Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
29/05/2024, 18:58
General
-
Target
2024-05-29_3db46275b9a4fef941af7cb6b33b0085_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
3db46275b9a4fef941af7cb6b33b0085
-
SHA1
41d7721f5305f2eafa8c67307bea5d8d17877fa0
-
SHA256
f07ce5018cb27bb111a7d4bac222009531b21012a45858e4e1c452f636fbbe18
-
SHA512
fac8362c8fb990d4b8080d442331e9db2c0b1757edd84c24bee5c3fcee177ff901411e9124be519f01b524832bc85f17d05347a42de81cb5b4811864f7b926d8
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU0:Q+856utgpPF8u/70
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_3db46275b9a4fef941af7cb6b33b0085_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_3db46275b9a4fef941af7cb6b33b0085_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\SkkIHue.exeC:\Windows\System\SkkIHue.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DpSqTuj.exeC:\Windows\System\DpSqTuj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hnWOTZS.exeC:\Windows\System\hnWOTZS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TNWXjeW.exeC:\Windows\System\TNWXjeW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oIXNpHG.exeC:\Windows\System\oIXNpHG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZsFFAcK.exeC:\Windows\System\ZsFFAcK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qDLSGxx.exeC:\Windows\System\qDLSGxx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yAiRlWY.exeC:\Windows\System\yAiRlWY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\liQkPTc.exeC:\Windows\System\liQkPTc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ExXddjp.exeC:\Windows\System\ExXddjp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uQYTtrt.exeC:\Windows\System\uQYTtrt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OBMUeiM.exeC:\Windows\System\OBMUeiM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aAnlkky.exeC:\Windows\System\aAnlkky.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gNiYPxu.exeC:\Windows\System\gNiYPxu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dVwNNTU.exeC:\Windows\System\dVwNNTU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HbYQkLv.exeC:\Windows\System\HbYQkLv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YZTKkEm.exeC:\Windows\System\YZTKkEm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bPhUmUx.exeC:\Windows\System\bPhUmUx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SMOThGY.exeC:\Windows\System\SMOThGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LVHFqoy.exeC:\Windows\System\LVHFqoy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMIiWHB.exeC:\Windows\System\PMIiWHB.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5e03b59f2c6f4acee5b9f24f1831525f6
SHA1e8350937b027765fb89844cb53c182cef1240dbd
SHA25641351afe2a743913355b4be6d8d410654871407b962d2cd8c027d8c7ce13c4f9
SHA51232f2ee93bf1e8bec4ad6c1a838a150dd50d092e3af55f293526889943838029a88b9c2f2f1191a8d5867199551ab041c4d2c7f0c9011702bf23b40b7af2f86bb
-
Filesize
5.9MB
MD568c65478bacdcffad925316fb1ab6ae1
SHA1d2d6bf7ff0c6d29852b368c0a7b4e120b6de6a19
SHA256e501afa36695258d90cc792da1e94af005fccbd43e4a9b41c094740e39e45012
SHA512df622500b87cdc6b6fa0625c8814a1556640ea0e058bede6ba834a7414ebebdbdbf4bae6c6c3c39708929f98469329d64252bc50509bc223ecd9dd6c67faaba8
-
Filesize
5.9MB
MD5677b4fce662032867f5e327b61af5453
SHA18194296bd6ef205f4b600cb6c03bbb062055df04
SHA256e6cbe70bdf2f1d0ff93cbac952d080601c55476f8738f4b0cda8b2e9312aeb9f
SHA5127e9a589ca941f8f1f670d5bfe5f07fa61f322fd69f4ab9131c1b9bc045d20729679d215cef150ff13005e471481d387d34e811e63f03a40672e2be3634aabfe1
-
Filesize
5.9MB
MD5017152c4b391bbf80365452dd0d40bdc
SHA1b2e576ab024ef216913385f3cca5d84da0d100e5
SHA2564c6c980dc7bc8919031f9ec87a64a9ffb49e1f9a8617f1c0a86b311d471efe28
SHA512a9e6718817747cb39bc65252f4e4fdae820610dab0bdc5213db1d486858963592c05d744f2097781ae106922c2f1ad4ef853ed11b3e9c2a245fa6d1a4a011fa9
-
Filesize
5.9MB
MD5639da5cf1e91fd217cdfe1ae276d173a
SHA1bd68eac24f959f5caf5177e4bdf6f493a95a4f74
SHA2563d2c4203f7f049bb5f25de38c97e30ad9c9af869ab15e9f3d3e8682f63266e72
SHA5122611629fb34c373c36768f8768bea2b36d519bc054913d15a10730c13c8d13a29b616568086454e6f442a825a0d9f364f9c7e16ff9d97c0a26ef3921220e3f2f
-
Filesize
5.9MB
MD5f86b58edba562822d7b2bda05b41af8f
SHA1ad13ccb3d085b574ce7fc88a3201778c7c169a03
SHA2564567da3917dc952ff0c4694b6b6d09c0048c5fb0315a15b3cd6cbb1b99e1e1e8
SHA51223ae011ef7697198df2e1eefafc3024f1279b3b81a81afda95545733485273d19b9b8d2acf62ce15dd60682b0e291af00af9d398e0c52f5b40fe1abee2bdb2fb
-
Filesize
5.9MB
MD5412715d6b9358eced01584411595d301
SHA1fec8282e008a25d64b24486e22d0c98c2de40129
SHA256a1eb87de3b4eb2e3289e70c96bf453fee37c52f24c992fde1297e288e4512359
SHA512a6035bff9c0bf3eb3e1def3bf36aa6c789860ddb8d96eb1a2ea66218b0587906e93c9b6cadbd168f843183bc4f40d50ee6ba5ec7759c3791a12bcad06a22a528
-
Filesize
5.9MB
MD5aeb6d0cd549f95e1458f3e5b7c6cc6c0
SHA16f8bb297283e37ce16533a25c7f25a893b894f5a
SHA25676daeedb71885afc0c4ae1318adca00cff6500f74d9798ba7fcd9c4b56d83306
SHA512bbe1defa8373efb36d8822a756e17ccefe6b08b8d242cc5999b93afb3de6248b7dbdf685cd293ea0f15989482a8fa35ad6c22da5cf905060ee1502d7a20163d3
-
Filesize
5.9MB
MD554312fcdef3d3431ebd9fc4dfb4d8f31
SHA172a333bafbb376032ba21ecd7252cd1c1c5b0a29
SHA256b1563e49ba05b052915d8d7f486b170693bb60dd2fa7c4a0ff483a9db0e67de8
SHA512c4b41d420d7287d857b8b69ce5bd3312e05fe9fd5c02e5c2398bb224cbf7e960bf810ad95704ada919aaf16abbaa7c1b88d861015745950ecaa83849c44ab2a8
-
Filesize
5.9MB
MD58082cff59e452dfd128dfdc874639535
SHA10d6811f2291a0dc91b7303a7f51e54b71cea0fb6
SHA256d05eb03bc46021d4debb21bfb236c34b9e142b15da1c6f1c6ea0ba54e673de89
SHA512892ab949adc371b9d262d180ddcd394271485ccf9a298419bafbbb192193df0eb6ad1a0f0d95e9a7ebb419d239781bdc50fc4604526831cdab14f9e2ffe7c50f
-
Filesize
5.9MB
MD599814e140931e9f636f1b5c14cfb09b0
SHA1a1763171a248569bade578ac0192bf017dfeb59a
SHA2561a35bd095bc46caf00862f5b6025abb4fdd501052ad8bf3db21c9b07c3c1a408
SHA51257d44f83f4ec8f406317f32d4ef14111925d13836ac4212334538bddddb1070d6b580d32ff7fc0b5c7d921d8e3d8cd71910b40617d22e39213f4ed9c12b4235f
-
Filesize
5.9MB
MD5355a6582a4d7261670f73c3721d07b07
SHA1c56b4ebc4153b046992e2574d73e3e9e7430e343
SHA256cc6e10cab601f487d23df6aa253dae2068201b231e47a5edf8df0b2c69c44ebb
SHA512c612001d54885e3294ba915101751f48e6498041713f56b5472df3646119584f2c81e4483ca69604d26effc59b67e3de66159ce7e7eb2db1a610a61bc0eede3e
-
Filesize
5.9MB
MD5b160c7416da4d2431d2e0f3ceb7a3b47
SHA13c0456089791c8e6ca5d31a44a89baa754280779
SHA256784a8e19a7862d846089a94e2f4993ce30eace00faffd33ed8448b9733b464f7
SHA5120710fe3cdd8ab3e29d024c65dbbcbd2860575270dfb144f27702333c234e30082ffe93219ac677977e387e3c17243f4bf888d15880969019161b0a55a57ac074
-
Filesize
5.9MB
MD585682d041b7e3a5589947cc76ba809a1
SHA147d5b2782c6b7d3fc92abc6c71757c5a332206e9
SHA256fa9000152dc092ac0380328642a3aa1377b56d3e69b62b2692571393ca867c4f
SHA512bb8a848317ad28db43f296f47c839c82cfd6a3aac0e71d2db7225ede9ade1ed7d9790a467c811168ff0e4d8eb0617ecd3cd3af43966501812ab96167281aef33
-
Filesize
5.9MB
MD5c4c314c5f0f5996b483c7b6d6b7e87ae
SHA1f5843b6cdbf205e5073ff3a4c482a0b7b5d33dfe
SHA256d8165d0568c9389cf8bb94ca177b8fadd17a8afd755e8caf9f2a36c1a38e300c
SHA5123855e7147b9d9c896b1c8c4c7b209f163868e27ebb423b4661894693e506b2706d05927aea7bafdcb21db5cea3cb1479ea20ee9a10204b6300583537eb54ccee
-
Filesize
5.9MB
MD52485f6f100c7f99189c78468ded57a1b
SHA1c9b3f97a052bc8d2acd10d5854017f5054032d5e
SHA25603ce4e2ed92657b6eb87cd69873376c929d9bc755c5ca37852b98de3d4a76602
SHA512c23bfd516298306b8706081e0d003599fde248900c9c866cee0529e1b1e81ca531066d0b7b2c10a971cb0e2b28d0f010e8e3a2597020470d0c6af5475e9b333f
-
Filesize
5.9MB
MD539f36a7deff2f9d6634c08404cdbce29
SHA19633b5944996c6dd240a92ad69966396528a9738
SHA2560e6ff3fb98b95dc1e2340b97e6c05ac65cdb5ca4aa03e68782f7847addff346d
SHA512d9e2a042e26474a3a3c642352e0eb1175432330971785d018fa3a1417242188b9e794f990358a6ebbc8dca7c227582c7227891891ec0aac03432e2007ac9526f
-
Filesize
5.9MB
MD5db6dea469a4dd0e2289ee9e9d4cf3786
SHA1a1109420441b44cbf66cdef8cfbc36fa0ebc38c6
SHA256a23a7ce0a79f604b9d49f54f592162898482cef978eb5a073742344753e6aa90
SHA51236e335ab7caaf61aa7f3c7ae80d070a557631be65219e792130ba7a2d8dac82139180190a664e06e8648182dd3ac07b200e9426ff12ef0afc746cc562b63e15f
-
Filesize
5.9MB
MD5eb38893d6f5828dfaf21f6f7915f6dc8
SHA1de75a032df19249752f2e33e53eca54be163913d
SHA256ed52c4a73b386a05460f1c2f90ef067987e5aedf81642979f366e88d9aac5c50
SHA51246a388d66a67471eae3e388d2ca04dec372a583ad3e8ff323c1d2b2805f736ce0622618ddd6ca7eafcc3e22b33cec109bc971644d623658c46874fc6f53770de
-
Filesize
5.9MB
MD52a01e283eea9ba80fed7b65ec4d512b9
SHA16d500c316c32c381be70335f5ab56d41759f617a
SHA256e92325865895209a22d69bf1c86ebe33bab24faf9fd4bae1d833bb03f3d40807
SHA51232820eb0691f998dff109200db407c28d270b1a2740e18deb925c83e7530681e2abc3f92b53e2fae3e3864faf873abdf419ac192d0c4b6b4ddb5b4e56eb07597
-
Filesize
5.9MB
MD5ad5d68e5efab17b3e6e1d0e342c57745
SHA1de07616a72748016331e9cfe3891e2c868c724ae
SHA2565ca57962681bc423f0046cfca55bcf0f0d9838b5e29b6485236c60a19b4200ed
SHA5122458b4870756c67d1bb5a9c7b61e8ed6b8f067908a8eef1b0907af1f9455da657bafe4e58c1f32938e5901e051feadb04f32e7879cd3eed3ddf0af32d58799cb
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB