Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2024, 19:07

General

  • Target

    2024-05-29_c36382c8a4ce3c050f4b36777d76181b_cobalt-strike_cobaltstrike.exe

  • Size

    4.7MB

  • MD5

    c36382c8a4ce3c050f4b36777d76181b

  • SHA1

    3311b1fb64d561240aec0448dcae9329bfa3f5bf

  • SHA256

    56f44c13fe7fe3d2015fc9f8c47325f629e97154bace250954e1ba94de606bac

  • SHA512

    67100fd54194b8fe3facb1778853c5befb4eeac5dc8fa056d77e891232a0c8b4c23a35b63634e2dce8c0f6fdcd80b95ec8e31d1cd633ea7d506dcaf5a2f037a0

  • SSDEEP

    98304:SW1qiPgxn+cuSuxx8Svt73qq36IdKtVxNw6pUkp3bkbRxLU2:53EnsxxDt73DdKrwapwbs2

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 8 IoCs
  • UPX dump on OEP (original entry point) 10 IoCs
  • XMRig Miner payload 9 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 6 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_c36382c8a4ce3c050f4b36777d76181b_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_c36382c8a4ce3c050f4b36777d76181b_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll

    Filesize

    4.9MB

    MD5

    af5bd6ab7c4e710c256cf4ac0396f849

    SHA1

    b6a410e638fbd2ae584f6fe7da4ee2ce5acd4971

    SHA256

    ab94e574f6f2740a43a59b73d32b02b4d16edb9eb91531bc1ca76324a0eebb3e

    SHA512

    695a92c8e8e4abe413e93b8ec7f4c8844d556e6381487368c29a0931d14f9272d1359566b25ca526d71ffed6b5927f0f3c557a8ca003842dc33a5b704c50dd43

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    e424d94d16ddf38e3b59dc631cb89088

    SHA1

    147a622739131906f82961fe789aa331ac138025

    SHA256

    1e93a374cd2291b722847006d164a2c1834dbe9f3d6bbf6e777a185ac4fec3af

    SHA512

    c8699b58b61875353bd4c0a8a9d70cc9b8e6cc65ed2afdf5b297fdf831c902c090d2f7ef5675071e27b451da1484227392a426e9f11b4cf96b0b4ae012baa504

  • memory/400-3086-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/400-4998-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/400-751-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/400-1911-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/400-2505-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/400-0-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/400-4193-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/400-1-0x00000000000E0000-0x00000000000F0000-memory.dmp

    Filesize

    64KB

  • memory/400-4999-0x0000000000060000-0x0000000000062000-memory.dmp

    Filesize

    8KB

  • memory/400-5004-0x00000000001F0000-0x0000000000200000-memory.dmp

    Filesize

    64KB

  • memory/400-5006-0x0000000005730000-0x0000000005731000-memory.dmp

    Filesize

    4KB

  • memory/400-5005-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/400-5007-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB

  • memory/400-5008-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB