Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 22:44

General

  • Target

    2024-05-29_44b96558fe90d7e3c1a8201bcfe0d585_cobalt-strike_cobaltstrike.exe

  • Size

    6.1MB

  • MD5

    44b96558fe90d7e3c1a8201bcfe0d585

  • SHA1

    115723a4f7e48b934f10cceb3bd64956ef378042

  • SHA256

    3f01646754d950e5cf3e901519365123608abb2a93e9bf24aced47b5df70852a

  • SHA512

    526f4bf9f347d3914f4a4439be7a82a82f0d2d15350be0fdff979505e6cd1f828e322ecd2e3828c0ca5bb6a5281a462d0743f8e37120a9c6b64ef49e5c4fcfea

  • SSDEEP

    98304:nVidQWbsgvS6gpSTWmjlKjAyljgkuF1fqL1enHzbpUg:ViXbrS6gIWoKFGkkiL0+g

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 8 IoCs
  • UPX dump on OEP (original entry point) 9 IoCs
  • XMRig Miner payload 7 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_44b96558fe90d7e3c1a8201bcfe0d585_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_44b96558fe90d7e3c1a8201bcfe0d585_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2872

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\Office64WW.msi.exe

    Filesize

    6.3MB

    MD5

    0fe7cd4f0e484ab214fd856beac3b3b0

    SHA1

    0facaaf94bb23c9626c3ec0ba5831577eeacb088

    SHA256

    69fc8d23c4461d421fe18b1b04b3e6573feddd20d5f5a235c9798ca5ba7b85f9

    SHA512

    4270c9e691bb3210cbe58b625038558cea60dd3128e9b9efe825d410125852b5d2ba4a3a063b0e5e411b9365be917281c28d5a53ad0ae94428c66f4afae7c13e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    7299ce4d57ea150c270362b044214343

    SHA1

    dd072f30cbb4abb8dcdcb19c0d82dac7883a9cc8

    SHA256

    7a69f20aee2b539931dc46d1b21b0747e8fa27a47e647f0ef1380ecac4ee0f55

    SHA512

    1eb0d7d0b6c9e64920e63f82da5c0ba1dca2dae5f47e0a62beaed8bbe00a1918e12756e26f6ace72d290cdc51a84a5b123f88e8e2fc0a95fec6e6d90a09e207b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    675af081fc5191b72a7fb7a46236becb

    SHA1

    90d1036a2db85445e3fe82fdd606a2cebcedf807

    SHA256

    9d9dd422bedc23250b351d93cbba1fcc59dad92c62300be83980b4c6177dcd61

    SHA512

    a6fb8146b03db1980c4c3921d57bcd993f87c036c023feb6c3b99b820676abdb71f332ecec082535242b37832e74ff36b118c773fdda6ed5e996265f55a51964

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1e29483d3cd9d12a9ee3dcb2436639eb

    SHA1

    5e45d7ff92ba58943eb3c9a701ef0ba99bb67e99

    SHA256

    827d18f2b8527b1b06f754e491a5abf729f9fb34a64fbc11688d25a28fb97234

    SHA512

    471d9cf8ee5e6370ce7adee1036b55d0939a34347546b9c8c0716918f25281eb75ea936f7a7f59db92cd7eedbf9df71ed7d778b9acc46fdc1a91cf6a4052dcac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5b309ca2051739fddd27f7ea1ac4b8b4

    SHA1

    93652710186f3da324779363798a8a83fce60b80

    SHA256

    20e125ddb8fc260cadf1297af6e382fd99c99d1234e664f169a5b6cb589dabe4

    SHA512

    fa56737d7997565d5a596e72f08c5eb657d7781ddc5234f65d84ecb71f6c5b6bdf80f691cf3bbfb310644803e915aaa6fb2616ba6f020d2b9ebff9fe5a3f87a2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d42b074303eba2b3c929c6d9455f0ad1

    SHA1

    68f70c1fffb28d31ac4a2323bf940b78a7d995f7

    SHA256

    fb40f439130fcf9bf9190170a1775ac987c6b3f0f6aa094d31bb39ad04204b41

    SHA512

    0e66e124240e71dca54da8ec9ad6241753cd9a74e8c2b2559dbef2dea3e0e9d44b91a2f99cf1a3a9c35a4b4dda05e28b3e7b49333d66b3790ac360361c04338c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    410e4dbfe7746131a17a3299a7a13ab3

    SHA1

    75b091c227ae16eb57e901bed44d4448a0ed0b4f

    SHA256

    127eb5a478e2682795f4bb2b24f8e1c77f73a4c1120ffa26faa99fcbba37202b

    SHA512

    957979f8e16853d06877c197803b0fbe9eed67c2a3f7151bec8f2b75818c185ec07271ac19a765a9dbebdd5ad4aa3aaadad1076b043763727ef8ae21ecd843ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b657fc826231269fe51f697a074fc1e8

    SHA1

    e799198f51b5a5b0b44eb7fd64925c38d3014ad6

    SHA256

    67d12b96ce0f4f8ea5440996105dd6c2c29640412b60e2c58ccc4b07bf5a0a3c

    SHA512

    e1d23af057aa7f34eb84ca93d768268a0353e1c62b2fb15115006538ea9cdbc5f66e35a664ab5ffbdc8b92f772c62fd444a14650576c3b387c2fc928141a3c62

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    98f635b39679a8f0dcaf9a7d522a8d9a

    SHA1

    44e164fd576badff507f162472a25e27264a628d

    SHA256

    371164cfbae7a89e7a1db3890125d71f8704789cacb42e2898eec0b556ccef27

    SHA512

    2359a9b645286a557c9daeb995a9ce0b91e74520934d19eb9e721049b907acd588a8f6303906c4b2c5ffced5ae294060bfccd7211f8f3a072aad65a8c3d98007

  • C:\Users\Admin\AppData\Local\Temp\Cab23D8.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar23DA.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\Tar24CB.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2872-4420-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2872-4582-0x00000000002F0000-0x0000000000330000-memory.dmp

    Filesize

    256KB

  • memory/2872-0-0x00000000002E0000-0x00000000002F0000-memory.dmp

    Filesize

    64KB

  • memory/2872-1930-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2872-3198-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2872-3798-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2872-863-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2872-1-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2872-4579-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2872-4580-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2872-4581-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2872-864-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2872-4583-0x0000000000330000-0x0000000000352000-memory.dmp

    Filesize

    136KB

  • memory/2872-4584-0x0000000000360000-0x0000000000370000-memory.dmp

    Filesize

    64KB

  • memory/2872-4585-0x0000000000370000-0x0000000000380000-memory.dmp

    Filesize

    64KB

  • memory/2872-4586-0x0000000000380000-0x0000000000390000-memory.dmp

    Filesize

    64KB

  • memory/2872-4587-0x00000000003B0000-0x00000000003F0000-memory.dmp

    Filesize

    256KB

  • memory/2872-4588-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/2872-4589-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2872-4590-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB

  • memory/2872-4591-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB