Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
30/05/2024, 21:49
General
-
Target
2024-05-30_e9ae093f07a1e6a52e42414755bcf90d_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
e9ae093f07a1e6a52e42414755bcf90d
-
SHA1
3f18cdf4c26821aa947464b60f6fa9bc7fc33fa6
-
SHA256
36472cc445d6f374fcaf3a3e7666e49900230b14aca1565cfba4c20a914fad93
-
SHA512
ad4c309cb5678a79fb0f84f00f605e1c76da572972e44f4a265cf0a707c2c62d0eac1213264a8fd958c0a73b99edd22fffb8cfd08197af9b92b614706d968f81
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_e9ae093f07a1e6a52e42414755bcf90d_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_e9ae093f07a1e6a52e42414755bcf90d_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XJLaUQG.exeC:\Windows\System\XJLaUQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aBuWGFy.exeC:\Windows\System\aBuWGFy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hGUexfj.exeC:\Windows\System\hGUexfj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IpfNrUX.exeC:\Windows\System\IpfNrUX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RudMQJg.exeC:\Windows\System\RudMQJg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MCpcNyC.exeC:\Windows\System\MCpcNyC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\whCGNuv.exeC:\Windows\System\whCGNuv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gRgItjb.exeC:\Windows\System\gRgItjb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wfUEtYV.exeC:\Windows\System\wfUEtYV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uSoLxsp.exeC:\Windows\System\uSoLxsp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUcdsJL.exeC:\Windows\System\pUcdsJL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cKeAlQF.exeC:\Windows\System\cKeAlQF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uJUclHT.exeC:\Windows\System\uJUclHT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LxfmAfK.exeC:\Windows\System\LxfmAfK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OymefEi.exeC:\Windows\System\OymefEi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NwdcEJD.exeC:\Windows\System\NwdcEJD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zfKsDuL.exeC:\Windows\System\zfKsDuL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RiNVTvn.exeC:\Windows\System\RiNVTvn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FvzKRqq.exeC:\Windows\System\FvzKRqq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zoRbwbc.exeC:\Windows\System\zoRbwbc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JyrXRcU.exeC:\Windows\System\JyrXRcU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD58b2e249bea4c372a83106f26759e849b
SHA1e5dfd5e6b82e281875a614c23d9c7e0c7fae98a0
SHA25644f3328e7af6c97626b6982d7aaa9d48869d1d5e43f8ccf6751493c4bebe9783
SHA512d82ae028c9105986a2e2f29a6fc565e0053a4d0dee8e66cffbf7ce267bdeb5f01d8c84e7dea93b9e574e6280a5fc2a76442baa80f571c43c00f201d9cb6faaad
-
Filesize
5.9MB
MD5adb93179c34e1513ce6f7a596a593827
SHA1fdc3668b38524c9eca23f0c23b8020aa99c5b1e0
SHA2563812cfed235dcb120958b664936189a88c89ed36eaddf4d1f4eb19388a65a205
SHA512bb7198a4c5e67c76c7748a390370376d87237d7173fccb9e538fbe179372aef4cbab40630cda5764bc01fdf1428d53c45b8f4aebc57e66d2f3d8ac574db7f1ed
-
Filesize
5.9MB
MD5d69fcd69d1898606804e40e5550f6b23
SHA11eae31aed8dee2d8c3465260f078dbd7a6b8217a
SHA2565e65ec9e3ccaca1acf554f1e40579d8e359c79510aee8a9c40ea8447a9f4b010
SHA512f5168247761329303b8035e053489023b61a47b8efe142c53427060abef1d3670730bb7bf8d01c3c2cb94e86af70d8ccdeb5896fb3c95aca64cb93e4ddf53e16
-
Filesize
5.9MB
MD5fb32cb9d6f8ee15b6f574a2ede4eaa72
SHA19448d9d51b215ecc996135052f48f81fd9174ffb
SHA2567e2d2b0194e81add6f6b7ada2cc03138a8f128c721861e9fab91eeb3a6fceec7
SHA512e73844be2cae7042df418c3a8e813b6ecc9ed7fe4a56c855d30aa485c6a618ccab7119d180797e4a65453000a2e72491b3430daf379c149f0dc3fee73eaecce7
-
Filesize
5.9MB
MD5a0d7ba6a07aafbe47fbd53587b67af13
SHA1040ba2d77c1efbabcd747988055b27147193b1f0
SHA2569420310a34069a5fedc2a115f5a33eb73faf668aea764c57d5012799b5e62eda
SHA512b068832d3b7fc84e7d54c8607fb9d5ac482371131aebfbd02ef4480b8cf8b8b60faccce07f5b7cd323938e346020e138d55c799bcfe672bba2a7a6889d6f95a4
-
Filesize
5.9MB
MD57b501b65330b5f3e9500f9be3e7655a4
SHA12b00de27f6a39948ceb59b9c4333ee9ed5418eb4
SHA256abb4181ae862fc81d21c2c844ef372805e13321c6f0c242fb2c46f6f8732ccb6
SHA5129a1b88b10b67531ecbb2d5690bafd718613cfbe176ce041a5cf9a1a49b418452d06b546acd9ec26aeb2c8ad6806564efe2dcfee0dd68a7891dfd8c8638042624
-
Filesize
5.9MB
MD58ec14a3d45f075cb4475eda3e2a219bd
SHA1f5b7889e1c8278032a503e0a08bb191d7b70bbac
SHA25678edc2efe1cbd888e77a031be8b0c77b78e1f4467e3c8e9bfbdde336cb97ec79
SHA51224db776869b7a41c671fd1127179436cf2fa4fa621f3462376367c87807659ac708850ac2580a53390e443c39b1acb6fc62ae367fbc2bde615d2a97de107bbc5
-
Filesize
5.9MB
MD556da0ed605a1d536d0414d3834646760
SHA18bc3addf095c516d6f92947c185b466bb9fe5e4e
SHA256a87282d0b8b9cd0738baae13b67d861518abb66684eeab8a4463cb59486c634c
SHA512c7200b74205239361dae80a9943a54ec7ef5e6f55161b83fa03b2cd336d1393095a2df4056bdd8038e8f937ed23c63ca4316ed136af66235ebc94ff5976b6255
-
Filesize
5.9MB
MD53bc487e593c98254e2286970541abbc0
SHA1fa8d11c5cfecc8cb5e32ef26d9e342cbd3b39a47
SHA256d25d957d498c441918b48b4e653bd2c84baac4722b5e8385a00f5368a47fd981
SHA5123c4cd7dbee620c271142def7eaf2d398780a362fe657e5f1d5408da1e47c419ab8e8e8f8bba011553a1f65b06021bafdcb0ba753ff74f3477b33fb8c309c9981
-
Filesize
5.9MB
MD568aa3115b235e263acfaa6abaec79302
SHA1a2bb2eeff40852ff0e2ddd7d610963c8493581bb
SHA2561c1da9fd75b37668d5b4b7dca7853baf76281d1a32d6245b32c06d850c4ab17b
SHA51250cd48ad10835aa5b51ae0cf98bd5ad132502b2fc06f295436f7841b8b9d956dc7335e772cd8073d074471f6083d98112ffb2fe6d3b6532510f126ce52456f3e
-
Filesize
5.9MB
MD565eebe3d3e15a4f472841218383414e9
SHA13a7d0b2c5f3c7d65072930c3f6dd90962c388d38
SHA25665293ecac710621485120e0211fb790dee22f5ad883ccd737a135eb7e4bc39d8
SHA5125229ad4f7683633de3d8b7cb336ccf10bf85267eb5ee04c9bb91d8042401ab523420e448a38093f04afc98e74eeb8ad0e34c5d85c81d08dbffcd9aa59e88f430
-
Filesize
5.9MB
MD595cd0d6cfd0cfe20b45d1d56353a4b88
SHA1e1b5d156ee7cac06408f2825e82fb34aaf96b991
SHA256df728e41c14764cb7b69d1ef09f21f88607e1a49ca58d8faa3fd212241783cd5
SHA51297e68ac14543e2e61165e8cb01b3425a6030e90b63beeea4cf46a4bba5e50b8bb350b257908c3f438c3e59354e85f5818978b916c36786090929a5a077a6f95d
-
Filesize
5.9MB
MD556a3579d376b64d8066e4036b5779a55
SHA12667a37b9ccb48f0499a266e55d9803af1bbbaa6
SHA256aa8bcfa53086bdcbc32a576fc7dc04cc7d68ffdf122637e2937eed8aa3d143b8
SHA5124203bc3ef3c786aad37c7de4d56c98ca90721cc604ea29941b22bc21ec42e9b91946161fafbe98112730550b02f1e82499a4fa45aa77e8b5a9b427f1365965aa
-
Filesize
5.9MB
MD55bb0186a26d1bb8e934c9d9a181f4b81
SHA1efd92aa1a26de372e9bd2e2e31267775ecaf9887
SHA25625aa15567e7573c9851b48e63cb2d77b10e9364374939dcdf8b9784beacef9c4
SHA512b721ac3c8e3b8c55f90216328e3388fe68acd5627caddff6a6654b3d8ee335bcc233a9ece0669a51e8cba0a526df7c2d234f18b34296f327a73bff28ad594939
-
Filesize
5.9MB
MD57390d48d146a2c0a0e49245750e10bf0
SHA1a55690a153d6df5d462ff19975dd2395d45a5734
SHA2563dca097711918cfc9358ddc6e31214bb527f9f639621df3cb199cdb841bb2b44
SHA512eecf4c54818e2b91aaacf8b4ed2698c2008fd21935649484bcc53b764ede76cb665a1a556d70c8a4492d3030900b834e558a4f270aa46894058a5608e4c5cb98
-
Filesize
5.9MB
MD540ffcaedfa3133df280cf2370feff330
SHA137f173c96c3fa96dfc0d1508b6a19c87ed4d705f
SHA256ae029d49b9bff8a3e0251936f20a6b37e175fdcb5ea710a613bfbe2dff69e2da
SHA51262d86438ad685efe8cf91c50dda32d1ed40f5a54a083148423769df759491a123976cdd3122835a1e01fd0aa7fc2392b3305ea86ed80a167855af614342b6990
-
Filesize
5.9MB
MD589d9d62739a28d1a48a851b4fb4b6278
SHA1731f2a4b185b8791a2dc9e360bf78e40f7b722bf
SHA2563ed41bbd726e0b3848d9d7033dfc8b26e3f755f7ebdd703f5acf4f313f4cd029
SHA512010fa21c91d19fbe305133f59a59bc63903eee36eae6f0508a5e2157bc9b4fdd4c0b2c00d5b0468b598598732fda1aff5a76bc90c592ca95c0199afad1076da4
-
Filesize
5.9MB
MD527c544916008cc80d1243db759bb1d69
SHA192820f5697c6d2009b3371d0ade34e12e8b1b314
SHA2567a190b0a990c59d154590d89ae042d32188fee0e9023291f07e991b524603239
SHA512c0ea28e8df4c1a7e1d53aeecc30897c5982fda2a6214de58396c4efd8e4e186c8cc139fa7858bb6648dbad9b69bbf2caebc24c634f2884e891ee96c5749652f9
-
Filesize
5.9MB
MD535014aaa16bee5939f2736ed87bac28d
SHA1c3a34f37f0300266ac81c4aeef01dc6a7cc89aa7
SHA256709c649972e7e9b8af205a9c9c0a1fcec8d8b62dda2e05ec6e5eb554c6c2b2b5
SHA512194d6216e4ef1edf5ee55d1ac8a376e18b1846644eeefc82a57f101a64b81d411015d5fcff5927f47fb8922d8248a3691df743067dd1b599b281fe8fc33391ec
-
Filesize
5.9MB
MD5db4c077e916c239ce9dca193e4199a98
SHA1a5e35cad5331c42da4cf5e999c3bde4e252b5271
SHA2564ab9a2370922098940282e3ca9506baa599068a7174f88f9d9f9807780984d0b
SHA5126569aa6f29714aafcf3a2c5828f14a797d44a80d6e7c1f9882d72b4772a457ce7827c04f53fc627493783abc3c913f9af30143dfb4dfbd61f716e5a63c0dba28
-
Filesize
5.9MB
MD5ee87fc45c276a61d2c0facc0e799679b
SHA13abe41608787edee15d7b7104ff4f70e12c644bf
SHA256c3c184a8a259d6e92d3d04618e0b22e25585cf34f63e5593163e586fc530c6b8
SHA512ffd436c2e926cfa53aff2511683304bed7ae17f2fcb96ca7e47fb1cd6c8469ab706edaacd24bad012c7576cadc6ccb9be25f70579779f93efe0911302e87f64b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB