Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 19:07

General

  • Target

    2024-05-29_c36382c8a4ce3c050f4b36777d76181b_cobalt-strike_cobaltstrike.exe

  • Size

    4.7MB

  • MD5

    c36382c8a4ce3c050f4b36777d76181b

  • SHA1

    3311b1fb64d561240aec0448dcae9329bfa3f5bf

  • SHA256

    56f44c13fe7fe3d2015fc9f8c47325f629e97154bace250954e1ba94de606bac

  • SHA512

    67100fd54194b8fe3facb1778853c5befb4eeac5dc8fa056d77e891232a0c8b4c23a35b63634e2dce8c0f6fdcd80b95ec8e31d1cd633ea7d506dcaf5a2f037a0

  • SSDEEP

    98304:SW1qiPgxn+cuSuxx8Svt73qq36IdKtVxNw6pUkp3bkbRxLU2:53EnsxxDt73DdKrwapwbs2

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 8 IoCs
  • UPX dump on OEP (original entry point) 10 IoCs
  • XMRig Miner payload 10 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_c36382c8a4ce3c050f4b36777d76181b_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_c36382c8a4ce3c050f4b36777d76181b_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll.exe

    Filesize

    5.0MB

    MD5

    f274f601f7a024766d6b70b88f276732

    SHA1

    643012820e179e36c87f2fc88d0678d02404ed32

    SHA256

    62f5436529199962471eb5466369183d59e1a79dc33e1f1b2d0c7d5e71630591

    SHA512

    d547d461f32a7e91e2fd50e814018e5b41718c52f7a728a1d322250aaaa34fdad53e11953ee278bf6471b78d511047935bc9cf03ae07253453ce80c7f82ac08a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    57aa6e0268d0a307d0c115943d4e6806

    SHA1

    6c1e35a029a67541f4befc46d7d72905317eda2d

    SHA256

    bf2a8763b0b85828ed4e03db611ce192b065c99d764c68dc4da6d9071d063ce7

    SHA512

    e2b72c299c0c339d8ec34eb508988a70831818b94c33289b121d2d8886986f493c4825a099fb7933baa63eb8114b3eff7bed9f40084e6771a4f38b238180ec91

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3003976ce345cce654780a0a9aa029cf

    SHA1

    298bf11d6d3ab4885964d42a6451c98490bac59c

    SHA256

    f1a7b26f585bcc9fa98aa399c9bb82801ae6a3bdf88b43827ff000fca19aa198

    SHA512

    0a5eeb3cb8683eb553371e85ea66905025e50aeb17ca25f913ad2c3c2d5e027d41e8917f5e60b69aa45a933721eb20bc2d1d101b1e1ab7a7a255db44fd845b76

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    20f94b7818d8f9543dffae310789ffbb

    SHA1

    dd15f7f00aad3a3832f4b4a870a4b3653272b8be

    SHA256

    33f1f8f02e0a38d4629dd66293252af16f9a5f26c3401018571f8c4b29203a90

    SHA512

    18e1380efe47ebcbd0b8e91ba0d6fbc4bbb1df1b599655687c8f79abe5edd45fe5e949cc85fe828e8f4a36d10115d796468894ca0c4784ea8b6deb393aba2a08

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    48a93b542e8a233a9e549b858658f6a5

    SHA1

    372768f7724f9627e3d00bea8205d035c4484391

    SHA256

    4dd7bc7d0ac7c68bb6f9b49c233371d93c0099fe21fb22468560ef3eb276ff82

    SHA512

    50416845e17472b267b73eca21df877536843b56f412cb6a3a21912fce2f4b149382edbbf96598816be6437b9ddf42a1e61103970d78f284f877cf0281de0f4f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    49925f6744a7ab41db46fcab9a75320b

    SHA1

    96af69dd46861d9daec25bbb26fa1f4940cf6874

    SHA256

    2b276925849f424f718aaa453f70b45f466b1bac94ba9f07005931d0eb3110c9

    SHA512

    05d04981bd509e44fa0533fffec2fcf82b7f57339ce62525ee6d09dda60eecf9d68b1ff40e02b33455deadd95067c9f4d41d01c95274250a0df3f5c2d23a9407

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4a257ad25a0371e23f85debee178ec42

    SHA1

    e250a15d831e89723c90a4c1f863c09e0c1bc67c

    SHA256

    dd757f90debe71606d4126764dace771de72943ce0d8e13376502cd9e2c65aa6

    SHA512

    6db33a8c585c95be460a6d5afe39576e7bdba87aecb55add21fa899f381a2567b564277115a43786cb0cfa81430de45cb960b5a7a898560ccc5933a78ee3b0ed

  • C:\Users\Admin\AppData\Local\Temp\Cab172C.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Cab18A5.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar174C.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\Tar18C9.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2936-1060-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2936-4475-0x00000000002C0000-0x00000000002C1000-memory.dmp

    Filesize

    4KB

  • memory/2936-0-0x00000000002E0000-0x00000000002F0000-memory.dmp

    Filesize

    64KB

  • memory/2936-1074-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2936-2508-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2936-3817-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2936-4470-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2936-4471-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2936-4474-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2936-1-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2936-4476-0x00000000002D0000-0x00000000002D1000-memory.dmp

    Filesize

    4KB

  • memory/2936-4477-0x00000000002F0000-0x0000000000300000-memory.dmp

    Filesize

    64KB

  • memory/2936-4478-0x0000000000300000-0x0000000000400000-memory.dmp

    Filesize

    1024KB

  • memory/2936-4479-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2936-4480-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB

  • memory/2936-4481-0x0000000004690000-0x0000000004691000-memory.dmp

    Filesize

    4KB

  • memory/2936-4485-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB

  • memory/2936-4484-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB