Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
27/05/2024, 00:43
General
-
Target
2024-05-27_1ecb9d0787b6b3d13e1e185bd91ee021_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
1ecb9d0787b6b3d13e1e185bd91ee021
-
SHA1
db0ced9c7d323267c7b693a8e0cfcbc50155601e
-
SHA256
b0e1026312a3cb1967f8d3f60c9e4dc24f6b524bc8492b992802c9d6f82894c4
-
SHA512
d5caab03dcf66f5fd91301991fe6d41aebf01be33dec63233a622c52f6bc1610c29aec559aa225e7eadadc6ffbdeee6665de583d04ba29b50a73d514dab04106
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_1ecb9d0787b6b3d13e1e185bd91ee021_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_1ecb9d0787b6b3d13e1e185bd91ee021_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QRihNNH.exeC:\Windows\System\QRihNNH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NdvxhwK.exeC:\Windows\System\NdvxhwK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NIyGbzw.exeC:\Windows\System\NIyGbzw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AgqKmYN.exeC:\Windows\System\AgqKmYN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RqrRDEw.exeC:\Windows\System\RqrRDEw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MZwqjnh.exeC:\Windows\System\MZwqjnh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QWeSThU.exeC:\Windows\System\QWeSThU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bTVkoqW.exeC:\Windows\System\bTVkoqW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RQMEAOm.exeC:\Windows\System\RQMEAOm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZJzSQjM.exeC:\Windows\System\ZJzSQjM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zPbValp.exeC:\Windows\System\zPbValp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BOoVufM.exeC:\Windows\System\BOoVufM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gaWgmPR.exeC:\Windows\System\gaWgmPR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tLNtxLw.exeC:\Windows\System\tLNtxLw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mKyesJC.exeC:\Windows\System\mKyesJC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FEfjAva.exeC:\Windows\System\FEfjAva.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\goSDlEq.exeC:\Windows\System\goSDlEq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ybBjOLt.exeC:\Windows\System\ybBjOLt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SImvjyk.exeC:\Windows\System\SImvjyk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IUqFbUU.exeC:\Windows\System\IUqFbUU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XksYcRi.exeC:\Windows\System\XksYcRi.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD513243fc08302a15ae2b8ec51c85fa167
SHA14b911de15acae4ef667e67328875fe067e8ae232
SHA256768fea3b3316aad3ad9c9457f4da9abd9f778b72eb11351f5487f9658b6f12a7
SHA512639289e0bfd7f32a712bf104abadf2b93dced93ac249ebe0ca2c0982da073b3601031ce91885f05917ba658d726192e51a720afa9ba6369e066dc5c38ade61e7
-
Filesize
5.9MB
MD59fc942d455e2b77587bd94c9a38bd49d
SHA1121dada525445b4bd2ec28ab74b462c407f990ac
SHA2562dce24a38aea7c5f12c13be329db08df2bff64b84e1c59c0540339aca0b04ab0
SHA512975c1cc2e7f3dc7bf5191f4f67a3f2d510ffe97d507e0bc6defa43ec0565ff77964626ef922fc55b1bfcb1ebad0258ead72501e8332fd347f1446e624405ad53
-
Filesize
5.9MB
MD5a012bc91e3506ca9ce47dfc6a17a2a1f
SHA101042e1eb41383987948ee1062169cbcf03a5167
SHA25693d6154457175435399bf87979a91526cbaf684a0a3e954eaf0df686b60482ba
SHA51293b518f2435195c310ae88d2f94c6975b518c5e37aa4de9aa353e34851dfc4c1e6694892714f9bcfaf40a358adf4d48cd4e16fdee8b36af3aba7c7a53d564b75
-
Filesize
5.9MB
MD5742fa05c02be681cb6530cfb56ed2409
SHA139398b4e8743cdb647d785ae2f6812555bd1f97f
SHA2565eda9f0999c488a3e04c22302315bd14885f9e664634dc427c019ebe297a3e1c
SHA512c91b9dedba7abc7eda9a74f46c806de3ba60010e954f1508f5296a4114ab2d3ba8a568afa3547b8152841866f267957b4c9b54e3db22c8023e6b657bde20441e
-
Filesize
5.9MB
MD5e90753f9842b3005fd55afb11172a1d6
SHA1c623dd1bb7edf5cee64f84bd183f91318b352bb7
SHA256e4a361a1c107822bb1dd0fc22ec80f620a562f07a48a38752d4b9e6abcd39c33
SHA512d301d2695f2c4bbbf0a0d4348a90abf7a67f3d8a5ca7fcd047ccbd8a04ef52c2043ce2b60968e4efdc4165af769c41217a122b6e1e1450b278fa363b4edbd55d
-
Filesize
5.9MB
MD59b58a9ec3d3d8e2a70c8128b7f2b3527
SHA1b85aa9a0dd5106bcddfb031aefc3a505a9483736
SHA256663fa36807696fe2ef848c359377f20af8f0d41d6b559bb5a049fe31af49b80a
SHA512c871733114fb031b70d2c814848fc89e10520b874405621cea232c4942c74ef1f4d16e90d71147a4911fd0239a39cde6922f8dcd3be5c742a90fee7314997d3e
-
Filesize
5.9MB
MD5b9d1bb4ce72ab9a07941ce588bbfb6d2
SHA180434fdd345792be4d7440dd322ccc914f2123b3
SHA25640001884ffda7a70dfb80940708dcd3bc5a24167942115dad8d9f8c1a4ecad46
SHA512be51848132f8c1184350cdb8778d6c16d9edcd793243b5ce9c8b9783e058fb9799deabc96e653e76fbe620ab123e274369b4daa018a5ab52c0003dd8d2076d90
-
Filesize
5.9MB
MD52b416e61162b6b46aa84f6a191bfac8d
SHA19606830c2c2011882beab22e7e1d47a39c12ca39
SHA25652ed65839356596b9cf32eea1ca418e994b1a2680b842f3262ab3230e83ffc5a
SHA512701c5268c9ebd4a2ecee9afe376657843a7084eabf54a8b68b5f5c72636b5a359100c8d151b089162077ad52f9c851cf03bd35f9cc3258be658ae320b798c902
-
Filesize
5.9MB
MD5d554467e6d95d323fdf71d86a9866081
SHA150b246f9ccce2f110691ad183de276ca9aa0e382
SHA256beaff7ed639ef690779e17dc8fb03d7b2f84735d3fbaa692cddec16ba79929e4
SHA51257649383e9eef295b8922332a4d48a404e8349f93328a9a9207617ebf86f05d863d00751ec9b7792aa176c07263c82e8e04cb294df05ff645996dff83e4173d0
-
Filesize
5.9MB
MD5e359dfb08a44b5b3109758249e1cfe98
SHA1b4d76f94fad56bfffea24b0dc520d498997090ae
SHA25695051e4e5217b9c30f20ac1650bc17ca1d31a850b4a248b688e81f38a91672f7
SHA512b8bd596505477846c0a3306c7ac7c231abee6d5af408e40cfa6dd014ded9a92dd8e7a7a0fdaa868304338c3ad450b2a63ff5d742ab717b050ea469506fc39efe
-
Filesize
5.9MB
MD5ebd1e2f0f32b9049b1b76d027d813d0e
SHA1e1450e38ae81bbfe99075e4f48ec247bcc6d28a8
SHA256deded8699ed4640d3ecb64db68ca971b70c7ac7711d197d3add279a4beff9ae3
SHA512f8365a5350deea5656a40db0abb317ac8f25121350f3c3e669b103944c82ff3205c4f0adb9b0317dd7849c97b5e3003ee6e79bd846261965e77516e141f55777
-
Filesize
5.9MB
MD5314328fab5a6380a6ab23250a00db272
SHA13680545ac44b9ab73543bc5e29a159ec99bfe283
SHA25673c9d4275e31f65d9e2aa597f4dee6fd644d3d5f1046bcac53ffde9ad86be54e
SHA512fc2c477ffa6095516555b6aba3b119cef3ddc844207f1a2c3e778ebdc74bda041a737f7dc3949890a6a074d271c816627099b93a024391ee3f11f956ccc38ca3
-
Filesize
5.9MB
MD58d23dcad3fba82c8e8c4c92a34819bf0
SHA10739d69a17bc69daa810bbb7ac8ecd7d342a1016
SHA256527d9dde0d4fe9fabb63b2440699e26bbfebb313269605414ffd5a220d567449
SHA512451b14cb7fee8a60fdf7df64b49a3832835718ef42eaafb54055b32f4254a3c3a42100a5f2248e708c05551b274e73b4a7b34c4ab27880d690b91f6ffb47cf6a
-
Filesize
5.9MB
MD55b881d0a054a0f4d6f217c28a6f51303
SHA1c5183207902ac81cb189efbcb2bad6b4a11b4190
SHA2565fe08ea3c10ee593bc65427a0b8077e3b155450a14552234f3b676b3f2d98c15
SHA51265867fa1efc4bcbcc9e6d4faca64fbed060d9fdc036982be87533206abe2b4344f71660508246b5b2d77d1cafeadb2e7218c39f68eed8048e367b32104dc7cc9
-
Filesize
5.9MB
MD56fef0348d5fa2414a51e422cef6c93bd
SHA154245527c9086921466e2f975f9c576038d53957
SHA2563c5a041f809391d4b382ac6ffd200dc5b5720d0b847ca2166fada3dd56bdc138
SHA51292637450b13a1b12f33411a57b9abb556fa5bcacff74fbd64288dcf6d62430283e2e9de3a84225ffff9f3df7b9369fa46de16642269cd4f02962b4e31f4f2fd0
-
Filesize
5.9MB
MD5c990b76df881ca4532d4baf013917952
SHA1e96070c009c0fb2a60e60ef855ec7e810f6ee441
SHA25647ff08f52cb58081d9db805e2be7642c6ad3aab221d4587f29e1d023886293dc
SHA512661e1a06d7aa91b32614bbd6652276b087623b49a45f581bf38a7646e21079fd6633389fc2817d2dd64b56fbc1175d2ee295024c4449f46ac3090864d963f90b
-
Filesize
5.9MB
MD52a45ba2a56743b798c3365dbf99567c0
SHA1ecb664b10cc126a3229da75751379847eeaf4328
SHA256b43c869a0089cd7286835448491452963a186f6b90b9887d1fe6d100925c8536
SHA51242231b68e7b3acc5bcdede51df9ec71607fa927e56f5b1f872009dd14bdcb4fac69b55a67dbce128336b3cf46d95276356be61f137eed7246a4973d87b97a2cf
-
Filesize
5.9MB
MD52d71f07ba204570a7dbb50bd0bc2b29c
SHA1a743458b5ce06a20ab5d652b28e632e786197c35
SHA256abe62c0fc6735ab40a8570b2a5f54943fada5fdd909772c8bf9581627a073d59
SHA51231b08e6be34ee2e4aff731ee0e30b67cc9a8bc0229fc31d2a6cab1fc19c1a23b1c573d5999287ac187388007faaeacd8add07adf8e6bf4d4c39810a1d8ca75cd
-
Filesize
5.9MB
MD596225df87f647364cb481b19a9e571e4
SHA157e271d1a77586c1a682b019409c75a8bb4a05bf
SHA256015611f44b4bf952ddc4dc0a21a8ac24438def5cd6221b619d2ce68515f8b8eb
SHA512caa2fbb79b055662af7fbefc3e2c3792c7a9de21c7f1e178958d0f47b9ec851a4064e4e29f44c8bc725195ec2af3073322e9b1413b9c1d86282c1e89906efe40
-
Filesize
5.9MB
MD5bc22e9346cef561a291b5b0cc3e1c248
SHA1eed62f7afd806e1f40b6c1c57f79bcb24c117d03
SHA2569b1ff68c2088758ec33acadea98268a0e69dea294b8683efebed6ce52dde2bcb
SHA51244a12437757300e5fe1414c9a4e3a4f7b4bbc5cd94740a4f4b1496096a7496b61e7bee203e9f77b0da435dee363156d9aa11dda43460549880caf968fa47dee1
-
Filesize
5.9MB
MD55d4604bb7bec7ffd1a8db55e24e503fd
SHA1741daf9c2a44d0a6b34f02ca4948c1aeaac4a14a
SHA256b62a777903d65dbd576e0bbe8ccb6d83663343c6edbf8548f4ecde3663efe846
SHA512c80419c8111a30268c2c2f0266b48c51cb55b1cdcb6a0422987195749c6df745249d601650268870fc9f30f492b0ced9fdaf2ce401fdc5c58f9cda85a1646608
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB