Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 21:44

General

  • Target

    2024-05-29_fd9a14af909f5c5b03257a4c10acf2b3_cobalt-strike_cobaltstrike_xmrig.exe

  • Size

    10.8MB

  • MD5

    fd9a14af909f5c5b03257a4c10acf2b3

  • SHA1

    568715a6c61824328645aa7db88418c6c9964b02

  • SHA256

    1f59a3106bd65fdbb4c3bcf697cd993e930ba45cba217363852b97e5aa8af864

  • SHA512

    c56b621f353743add9d423154379ab532a34fc7c8579bb0887279efac03d866fe9c1aadbfa0e5315cb35d5b15a28841a4135aea99a4cee1a790e92f9837aeff5

  • SSDEEP

    196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoWlY:dYXpkG6uDBuQjmrOHV

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 7 IoCs
  • XMRig Miner payload 7 IoCs
  • Drops desktop.ini file(s) 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_fd9a14af909f5c5b03257a4c10acf2b3_cobalt-strike_cobaltstrike_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_fd9a14af909f5c5b03257a4c10acf2b3_cobalt-strike_cobaltstrike_xmrig.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll.exe

    Filesize

    11.0MB

    MD5

    cb021db3940b31f020033cb859d0111e

    SHA1

    1aed0de71fe6f171c520aa15da7e88cb699cec3f

    SHA256

    c8ee84330e462a981aa134d8f730ed3b4eb4c94db8c32be874067a03db038dc5

    SHA512

    bb31e5b4446f7594da34c41897b0e86c7372baf8365783714910ea140cb37276ec6a0424a14336735314a28c5b1956ed2a79468a100a59b8e941bc98424c9bae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    13c6cc78be2e1c7d84a67d0397b7015e

    SHA1

    eac7cf7a42b4651d6ade3e8bad427c26ca891863

    SHA256

    5f33c896beada1b5f6c391f557fd792d491f41f4c96d7eac54d5d7d7c31f4169

    SHA512

    1ad26695ec570dd21ffeff1218a33a1d47bd34175fb3b0a984a8caa1302e91f960f60013ae3758665e343b8557ae5f16fd90ba300ae9c44cc9310331df3168a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e364cd6e9ddc2bed0eb57ebcfb32e1b2

    SHA1

    be62a309c3275162b56d3936a05197234fbee86b

    SHA256

    723c09bfe531e22a411aa23a96256010d26c3fee53775d48bbea97951e03b1e0

    SHA512

    dc720bfa5845b282a19025ffcb2fca47cdc4d9451aef5f8fc32be02915168a2ba186b1658c112ff1c8889219a02382fba1f841f481c9b4909c8be3d7ff17097d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    522dff5ea36ad7f2498b6eae24ea94dd

    SHA1

    4015ca1c9db02cd29bee49ab0bf2214b2b49cd5d

    SHA256

    454d20029ed6691aee10d40481cbd2c8b0d7abb8ef80dea86d683cbe0f81e26f

    SHA512

    3bdaef29bea18a6520c4572021de11432f2130bb5b81219e5b2edaf444d1f580e79b8f91e3ac25806df9e6c4a8e7d10125f463d602249ab04588fdfbe7cf72ab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a32b2b007a9c869761d30afa936e9e28

    SHA1

    5f8a5d86d0bdc5e6e93d068a3d7e3e565157fa1e

    SHA256

    d51c84094dc73f0c4e8c32180c63a3a24413bea7f0bb20cf42225d89ebbda1fa

    SHA512

    093e32c4b7f986e25b0e3a2ef9474794d4a7643462f63b144d66dc985c4a6e2733498dc36ff405e7c27014d728994a8447a1f85422c2447ddf1afb3d3d876710

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9997b2658f2151befdb426b26c927dda

    SHA1

    e1c1c7bdd2f7efe7fbd131f2047e6d1a9b1e6887

    SHA256

    53d3ab22bba1be6337da7b0965740e58d97c595e684cbd610cc8a4f8c76f5bf0

    SHA512

    2288478c962a22f4a11ce4c8874151a723f1b1e1d04af4a4deb9cbd0bc7469a4a21ac03e1c2cf22ddb662ce8379d38f2e435b358da6d53956985be2aa9a87b33

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2c5e066f0eb90ff0682f2fbb22cf4fc5

    SHA1

    724ec0cd13dd95a0edd364751f3941f38bb26dff

    SHA256

    494c19490a1b35e09e6d170f3f1a5e9024037e20c17493a0eab92d5865450a86

    SHA512

    a44cf85d6b8a7d2b54c719e9758cf8eeeae730d4c9dd82f0eb03cf9bde200bdb897e2c5a44c30e2d9553ad166855b48a23902942d95a53494949c52b303b4f25

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3ab9ccc92adefdcf95406bf3e8824f3b

    SHA1

    b277a1bc1f1ee1bad6165fc9b165c116b4c06855

    SHA256

    b204b0f342a38bd440b3499a49fb80e33d41907e4bf5dcf3a1d457c6ac6bdd12

    SHA512

    387f944bea561ab18e16b80e5390124668941f0ec505f6ac50521b907d19e173c1dc2a10848266b7cc0c464c460356470685423f7567e1ebd08a2a88e75acc49

  • C:\Users\Admin\AppData\Local\Temp\Cab1E1F.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Cab1EFC.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar1E1E.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\Tar1F2F.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2808-1201-0x000007FEFF5D0000-0x000007FEFF6A7000-memory.dmp

    Filesize

    860KB

  • memory/2808-3067-0x00000000002F0000-0x0000000000330000-memory.dmp

    Filesize

    256KB

  • memory/2808-1062-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2808-0-0x00000000002E0000-0x00000000002F0000-memory.dmp

    Filesize

    64KB

  • memory/2808-1804-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2808-2581-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2808-2783-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2808-3045-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2808-3063-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2808-3064-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2808-3065-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2808-278-0x000007FEFF5D0000-0x000007FEFF6A7000-memory.dmp

    Filesize

    860KB

  • memory/2808-3069-0x0000000000330000-0x0000000000340000-memory.dmp

    Filesize

    64KB

  • memory/2808-3070-0x0000000000340000-0x0000000000350000-memory.dmp

    Filesize

    64KB

  • memory/2808-3071-0x0000000000350000-0x0000000000360000-memory.dmp

    Filesize

    64KB

  • memory/2808-3072-0x0000000000360000-0x0000000000382000-memory.dmp

    Filesize

    136KB

  • memory/2808-3073-0x00000000003B0000-0x00000000003F0000-memory.dmp

    Filesize

    256KB

  • memory/2808-3074-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/2808-3075-0x00000000056B0000-0x00000000056B1000-memory.dmp

    Filesize

    4KB

  • memory/2808-3078-0x0000000000401000-0x0000000000A18000-memory.dmp

    Filesize

    6.1MB

  • memory/2808-3077-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB