Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 21:26

General

  • Target

    2024-05-29_29f47bf215201447a919a7502f3ed630_cobalt-strike_cobaltstrike.exe

  • Size

    5.3MB

  • MD5

    29f47bf215201447a919a7502f3ed630

  • SHA1

    f116d03c3e901fc2e2eb6fdf6398de0b5cdc7c2b

  • SHA256

    f1183d0388969ff33fffa0a6ba57e095dc50cbc6fdb57418e50a8d4f61df9102

  • SHA512

    4af8d913630a8dabbe13c7c9a0bb8499cc46bcb76f2bd2c57892b32c31a9095bb0c0819b0a1bb07fe3ab6aa88b4be9106b25cd3b2bad770f075e6904b076d8d0

  • SSDEEP

    98304:SW1qiPgxn+cuSuxx8Svt73qq36IdKtVxNw6pUkp3bkbRxRUh:53EnsxxDt73DdKrwapwbuh

Malware Config

Signatures

  • Cobalt Strike reflective loader 1 IoCs

    Detects the reflective loader used by Cobalt Strike.

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Detects Reflective DLL injection artifacts 1 IoCs
  • Detects executables containing URLs to raw contents of a Github gist 8 IoCs
  • UPX dump on OEP (original entry point) 10 IoCs
  • XMRig Miner payload 10 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_29f47bf215201447a919a7502f3ed630_cobalt-strike_cobaltstrike.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_29f47bf215201447a919a7502f3ed630_cobalt-strike_cobaltstrike.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:2188

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7-zip32.dll.exe

    Filesize

    5.7MB

    MD5

    1472bd9720958f451da60aba0edf4bb2

    SHA1

    9db03270c4528e4e40975bea2c28c667e153aa27

    SHA256

    5390b749a5b3ef6d10aa0290b73b8b17253f979d9261f242586687a877a70afe

    SHA512

    8971c34a078930b4d29fa46e29a52098a35ce3b1cd971a5ad5df5aa00cf30326ba941381eb3cfa807fdd751b283af3b021bed259ec77de8f13c130bbc597300c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    2ca35ff7444e4b5b944a355c1ea68f55

    SHA1

    4b4d7ab14dcd5ceaebe83c340d273fd114899868

    SHA256

    d2d3e7d734e46a1e61dfd2705b6eea2171110a8fce432738190708516d37b8d8

    SHA512

    75ad08ffb12093bef7a152c81d5bf18f458dd8a83baf43876a9e1dc8514280774c9c75980de6a0f5ffc2f621f0b4c917c32344416d537d0647ec9611aaaab14c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0149db840d3830a93889c1efc20efa4e

    SHA1

    278458882f27a502e21ac7a2d5efe411308042f5

    SHA256

    4a2c5af6999ec45448df2efe2dd37083b3ec354eba9331b6deb1ac629c1e1873

    SHA512

    604c1c05aaa0917e1850d99ded0e90ecd664b554d59f9d18d3f3078ce14cb9ba660853b66fa2c49f25077d3e8d23b477039c0dd531d2491232708136028e87d4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4ea974e2449bc3d2c5815d7b809398b8

    SHA1

    60324ae498589504c3d94c37b3ec9a81273e5106

    SHA256

    6c0fb08eb519632ddb5de6a80887552d9c3a01d4118e407d6daabf8089b48431

    SHA512

    70a9ba3ee12518b7dad796a8c22b3fe4148ad9f9c09ced8285ccd821f8794fd28c9f1a29f3a33d3c32554ca27b3cc15ea65bdf3d8543defb3755618554fe4ac6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e1e4cc7683fca058ef19e3eeddcd8644

    SHA1

    3082cfb2a38c72b3cef067e00cae8b071b2429c5

    SHA256

    9ac1c4046dd8e9c9062540dd3e4e43a0b4b46755c6c61f0960153f7a67bb6929

    SHA512

    3c90aaf647b02b19e63bdd797b8ebdfb658d180a0a4da29aa130fd17513eaf46d9250c523877b16f5b6bde834272935ed086ea370e98496d1cbce51061205d7d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8ae3425d1e8d7519d3f0d47796af0aa2

    SHA1

    278cd5d89218eeef65061bf42b5a2350c5d637bc

    SHA256

    6247e2cbf625ee5951e172a1b99658899723b7da050c1d3da70c1b78b5c73719

    SHA512

    0abb4c657ffeb8703e91e5e6712a4b8336a4d4db4f2c3a1d899906496f904017c1f29285e8792dcfe218381bbbdfecc9247b7eca7446721f6619ffbe8e4356df

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a919c60ddae7ca91ad40a71b014dc850

    SHA1

    11f2aa1148e37724dc6fedd9a6ca6b87f8ff0132

    SHA256

    a5950476cede9cac41fc5440169421920d47170f61af3f846312eb98d1f1c3a4

    SHA512

    4e9d0c20fe81d49b57415ca526abc4f6a2ca9e45f07d8287f5e4e46e03f1078cdd64f97933c35ac853e036434e9facaad5f705bc47f3c662b15e19c5d15f879a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2b5b5dfc35cded740c07458164180601

    SHA1

    783405e668ef122d8db254c9d07439ea8028e4fb

    SHA256

    769d695bb935cedfec3a590813b2f2f328edc1525e0f5e1083013f1549c92a3f

    SHA512

    97912de13027892a0a03fb3c23ed871e2624a15c598b222e90d20dedd3b701d259a6f47447ce2f24f1cb11aa91209a3dee2a4622351a0cc01960abb66a9ccf5d

  • C:\Users\Admin\AppData\Local\Temp\Cab2EA0.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar2EB3.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\Tar3011.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2188-970-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2188-4921-0x00000000003C0000-0x00000000003C1000-memory.dmp

    Filesize

    4KB

  • memory/2188-972-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2188-1-0x00000000003E0000-0x00000000003F0000-memory.dmp

    Filesize

    64KB

  • memory/2188-2002-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2188-3156-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2188-4266-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2188-4916-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2188-4919-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/2188-0-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2188-4920-0x00000000002C0000-0x00000000003C0000-memory.dmp

    Filesize

    1024KB

  • memory/2188-4922-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2188-4923-0x00000000003F0000-0x0000000000400000-memory.dmp

    Filesize

    64KB

  • memory/2188-4924-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2188-4925-0x0000000002B90000-0x0000000002B91000-memory.dmp

    Filesize

    4KB

  • memory/2188-4930-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB

  • memory/2188-4929-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/2188-4928-0x0000000000401000-0x00000000010B5000-memory.dmp

    Filesize

    12.7MB