f6502d1253d05979c1e20ce8eac2f368
SHA1a4e505ccec2db59810c098f3c0fdb297aa5dc7a2
SHA256ce9a1738855a2a08ce1a8ae0b7c8c7c321e58d003e88b4f7e433719bb636df40
SHA512e7066e80b465486e4743ba0a7e4d3579e138470b08833eea1284b0994494b206629bf70b112a831f827bc5dc36473053514221958d8f52296443d75aa3765532
-
Filesize
5.9MB
MD5dcf561d3edc04c4238ec6170136076a2
SHA19c5120abadac197d3a7d7a5e5f41d46901c17a93
SHA2565669e99ca313663335c28b16f353f69081e8b23b799361c1f1377c6b5fbd5735
SHA5120b7ad07b7b3b98be9b5272deeb39e3a1a5139cbfec210769eb2f063cdcc26d98728ae5391db35747391bdbbd52df48f4d5eace0333cee2d9c6274216a36e909d
-
Filesize
5.9MB
MD5f6ba879ea8fe6c8a1d93e736e36bdda4
SHA1a38beac2f6f4e67bfd660e618f6fbab558ac12f2
SHA256d4b4b370597cf72b5acea4f9ad67e46b73fbd1cef6494f686bd854ff67e3b205
SHA51242e549cd07f1c083d0eeafd1ad1b4b0643672a39a700abd7fc32779c29afe14db0a61b926fa3e208c6ece08932e7afa9115cd21d1492fae3c0a3718b99bf37b4
-
Filesize
5.9MB
MD5bd38ca6e749675770f88b3f908ae294f
SHA11eb8d3edcd64dd75f9e8b9e28fed7f27347fb813
SHA25608d65e668ead5af437c63c3787ed7f336e4ea4a4ae1402c8c04cbb7acb195371
SHA51286db48cf2c604c3a8a23e99503dfc6c5e86f65deab5e333c4114f9745e8e7b7e9965977fa0801e0b5e16bc49db6dc1eec11b37237547af05b4da3e5ab381ce3a
-
Filesize
5.9MB
MD5352b9cd355aeef96e98417d034cd18c4
SHA16d19383ba0bb3ed1049ccd8c7bdc68274f2031b5
SHA25681013bf0722b83876c81d1b92706126df8b35f9a8bc04620f57728c13d2a1796
SHA512f071d5ffb59b1bf87985137ed82e0c39c576ecdba520f71aec8f4a103eb35f17006f8362e4c5998031e513881097e67ea81c1a18828077e701fc42ebf5092d77
-
Filesize
5.9MB
MD53d4d4044852cbc3713ad20fd61360b4c
SHA17e704f75f2e85b05801961c0c1246f4a62e40c68
SHA256269a7d29a153606da5b7532dfe3d58a18af74976a7ec1a0d9c0d155e829cbc86
SHA512c9fb2ead67cb753a34be182acd55cfa34a44a264fe10242670f109f1d34dd588aac966569ba62784b31655706fb4d4288b93e9ba317856405b75801a7e587d59
-
Filesize
5.9MB
MD5cfbb70662fa84c01d617b4f631166cea
SHA1a8349c0e727c2d52c6fe7d4a6846829e3cfbd6c9
SHA256c3f53a678bd66457405e09c74630fe36ec5289c234d3f5c5b82f895fa6f5d2e6
SHA5123fd4e81b9ebd5eeebcc28a34ae93127e8799270737948595e5f58e644f5ab0809caac1f85680a0d5a3ffefc2941a66bd04236f4a351aaef6cb2226317ca352cd
-
Filesize
5.9MB
MD564fb4f5c1499410640a8c7db3382d449
SHA1b389d5113b42050daf0e96aa294f36ba14c66593
SHA2564ee484f99f0f3c43f9feae02d8734aeaf557b7e3b11d681ff1cc132e0cf802df
SHA51209e04998dac2b4ec831fcf83f8b9d166dec22c2d28f18346a59c1b70bb06591244958815e93642767bdd119755a9ef48c79378e735978c8f5d35f6efb884bd6a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB