Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
29/05/2024, 18:51
General
-
Target
2024-05-29_1cea6ebf5e3a8e136678bb226b1647a8_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
1cea6ebf5e3a8e136678bb226b1647a8
-
SHA1
bf3cc73f6cd6b54350900a0c50138aff7dfa4477
-
SHA256
e2dbe162f976ca89c96f2d8de7229418e6842e8459522b0dcfc8f995fc06ecd7
-
SHA512
804aadd5878b399a3aecc496f741dbfdf9b01dfe6369b750f691178bfa0e4e44e29669d101ad7b256cd1d93819d5c6e4b831e3df66d070fa2b323091cb08e1ab
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUL:Q+856utgpPF8u/7L
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_1cea6ebf5e3a8e136678bb226b1647a8_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_1cea6ebf5e3a8e136678bb226b1647a8_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xmUNewP.exeC:\Windows\System\xmUNewP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZyBavie.exeC:\Windows\System\ZyBavie.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JFuPMpg.exeC:\Windows\System\JFuPMpg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MHgiVDT.exeC:\Windows\System\MHgiVDT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NfrRSTw.exeC:\Windows\System\NfrRSTw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mTwEJpT.exeC:\Windows\System\mTwEJpT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pstiRlY.exeC:\Windows\System\pstiRlY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPMtAWA.exeC:\Windows\System\IPMtAWA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HZLmpbE.exeC:\Windows\System\HZLmpbE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LAfwGQj.exeC:\Windows\System\LAfwGQj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CxdRHrt.exeC:\Windows\System\CxdRHrt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QuZvFGd.exeC:\Windows\System\QuZvFGd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iqXbaUp.exeC:\Windows\System\iqXbaUp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tsrtsqo.exeC:\Windows\System\tsrtsqo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hhpSEwh.exeC:\Windows\System\hhpSEwh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OfiywxL.exeC:\Windows\System\OfiywxL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lxTmgrA.exeC:\Windows\System\lxTmgrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eweMbQC.exeC:\Windows\System\eweMbQC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHnPCMx.exeC:\Windows\System\dHnPCMx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xIqCzME.exeC:\Windows\System\xIqCzME.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yYKESHQ.exeC:\Windows\System\yYKESHQ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5aa724380880cfde17de930c99d834d27
SHA150d6f4cba1e91b75e38636d01a218ec8b1fb17f8
SHA2569de9451f13b622e23df9b09868dc84396197b9244c54b388cb5c699b08043b26
SHA512d33e998af9f31f9314e81a3b5874ba2dd4820c2e14fee0ada0f96142c2508f85db500d3e39e9055c1bd0ac78376518fc9a294739053a6a1b463842ccf37de70f
-
Filesize
5.9MB
MD5ccdc1479eee9db2641aecb08a8ac6103
SHA17db95408e786068848025134a80449de4b5321eb
SHA25647b4d859c90df73cbe6895ec98a1943862a317ff1f4d02802272abea610b7f06
SHA512e05aef2495b15d3b50e9f73db64425eadcab8c9a9ca3f9157658e95db7c20223a403301ab58e1823117b61293b6a8c86fb21b55dd0b34ecc341300d2887f625a
-
Filesize
5.9MB
MD50df539245e15e6e812680069d2974967
SHA14485629c14575bba5f84558031aa8bc8a400447d
SHA256a9b40f7dc178d231ebaf41064b7ea4dbc4e205c02e8960962476b1f09acc6954
SHA5124aecc9791430aeab8ae87502ead662f9e5dd079beca9a758a1425f41e8f1b08a8430fc4361776a0495245faa51d953454de2df90621c872886dbff1dbfdad995
-
Filesize
5.9MB
MD5bff3f28efc2895b3f2c75cd5ccc64c5f
SHA167a94ff5e46b2c288d39416de4e482aaa904162c
SHA2562949429fee6e797ba7e04e4ca72c726f36f9d9e55d1ed79050ac0d2fce01d771
SHA512ae6c56d940ed3f498da1f0802c9fb35c6a91b03843e6fdff11cdde04e52d4dc84bc146c88ab40dc2b1beaf5ef34d610a486da86f21462c7dd70cff20acbbc965
-
Filesize
5.9MB
MD59f609991161cde7ce1c89e659fb85334
SHA17645a294b20c8d50c06c2228cb2ac31510cdb91e
SHA256c0c893c19db075ecf1b45c29395bbf657a2e609e9c21c7678110e57adb22c913
SHA512075d46ca6419772c0c2a5543a5a7df7724ba558158e230656a32b4968e7ff9b0646e67b23dd6e06eff7b1f3f6354594dd8f5704652b6e0c09a12d62eedc19db2
-
Filesize
5.9MB
MD5dbc3d1367baf7106d5ae0a5ef0117ed9
SHA1270a721fba4624451e877389acfaa9ce525bf9ec
SHA256576c7be7edcd11e214aaf3100e7893d28b20d4815390768857532cf38f39d9d4
SHA5123f4a3263d787ae50e67d74aee92fc9d4991a7fbcdb05c8570d135bff2b991bb2445047f5dbf053fa5194ef2194f2adf515ecce41203f8725a87fd82294c6473f
-
Filesize
5.9MB
MD591af4d364587aed9d677d920f4a0b0f4
SHA117dbdbe5a3fd7bfe1f6b10aa5555cf6070a30801
SHA25671f8bc0620ad31c78822d7d7dff7860ed779bb6075c788a4f65b1efc1992465a
SHA5126698fd136e1a3ba99646af62f3da51f5d77cd232d9407ef1ad02801379956f593386de1812f4b42d3bda05095590b28e1bed952fbc78dc36a65c60985e6b7d08
-
Filesize
5.9MB
MD512240e4829f0eff80fb9713a44a179b4
SHA19339c51d950f8b8a85cf4b982f512018720ede98
SHA2565472731d776fd212e2ac4b39c1c8779c6bb9afe2a3742797a828ca4048309a31
SHA512cfafb84b438765ca7c675c6f9793f674ea90f7e60f1da99b50c36f48254482b3a04b0719461556817c4feb203d8a4cce6dcd8425a4a2c22a2c810de8f6856dfd
-
Filesize
5.9MB
MD58af2107a893cc633a1faebe4da2508a6
SHA1e0f85df753f104921a01bc63248e2571257206b9
SHA256727a29c6766260dd341917c9735f6d98bbe4a45eb2fa05b7f1926aea8a729007
SHA512d22f045b8a95c0b77afcb8b6e7b0fb22fce7180328fd745c923130f97631a48b215abb57eb9373be0b22d8f2387f39d5188f060b1d1291fbac8d21778fbc7fb8
-
Filesize
5.9MB
MD5811b9904d20ffa6e6ed02db4830551ff
SHA1bfa212789be931d1b2d95a1691839f9cd46a0637
SHA2560e16eabd02ac80698d972f11779a4edb7bdec9c8f0a0c8f8d926dc52536b4490
SHA512737d2b993d96a53c2629e112abbd5ba69136e9ad9bb18881fb9604dd8dd57650853b671475575e752b301161acc4acc2344024d2fddaf2fd6666e17172c7c50c
-
Filesize
5.9MB
MD59c5ed81726a81b0dc8df559a05ab7eb4
SHA1796e749a2c7285330cfb5d2b5a8e3604eaa228b4
SHA25631e28f6426ec2a2124d54bd8f84b86cafd2802e301db9346965a05e10777442a
SHA51228f1ae765b473572df04be52dc8c481f71a2ba0a9d9cfc509350a0ef8b273d75d9641ea5ec920f9646496f8e8b231150c5df1ae66881400346079f1bf0bcf5de
-
Filesize
5.9MB
MD57d22c4982183a7b94e9eacd73435f907
SHA19d348f47f96ddaba160ee7fd52d726ff3be22386
SHA2560ea90381fcaef0c3116825d2ab65d7e8c5c5aac19955a8ae6bd517c8051c6829
SHA5126e6418cb587337dd681eec2532da947d772ae769d1cb9305e3fb9753f46f270e2854086d3d372f9f0c9c3822f0efde686db9bb6fbccd2c703db7f9641c053273
-
Filesize
5.9MB
MD54040f2866ab6bb301cbe904ec7156c0e
SHA1987636441c8be3bee980a15a524f4fb9c4acb9da
SHA2567d86c9d1ffffeb50a5a4940513c06c141e4da1dd1978517e908f8ecc74173d55
SHA512c9c712abefb32f9af0b75b921f68bacb730f1940023e1c363f2c3a49ff3badfcd8b830f82321bfd9232b3cf7465a7c0c2316b4b8a36a8b652394647b55f4629d
-
Filesize
5.9MB
MD5bf4a56050c00a5f7b4bf410fe14a45de
SHA1ef0100e0f1c5b4f35c0b0f5075f69124ee9d1a80
SHA2562787d3923441555a05df7503078309a0788c06c821fdeead08e3296db42042b4
SHA5126cd36a8ab28ffdccdc576304792f765d0f1f60b70ea3ac6e538427a726844b41ce7d2e1aef685392ef391fc21cda7cf4a72646689a5ba9c5a5e669d06acea923
-
Filesize
5.9MB
MD57ee7c41aa732b1989dc7e93d26958be7
SHA153dfa6d62831d9e72edfc07f0609129436f133e7
SHA2567bb4581e6a8b04516a98b65794182bbe05fb0460fecdaf8a2b4e07a223261fbb
SHA512e2a14b4e04bf49d1597f15658c656d7dfe593cb3ed9d28fc9d3089b1ea25709b5b7e4cf54e02c3faa84d9617820f70193a9666f1c3f64791d2ac435dba5d60e2
-
Filesize
5.9MB
MD5254c0dce71371372e9f47ca19ce74b2b
SHA1ea3ecfe7f3fb852701bde4cb6cd457c1c6964ec5
SHA256356baa5178ec613206d5a8861f84438f0a7abfd072ec808f6b133de7822f16e9
SHA51227afbdceabdf6f63414f602dc0c94cd718b76b8b1b7d5123c1b60d4c4bf14ab3ee30e4afe09489122e2dc6c490159c21dee64d7d79aa0b0ea7d59e708adcfefa
-
Filesize
5.9MB
MD5377ce2ac1f9dd5ad46bdf862a1ac2ae8
SHA1e9146d9e7296833f259f89070a316193dd01cf32
SHA25688761c989558810a24513146165a24ebd1f1c539c01fc02622495db0c2546862
SHA51213b8fac27068f29df2dae354583d0719b131774b6c524cc735f46a168210b93a59724e53a88ae5be967ece8d20319b21fa5d584e6fbc0a40ba16dbbe5b7558d3
-
Filesize
5.9MB
MD5332232af70414ac21b0533bf790f9fc6
SHA11ae966586b7b91d7f864acbd1f9f0a2c67c4ec1c
SHA256184add0a6ff4cba97eff621a6f8d06afc89f4f9daf6acbc8f7c1851e85275d67
SHA51229a16b8f41a914b45b1bed5f941d89314407a9e86e14c2356e36a8b1f2ab0def3cbe45cac8640a04481558d0b3fea6d07fb283d66f72a17c1f3918f29a1a1755
-
Filesize
5.9MB
MD55bdea3724d9434ebef9664de230d5958
SHA142ec14f9f40a55c2f3c5f67ca60dc6e6587901af
SHA256860f899b5d67dbbc4d7cd992d11d07879669176f2633c9a72c7f76e8cfdd8189
SHA5120b447b38bfbdc0690e2ed247f20d8a9f7dcf6d6fc8d36fb974acb923fcade6e3709a10a168f9298b255d93092bd5cd19124058a151ae40dab780d401923f4bc9
-
Filesize
5.9MB
MD5f86fa893d1b45d611b03efe0813bb4f6
SHA1deede9cc3dfb2c6619ba87e4f81acc4ce4e2fe41
SHA25613ef3e34f8abddf01ceff74584ae34c3a902c550d23aeb67a3e229e8338ffd34
SHA51253287df404588e2d3ea17e49d814edd4f7c88d3316b5550bae627eae2ee08d8527cc62502fab4cde3cbcbb0a2bab57dc4573c162b849c6e1137ba885f7c22cd8
-
Filesize
5.9MB
MD58dae660a33af954cb444b9af9a83c35b
SHA1739b0c4bbfcfe8514edcf3d136673ed1054da9d5
SHA256df524b43a3d13b32e122e63d483bb9316f7f3f4a02009c6fb6c1151a23314ca9
SHA5128d513995f406b19857c28f1e72902815f2a83e25a4d1b11eee508d3eb5f6be77e98c694263f0d21ca9f238ff0572c39fc53e72a20563c30239f32d1b4d1072cb
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB