Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
28/05/2024, 01:22
General
-
Target
2024-05-28_de3e57b7602d1c9aaf1271535a75d97c_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
de3e57b7602d1c9aaf1271535a75d97c
-
SHA1
b527ac3ec27d91044aa6d760d274a1cad27d2a4d
-
SHA256
0c5543b8a8fd22c8005e5982a4fa3fcf2fc7d20b39ed5969519237aa2f1c86cd
-
SHA512
c613fb8959983e97e96ad15350b8999436e57eb2ab0aacc06523d2eae1d1160f172dfe132ba7c20bb2121df3273a66318fe4d1955d007e7e6b7ced0cfa9a7058
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU8:Q+856utgpPF8u/78
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 54 IoCs
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-28_de3e57b7602d1c9aaf1271535a75d97c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-28_de3e57b7602d1c9aaf1271535a75d97c_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QLydkXb.exeC:\Windows\System\QLydkXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zKLhgNZ.exeC:\Windows\System\zKLhgNZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fHpVnDv.exeC:\Windows\System\fHpVnDv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hTuYLvT.exeC:\Windows\System\hTuYLvT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sprneBt.exeC:\Windows\System\sprneBt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jePVjSK.exeC:\Windows\System\jePVjSK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rpEhzSE.exeC:\Windows\System\rpEhzSE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TUnXKhw.exeC:\Windows\System\TUnXKhw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eOXxtWU.exeC:\Windows\System\eOXxtWU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OKsxjks.exeC:\Windows\System\OKsxjks.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SzRvxXn.exeC:\Windows\System\SzRvxXn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zNtVDQK.exeC:\Windows\System\zNtVDQK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ubaGzQP.exeC:\Windows\System\ubaGzQP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FIjZRsB.exeC:\Windows\System\FIjZRsB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wIcdPRa.exeC:\Windows\System\wIcdPRa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RtGrbts.exeC:\Windows\System\RtGrbts.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JPExCGl.exeC:\Windows\System\JPExCGl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QuSeYmo.exeC:\Windows\System\QuSeYmo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pSkuJql.exeC:\Windows\System\pSkuJql.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gUWRwGv.exeC:\Windows\System\gUWRwGv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JifCCQW.exeC:\Windows\System\JifCCQW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e182eb298e12b6641907312579759e75
SHA18085837d1fcf1e18edf6feb30e9f41bb3cdbec5c
SHA256f348b3d702bb7b0684ad0b17da543a3c9372223ad6a34c3f0a7f5f75314ecdc9
SHA512f91942efdd7dfe4b16853ef563f2070fe2086f82436653699e089a06122ef8f512007c783ebfc770ae0d285cd8f68bad03904d6e64724a89f29bbfd18359ae7f
-
Filesize
5.9MB
MD594496b5b8e32eef8cb9ec96d9770a7eb
SHA1d9dfe144c1372a8f640675a348949bb41d2afe29
SHA256909b732cf0d686619276c275562a82aa6205b288e56edea6f260c872dc00387d
SHA5126e5b00831fd65d5f5b1ea8b7089dc9a24d16dc1b2e8d9ba27fe43b780cc059e3a9977a2934156fc7e0f2fa8a1006a26fe7c30b01829a68b1460baaa0d40970ae
-
Filesize
5.9MB
MD52baaea728b86e59203a47e06990008e4
SHA1446d594f6aa57741f9600df18b8731ffb01a2ccf
SHA25620e8ecd986e24c65e63714ca69bd8a0339f666436a1a9a366925ae9fa3a5a77e
SHA512078f2b43984330d7db12f20a7aef389943070f50ef05053ac803533e6e78d59786bab2cccf266ed9841e0e2f27c7685addffb0bba60f4dbe37c7d695cf1332ff
-
Filesize
5.9MB
MD568609939ab5fcb6ce40f1302ec465927
SHA1ed9867dc232b4bff372b4d0150ab11ddc7da2e0a
SHA256c660a4039f70356a8011d9aefcdf984d0cc1cc3dd2f057c0631963376df07966
SHA5122e2203ee0e5e49299d1521acb6a764204830d2e218eec2a21c0f26bac1c7220ae5d8d2d8e6c129a3376c71ea83d822d3d166769db8b8e9dea501fce49983d79a
-
Filesize
5.9MB
MD58ab1db96a2526e47862c9db3485e7c9c
SHA1ae19a06081f3f06f18999f57e43686f2f8629ab6
SHA2561116286698facd0bffd3264419b3b492861138b311c0ee4a3006e53b6b37ccb9
SHA512729e42f79554e3502a8e30f62542c4b4b0fc4321739edb2cb04b6f0c2d1e18e5db38f0d718063784bcbf4eb7b81547957c0f6a0916d8e8dfe21fc01285f9b8c1
-
Filesize
5.9MB
MD5e819768c657f0dd295f35ce2c78fcae2
SHA153c3829b789cf27f5870fd473b80bf848186b951
SHA256e5b7b5f4b6ae33c85b7c0e631309852163f8f1d0dc6e06922664b7d270317321
SHA512ce5e3861cb29f4a57a00de324877c97dc1714186f8372714c5a74419f9941be4f17de23ef7793f91b85c2752f9eb11501308acb731dc2fbaaf95dacf5b312bf3
-
Filesize
5.9MB
MD59a7c8b09531b5dafdb8cb0958aeb59bb
SHA192c9adae467319849b5d53239db34010dfebee09
SHA25644ac10d7f6597801b297e63de98e9ddaebf26ee734faf913dc4e74d12737b9a0
SHA5120d8980a80fba8715bf844da7d323c17817cc9150e3495ed4d9fc1a81dc16b0ef20362bd034e4149d1bf000a8a24470f4d614c85f2b12cc63c9545d54256e08c6
-
Filesize
5.9MB
MD50e5f9f9fb23a50bf3ea40bad83a68b95
SHA130ffcfbccc9d32d9101ed2aec0029d6f8e07e88b
SHA256477d3f8f2190c9d3098e988d18ed7df321fb482ad1749e4cf0ad778a3bc6d94e
SHA512aeb4ea771bd41a20729c76ca179650106a680360029b7e3ddab2e950719806627afc6766d27397ee662b52d9c904f32dcfb365e940f20c1005ce8ca39132088d
-
Filesize
5.9MB
MD5e47ea02f395b3ac4865cecf41d8fad96
SHA17b50bd1fb3e130523eda7402c18bc3e80cd48de4
SHA256aa1397cf68b3ed666dbc4828ef1ddb7f53729f3e8d871fb5dd30d0fab6cd6ed0
SHA5129c31f0c5cf75ff65868b315d4d5dc04b6b5b22c272931e6631f5c457fc9af8ee1f16be75b27127147b023ddb36910bb79b550cabf2c2524da8fa0399cec4b24f
-
Filesize
5.9MB
MD562f606441219053e85ffc10e5ebad201
SHA1723ad0cbb39be5f1387eafde3f27ec8fcc34fcbe
SHA256cbb427f935246fa1db4214a3eb6ec9ef4c8161b66ebd6d2546f75771e8ae8f74
SHA512e557b8aa75f734439e7c52b10bedfec66b24b2038a74507c5a225c130eabef97b97e5f6c186b2c75a791adc55d6096205e61e77a29409e62d1d0e54b2c04eb73
-
Filesize
5.9MB
MD5015bf4d66549d5b92383977e1568b92a
SHA1d5b0052de3dcc62228faaccb450da36adeaa2c28
SHA256edb19e57131bf22e023ed0dc6b0e4b360a6d1a7ec4856e0850b95691853c24f0
SHA5122f5b84963ada0d9db9271b09d416db4676f6d5a9f011f82266ac82485eb4e80d57311cf0f4dd94549b4d4c640c6f70abe27803297e681b3b4731a6880a1c1086
-
Filesize
5.9MB
MD5de836c95defbe28acee0950fa4de570e
SHA10f4c33916efbbd202b12bf4f85b8203cfedaf44e
SHA2565031529778f020e24c68a27325c06083b3ebf61c1fb4a7c77b0a51830c2ef11b
SHA5125820ecdb7c83fb060401f1029ac761cccf33fd8715e2848e997bcb6425eec45f0dfc87c93bc77e795a7187789965f024c46aa0bfebbb528bed663af65525deac
-
Filesize
5.9MB
MD5ce88e5cd0efd95b34c27eebe4fd5c5b7
SHA1e4d700b1b06f2b6ea191ef1a161efea193722736
SHA25687a73a3f01c9f77126cfde3dcb526f4e87ef59982d20f21edad206fe3551f584
SHA51202d0b5bf38079bd82445c1225da4a111aba5d0cdabc1396ea3f7b6c6bb08949f4eb6d78ad83d883d37ae998cb06aae176baffa93c7b2766e0f89d3a716c93083
-
Filesize
5.9MB
MD5052a40d969fc2c9d8c72cfc0b629f5da
SHA105cd98d0f8bc762e28737c639eb40405afd1e85c
SHA256ddbf16101f528e01cd2985801f9fa6507de49e2b4342dc9ad774e9ad04bbc14a
SHA5121e6968e82cafa135cef3958182d03ddb58027e527d8b2447265fad096c57037b573073a507388277762720a210ebadc54d3d0b4c821968e71250a60c0ce93039
-
Filesize
5.9MB
MD5a72dac26c36d3c27ceb41c8b197e0e54
SHA1c4ac3c532b9856d734d51644b59545d6f7d42a7c
SHA2560b0c6c3ebb2570abd2b73f8ffcd6bcf0f2a6e4163e00f52f9f38629d06b6cd0e
SHA5129105724685137c617f41773e3d2cc687cb263c56e1e2cb836fe3d3bd39cbe900b251ad511b33df582d403ecefaa3ba5eff57974eec3a41e11aa1e064f6d29091
-
Filesize
5.9MB
MD57728490dc1213e5a92c975a8832d5171
SHA13b1089a4161f8fba487bf49495efb3d4a8ffdf56
SHA2564373c1466321196d11820a729622b344f6456efb547b5582fbdbbcbf09f78c25
SHA512dc8e3efc957efe14d878eda9de5714caa70af2bb758189ac76f43bc9bcc4b49e350f535b3a6ef283675f568e521a32076c757a5300d4f38acff85184f714e15a
-
Filesize
5.9MB
MD5ba6ee3bf6d47887500b5bdec48a62b99
SHA11fa4795669e0c565d79aba3415b2c1029fb9be6b
SHA256b70707e83d825d5e71a76ca110c0b4e5165cdc54ced08dd15b9cf434b9ea5f6f
SHA512f45acc59756c8ec9d9b78da8c9a4f317866de9a82f4e8676eee239b2e217c81751e38b606ab380de7332d2a93f3118185a41fab5fd7f03c84d587030ce0e4363
-
Filesize
5.9MB
MD5513bfd9c71964263c3d3a1a80ac90c88
SHA1d5b61e2d0ee2b18f2c4f3989ababf40c1974b59b
SHA2569c2084cb664fa9076832252e83e208a924c5619f5c021cd6b796373cfdf9776e
SHA512916bb0d2c429aa3897666d3deda0ee06352fbada79e7644a67497482c80c0a4ee8ea09c32b1733c04d4e4603919d52b89f4d1ffb0d7a70d1cb4d6b99cb1584e3
-
Filesize
5.9MB
MD5098ac1bf8f19fd1a43d2583f8c741ddb
SHA14205eb61933b4b67bcaba14201ef0cfd4fe7ec6c
SHA2568c85231696c6d27ec1d70f72454db73513249f58116ba0ef9232fa238f7a839a
SHA512fa3c9dd81df4f11241bbebf8de102e68701116362219ffcbed3475186518b713b17a1f8555e6ff4c146fe68fa4fa547231c3e672d5a685846eb9a93bed91c4c0
-
Filesize
5.9MB
MD569a5476022ef782fcea414f02badc234
SHA1fb28e0b6df58413bfb9e75f8a7ae05f027e01923
SHA2567c9253cfb7f9d6481da56c9d9184f282f240f69bc5981fae6901542e94f3b0b5
SHA5123790e558f8fa6c8c641bff956c50f4c8f25ba31ec5dc01e89b7206cf32cf98f8296fe7f86e98f145e9d54c424b29c65b250391b8539ab2afc454d5238bf90436
-
Filesize
5.9MB
MD5d17e67a0c96a64056cd1df1bf91e88a2
SHA12c8acd885052b2375589debd6ad6aef34563313f
SHA2567a7e51b5f90933136ef83dfa0bcd844eb95b03b855e0ff3aa7d5ab966f3a8676
SHA5127c40ce347e2c40180ab5aa50d02cd7a9ed0038af52bc934c41cae603f92d6e0634b930f664574ba7d384cfeb32604a548aa4d279e269d1e161fd4f91ccc39d9e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB