Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
-
submitted
30/05/2024, 21:49
General
-
Target
2024-05-30_e9ae093f07a1e6a52e42414755bcf90d_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
e9ae093f07a1e6a52e42414755bcf90d
-
SHA1
3f18cdf4c26821aa947464b60f6fa9bc7fc33fa6
-
SHA256
36472cc445d6f374fcaf3a3e7666e49900230b14aca1565cfba4c20a914fad93
-
SHA512
ad4c309cb5678a79fb0f84f00f605e1c76da572972e44f4a265cf0a707c2c62d0eac1213264a8fd958c0a73b99edd22fffb8cfd08197af9b92b614706d968f81
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 57 IoCs
-
XMRig Miner payload 58 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_e9ae093f07a1e6a52e42414755bcf90d_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_e9ae093f07a1e6a52e42414755bcf90d_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\TYqvKpV.exeC:\Windows\System\TYqvKpV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FSBWEeJ.exeC:\Windows\System\FSBWEeJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zOszgVg.exeC:\Windows\System\zOszgVg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iptvWsl.exeC:\Windows\System\iptvWsl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BTgRvbl.exeC:\Windows\System\BTgRvbl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JkLozZq.exeC:\Windows\System\JkLozZq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mEEWVEu.exeC:\Windows\System\mEEWVEu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OKvEwgF.exeC:\Windows\System\OKvEwgF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uvcpNyT.exeC:\Windows\System\uvcpNyT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\akXCooN.exeC:\Windows\System\akXCooN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TIwNFOQ.exeC:\Windows\System\TIwNFOQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cjiJxiP.exeC:\Windows\System\cjiJxiP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oBERRBh.exeC:\Windows\System\oBERRBh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jjRHtIw.exeC:\Windows\System\jjRHtIw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PZBgcyy.exeC:\Windows\System\PZBgcyy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EYpYpZB.exeC:\Windows\System\EYpYpZB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\reEJhZf.exeC:\Windows\System\reEJhZf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UliNDXh.exeC:\Windows\System\UliNDXh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UVzxbYR.exeC:\Windows\System\UVzxbYR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kvjxzff.exeC:\Windows\System\kvjxzff.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yFsAKZE.exeC:\Windows\System\yFsAKZE.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d9215ae55025dd0d0a6b3046ebf940e5
SHA181160148b8b2dced3e6c57bc1f17ba169d09e6ae
SHA256d1f2affdf1d63026dd98c3e9476af2e39388955c32d641485c0d64de3d49e193
SHA512ba9734148065b9564e20fba1123322246e7d32bfd6c6a46f4ba595bc75dc28fe14a47035bff2feaa9b79364cb8734c6f6ad19adf6391f51ec3c9135070757b6c
-
Filesize
5.9MB
MD573527677e4b808206ed8e213ff7248d0
SHA18f9a524ab95f46d5d11d9600892972f1cc459168
SHA256863e46a6513e3b686e60692dc457b702a4cea2c675b73eb6dda853a119e2ccff
SHA51217bf4195d2f09334eaf88895580fc49cc33a6d8d0258694b47fae268804d828098316b5ed9fec7ba1b771894b38a40513c79450699e8755b1aeacc81bfd1a3ac
-
Filesize
5.9MB
MD538a4582d53d77bbe82b1fb341fed70c8
SHA16a1a17f3b7779100adfa7d28d55a716b600f2b89
SHA256f803b87f7efb5a2fd50ebec3e06f4983dd9fddefab1e186df0efa4c4848e5282
SHA5121dbe153853c9b74ff10b04421f770509b96f9171e0d250678d148bdd6f46d68e48f87334b0095ecdf65974e33738ce224b1cfad2505658cd542dccbaf88a5147
-
Filesize
5.9MB
MD5ceb764a53ee4467a0fe6c629ae87ee0b
SHA1ac196c447a039319e797051d909528b41c8730da
SHA256cc142968b533601590e4449858e26599944fa0d99398bbb50788d557b50d982e
SHA512d63b8c0218ab01028b386ec97e37de343518ad0063e6fbe25a365331396eef2d1ed876ee83dc372976b0f1868c333fc0613e90074bb19199b8861a1565995d31
-
Filesize
5.9MB
MD5518d8e7a20d51ac89391a88560f1993a
SHA12d9f137d312f79c8d3dc37200ccc7683d4110ee7
SHA2568607a9bf5eb644561939cd64e5c427c9e83d36a2bf7b0fa70fbbc3b8edf8ffe1
SHA51274fb9f6952f0f4630e8061f02247dec08d3e74712e5ac122c7c1ffe9871edd6316473d903967438f9aabb7b6db56e7fdf7abb7f659a9606ee1c1a4a3ee22abac
-
Filesize
5.9MB
MD5a4346bf51fdda6090be2172ebf44bb05
SHA1b18c74271e75760bd569fe96594c0da8bcd59334
SHA256e79d0bb0bd9ccb1a8f0d1e4bf2dd59dcd27916f58ed99b31b3e5a13e6397ec37
SHA512c4dfc375ce22e8581f2a3eac69fa5d1001843eaa7f8dd856a5332c473cff2171649c413ec74bdf4c0a7a3461aa49a952a59e79e5d0e3e3d7fc1c79f0fdada760
-
Filesize
5.9MB
MD5ce772ce873bd1c9ef4deaa9dd42aee3f
SHA1a2f8a72abb321477a635f089845d4e4baa216d1a
SHA256e8a319dcde77391c3ac5097aa0e5e997cfa75c58da576dd3c4b8d9b68800a940
SHA512850ead09815e258a39016650124c972ddd1b951ee24a70f2c5739ec937538270afb310a0c6bfa5e07600fbe2478db6cb8ff705cd18af41e6c93f07ba5304f3de
-
Filesize
5.9MB
MD5e6c363440780bc2961c290398252de20
SHA112b027686cdc692abcfbe0d267974c593f04275a
SHA256045ffa9d2b55f55cb80ba12a629156113c48e9b90ae9d33e6d6baa78cba00446
SHA512fd5213f50abd5ea80d0e912e2c31c7b0544e12ce5e8cccba06463d46bf33dae2f5b19613ebaec66dc176f8fcc72c2e4994926384d4ef435417ecaf0cdd6ceac9
-
Filesize
5.9MB
MD55601d9f593c5c8351359e539e597ea66
SHA1c233b2eb9f5f4d38a396f36e86def6b71cd0c738
SHA2568da7552da10f7c2735404fae40358e799c71ef6eb35f5004f1f332293efd8ca8
SHA512f2bd7a20fcdffde8b3c63749481c4b25d03b1980a9634bfb97fa8a43cd11ce18eecd62dbe3e0de59b91995d2eae2237665329bc5e7f480ff2e59e60a9c2507b9
-
Filesize
5.9MB
MD53bc4b39a2c75c0872456d052c82d1997
SHA1e4aa8ef15e819d1336831069ed9d21a22b7f5c60
SHA256829cd48b47af0a7f72ebd8f3c28f41a5f717c15d9ef111ac883b915e6780ed5f
SHA512645c502445fb6898922f8e0000ab212168bfd65faea9fa0e6c74f37614e28b7bc7da14f41ee632f1a219351fe96e3ad6d7f5f8ac10c8ad3548ab16bbe718505f
-
Filesize
5.9MB
MD58b585119776b61d2055d80a0104774c5
SHA14e5ed47d9127aab70192053ae03c40ec15f35eee
SHA25672e1aedb260f613be65f91bba1fb05345d280e6b4827812bb8eae808eafbbe06
SHA512b0c5a7e15e94c5f05081fdf44a1babd1c8e97a9477a022cbcfda8618bb0435def6701c5b2a06fe3eaeceea06db431c0c1a634d9c2b2331d4ceaa1b88c33b337b
-
Filesize
5.9MB
MD5996369426d61ba53d78b605a992b429a
SHA1201e76cc7e4e6e5283d6ad982bde7e867d8ddd2d
SHA2567dbe52f077dcb36bc3aac2c959de8e2729736ca613dbd565525641d0af348f0f
SHA512ad159afb7ee001e44ade3331076f93ae8be5b2c93f33c60dc5c911b9e5d8703185a82e7728221425fd7f71bd94f84d31b16f93afab5ab9005f12b5480095e937
-
Filesize
5.9MB
MD5cf2b78e50784764c4ae7b811322c5c22
SHA1832ac43d33d3a8b02485acbf867cdd6952e3ffe9
SHA256b6d6f327120ed80ee9e9a6eda9f241ef0f8fc2aed9c3b3bb4554793f914b8290
SHA512cb513273da94fdd249e7b477ded95fa8740679c3d765eb94ea0797aa2a6cbfb7cca33198d4f1284e03b8f0acb6102b1a93052377baaf28ab2114c98e2d0ae9ae
-
Filesize
5.9MB
MD57fb0c9c227a2f74537ce92e3d3ebb7db
SHA1a9097402fc2ae45fce01c2907a4969e1b52e39c1
SHA2569eee03c707ef679ed7c88fe12298c7c2a8b909a068d762a75a08688f0b349744
SHA512a2a8739f10e511a23281677bf4dd46736536206beee2dfbf2427046db30b6f025e16d5a231f8e2f5eb05cc508985b9de61220dd53f94a30685dae68a50793134
-
Filesize
5.9MB
MD50d1631a1bb08453b38c7bace6a19c4b6
SHA1c7a6d2bad051def9262f0c2e7a677c88bc1bfb3e
SHA2560384da488c800931a48d59f4cbdd6d4b12dc7bad9af463911aaa254c82482167
SHA512937a05f3b82f85ab8c06f7bf035c41adec49a4b52aebc62f2b157840693a0004e6e0c2a61f1b2d2d4a0db2fd1636f908b485e2ea349428df86ab64303cfff778
-
Filesize
5.9MB
MD554d842864087d723f933874c72f7eb2c
SHA177185ce06776545bdc2a6a44f3d04225b27ef729
SHA2563aa69d55ced9831b6339e4fd6f6c137161b9a5c1b63b9e988b14294951f73ea4
SHA5124984c74a406fd81210eba987eabe2f3b8ce0d5c8de294771ec6cc8d3274a2ffb85749916df7d5eea6ff2859aac97a1b59ff84300064cb2fd9b7c9ed7630d7723
-
Filesize
5.9MB
MD58441d833e92fdc6bf0e574a3dd77b1f0
SHA1507ad5ad0e5391efdb94306d90a69e5eec23a9db
SHA25630d85b20fe44e33e7321d536c3c5d4da89a09ad2b506e81d410241be1e824f7c
SHA5125315b84079a183995aaabf070135edd27933f99cb0033a8714a35d5b7e46d7f1b92768018c16c26007d7c0798f111ab9d33eeee4de9c1a178303f9a19b31bf1e
-
Filesize
5.9MB
MD5cfa86df9eb52e8570730fab928ce0752
SHA19ca35fef2cb5bab5ac38341bad5fa4c57019c52c
SHA2562ea14e2ae2911c1470f16d67408bf915c603d2c0a1bbe8e1e363fa8a2996771a
SHA512ec1b863ea40c42a7c70ddde44651b6386fee25d56c635d6748ef637d2c416f004466c1b3b5710baf334fb072bee125d050a81cec7de470558dca56385aa32b38
-
Filesize
5.9MB
MD5b9452a90b26bf6eef45a5979d6836b99
SHA1440f242f3b01ed8a86ba183189ae66f9197fa38e
SHA2562305f667a7b5b41abb2e57d149a7f7649c3305eebebe824f7c25733fa300a085
SHA51278c697be39c93cb078e8be600e9606b696e2f14f276f856e737c43147428c103f9bb2239dabf9c2dcd961c2edba763d7571043aca7ba5682ba267c682183c754
-
Filesize
5.9MB
MD58d530fb0af3a7993f510b9b3ea92163b
SHA17bec2c9acf685636ec33e8ca51f5fc7fd5ee3205
SHA2569080eb4f292d9b098da866b7672777f293f85ed1b8056b9e9d0b79fc790c7c07
SHA51227aec798606c9339e27bf0d97907f68621472fb99148996274f96f6b1f849d506c6c18298905b8a7c4eb06b850242f15f1ec770a06cb42b15843ff8840c5f797
-
Filesize
5.9MB
MD5eb2344355d21a09e6ca7b9307cf1c1c2
SHA125a0309544e56bef6aca702c365ace1caefd07ab
SHA256e980ea1f47986d7fe92cb546a239f0a146f1cc9c4419dcf4f535cfa0881f6948
SHA5126c6fc024c957589a43f14b07e711efbe0651e61385fd9f22f42e078b7f25bc578485c6b68dba7e51f7e3a1a3025e2afd2f6916c15373cfa4e2864b7d03b00a31
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB