Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 16:06

General

  • Target

    2024-05-29_4ea8f3a654fd35f246a77a75ffc77b4c_cobalt-strike_cobaltstrike_xmrig.exe

  • Size

    11.1MB

  • MD5

    4ea8f3a654fd35f246a77a75ffc77b4c

  • SHA1

    937a4293e32dbb529ef8dbd8a16480b95915d90c

  • SHA256

    b2c8ccd201b4f6e1e858ce60af89bb507b9cd487edcfa411f31f081409924e2a

  • SHA512

    1085aad73ea4c088d58f2412e5f6e02b08444f886c08026d6ae5dbede0db1f988624952447a196292bbb9145e89a6d5d507304c210656d10ba8b58c863a42093

  • SSDEEP

    196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoW3Y:dYXpkG6uDBuQjmrOHX

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 9 IoCs
  • XMRig Miner payload 9 IoCs
  • Drops desktop.ini file(s) 8 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 7 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_4ea8f3a654fd35f246a77a75ffc77b4c_cobalt-strike_cobaltstrike_xmrig.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_4ea8f3a654fd35f246a77a75ffc77b4c_cobalt-strike_cobaltstrike_xmrig.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll.exe

    Filesize

    11.4MB

    MD5

    c7787e118f65cc0a4f57229e95e8f5bf

    SHA1

    8d017cb5eeda0e1a4347a03d31f5ee72130097c2

    SHA256

    6d8a10dd5e04bde4b192c920149e9c8ad5b483f18eab46f51a5c4f466be944cf

    SHA512

    356d23e55ec1bae76ee68d76b9d3d9f2680722534425e9245b48fff933863ea2213d33d0661116b72d45b8ad1012616a306d35ea88ebafc48b8b0dec5ffea4bf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    fcf3d5068dfe79f23f91ec45a7b87491

    SHA1

    93443357777e2878bd7f6d4fe3dd5b6621b4d20f

    SHA256

    b29e70eefbc3fda3ead1a27fb5488cbc4cb3bd78f8cabb4ffbf9bcf1a956ce78

    SHA512

    5dd5423c2fa12f03e21f127651f54c038a766c44026280856f82fcf3f8be84d3480c3583cccbe0c276b28088cb4648448026a832b662402bfbc9858a97926005

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    928468fbfe116cc1aa06d41ee6650146

    SHA1

    0b8c58b1617a6ad049d6ece222f9b9a91576f8c1

    SHA256

    5b4cc203c4b022d596b7a09dcc044b03739165d4ef4ec4f87c6e4f7979fcb9de

    SHA512

    85a1adb6a9ce06240607bb03533979f2c8491852c3d95b7688749c4e0c1d214763332baf7f87fdbba47cd62781716da0989a9416729a36a3d5878386f2d7e14b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7c5bf581104c336acfc674bd321bb3f1

    SHA1

    88349308b4d92b425a3ff0d898cbb41c5378f4b7

    SHA256

    2719f428bad6a34affd9cdeb04f35135286b263229e6ec1089d6d562d85be7cd

    SHA512

    c06d9b73b5f9ff0f8b5b15ff508a76e265e4e3b59ce2586e19e98a3028f7b758fb2f07b5e3fd818f3050b2ecc8b0c28e6b95114104a32e288ec9ce1341246c36

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dacc4decf4720a1dd1ec29fe7176d009

    SHA1

    0c7db5c11c7cdae098d9acfcb9b037964c415473

    SHA256

    b7a2bcceb516ffe3837ce0e72ee19e6ad0def6024bd57b770c135564bc93fb12

    SHA512

    dfd30f76e9b1d7ae83c12d64f0f6b2e273d1b7989b565edec039b818b09d4457726675c8eaf00c5c8551f7a3ef53d515765336e4cc183eb7b44983b4149467a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4d392ee77e6aa081b99b56a79429cd2f

    SHA1

    8faad12400d7f798b70727ebe26149f25fead790

    SHA256

    7e08853b80a78b8ea612a10d2ce4f49b3d84536e636b2d6b7113d003cb4eb225

    SHA512

    6e1bc3ff8760f9a45698e601a493dc110198b0cf2594e55d05abb6327459abd25ee53938ac6fd1f474676ba4ba0ec89bc1b1a6725081be4995d5f0ae1fda4f87

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    59ca42122eaefe7aab980f608f5fa027

    SHA1

    e0209614a69eef940fa74ddb8b14ba020fb3a7bd

    SHA256

    c46f38222fc2be411c98faaef85ce4dd4acafb58be70351203f7c80413bc9bf3

    SHA512

    806daa683406ee596501b7aa42d543a213e81658b2fa523f39afc3929e250cc8972b055b8dca7e515888921d5aeb7007bac3cf88edd16b3a0c5596c0f3e0f5aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    90590ba896bf6128e3fdd6f79a9cb8f1

    SHA1

    ae4173d12715ac1cdcccd0b9704ee9f162fe12b0

    SHA256

    f35bfed5dea30bd6d31adb26f92eb3a0ec27a65d0aac0f3169c58eae5e06a131

    SHA512

    e3c205219a91dd6c445990761ad8fb360b585bf96afef5cd705c1d22882cf5d739310660e8939d43897753c8f2132de9277f79f8940ff12e5fc7aa03ad9311da

  • C:\Users\Admin\AppData\Local\Temp\Cab204F.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Cab216D.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar2090.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\Tar217E.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2876-840-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2876-0-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/2876-1560-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2876-2144-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2876-2390-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2876-2508-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2876-2522-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2876-2523-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2876-2524-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2876-2525-0x00000000002E0000-0x00000000002F0000-memory.dmp

    Filesize

    64KB

  • memory/2876-2526-0x00000000002F0000-0x00000000003F0000-memory.dmp

    Filesize

    1024KB

  • memory/2876-2527-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2876-2528-0x00000000044C0000-0x00000000044C1000-memory.dmp

    Filesize

    4KB

  • memory/2876-2531-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB

  • memory/2876-2532-0x0000000000400000-0x00000000010B2000-memory.dmp

    Filesize

    12.7MB