Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
30/05/2024, 13:31
General
-
Target
2024-05-30_78325fef59f4218f566f53dc512cb2ed_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
78325fef59f4218f566f53dc512cb2ed
-
SHA1
0a0b278439d2bce24287c439f70b5544205c4677
-
SHA256
6b7f06541946df826c8019760f8c0aa6b7b4293f9d76d7e3e1884b2ee9f45fc9
-
SHA512
4994848b5288045a5fe4e2b7ff4772af12e77771e870d63247198e6e7d247e03ac1da3a279764979e97bdc584c0b4a76e7257c5fa3d6e0fe32116d14297f79fa
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 63 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_78325fef59f4218f566f53dc512cb2ed_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_78325fef59f4218f566f53dc512cb2ed_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lOnuciX.exeC:\Windows\System\lOnuciX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YxdKAen.exeC:\Windows\System\YxdKAen.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xVOuSOk.exeC:\Windows\System\xVOuSOk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MhehzTw.exeC:\Windows\System\MhehzTw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SyEqYRP.exeC:\Windows\System\SyEqYRP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zOlZawL.exeC:\Windows\System\zOlZawL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZwYoIPD.exeC:\Windows\System\ZwYoIPD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mrlvaYL.exeC:\Windows\System\mrlvaYL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kuSbUEo.exeC:\Windows\System\kuSbUEo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jLkyLxu.exeC:\Windows\System\jLkyLxu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HNIHZsc.exeC:\Windows\System\HNIHZsc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KNOhyvI.exeC:\Windows\System\KNOhyvI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AuDBTBk.exeC:\Windows\System\AuDBTBk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ekJMmbN.exeC:\Windows\System\ekJMmbN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IuTcIyx.exeC:\Windows\System\IuTcIyx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bKwlYlI.exeC:\Windows\System\bKwlYlI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JWzMRDD.exeC:\Windows\System\JWzMRDD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FAWzFlQ.exeC:\Windows\System\FAWzFlQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PydQnIY.exeC:\Windows\System\PydQnIY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IufaNdo.exeC:\Windows\System\IufaNdo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\slKMFPx.exeC:\Windows\System\slKMFPx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD56e52542bbc2ca59d120c0817a021a72b
SHA193e3c8b93e91bd2284e9cfc431ebde438af916d5
SHA256bffb89142db317f3849b6617eb9ead94157719c839ef56422785c59744992362
SHA512496c90ed393798a794ad3f432503214c82a7f32b83eb00232218217b38951b267de6ba3be95b0bbac3f670a39639a077325aa2c5c7c5c28cc1cac73fef4df9c8
-
Filesize
5.9MB
MD5bef1cae52eb98b2cb45b0c4ee534b7d4
SHA1f85bddfa981a3cd088836c5d917895a286b6d031
SHA25606fbb5b599e1ba56b9c8fbf40be7be409f225cf3f608115d23d03efc1ec03104
SHA51208409363f8023d4fc3ca8b634c9dbfe8df93f62ea787e02ad3ebd862cc6e686bca59515461ca04efc1b62ab306c7ab3db414e1ba52725f3150420a87a4f35141
-
Filesize
5.9MB
MD5569d836c83d05348f5c2b920c804ffe7
SHA16bde0951fd7c870b403d0e47e2b52ca38e0aebde
SHA2569db69dff65c664ec9dcee5a555bf6b68f896b704bc303d9f060d4396826e6459
SHA512467efa818d0f2a907b2503281a3434f8c713adfbfdec9390e745d99f176f436add73150874446b019ccc383c7ad81c5382cd85407553f3f24806326532fb73bf
-
Filesize
5.9MB
MD57ef0dd8f24760335249023765652d715
SHA13413b599e075108a958a47f8ce156d2287c6742b
SHA25645fe0701553acad485d9dc02549539987213aba984dda22a2536fa32d59ba96b
SHA5129257c3bbaccc7b3979c75b26f2949f8eab878835893221d6db27b31f2c8011143753375879d8980dee348011d94c2e918e58836b428ee946c69801e1da3c34ae
-
Filesize
5.9MB
MD5aefcf82f64cf3d173fe0cba0be3f9042
SHA13d31c45b2badeb5d6ee2f5f77063a4e856c85345
SHA256de69a9acbbbb5e76546e3b4dbf9b3258d9499ce081b8013cf174efe94697ee16
SHA51297d42966ddfad5644eca1e7fff7012330430f4d730ab6ce49f9c268fbe0b123ca5fb8605ceb97dbdef0599b31e020a1dd1a11140b40986197c6058f888a07851
-
Filesize
5.9MB
MD52e7207ee00bdc1a36f83d15e3a07df8e
SHA1281a725db807557fa70d551a0eddcbe1ae844149
SHA256a70db7656d4fdf7ce50282413d8bc3d6095459a6a03c8a7b206a6e46ebe4bea7
SHA5129639d52e5a8e4588af32cc0386387b8aacae8c353369710ad5364986b044409d70bf1212621133fac0b62e1d60e43899d66f8c858f7a941d8976698e074253b6
-
Filesize
5.9MB
MD5e4c52a3807f40d4d13f29b1b3e2daebf
SHA1a4475181e8777d864c4626d6e16887c0d6e962ad
SHA256db1c939d1a06425a79197eb1b2753d53c65068a97118d299324a678ffc36e0c0
SHA5121a2e75f6e06bd9764695d89f02b7460a156ad10d11cd8f2dd1aaa4aa2f7c05c43c2a5249f3f3f1779f384aec0e136a028135f2c4142dca9bb2ec1a547f0efe7e
-
Filesize
5.9MB
MD5b883beed8c0b13ce29e2cae65988dfc7
SHA15eb31dac6448d83c67e3034bdb60c1e8c05ad298
SHA256d46526b07c0345c35b9a13362c61e0be26cdbe2c046e3dd3084db759de60dd07
SHA5127bbfd5a6253312969234eb5fc688ca9a7bbf880a7e97592fda8ae1c2753af4201cf3b2d5619b087e645cc2671a3b144a7c66e832a8c06710fbb07084b1c916bc
-
Filesize
5.9MB
MD5704b6760809dedb0094753069eae3457
SHA1022dc577e4a7a7dd2c40048571cdfd678c37c576
SHA256584f990f225e6baa3660c539c471a70bc068238c771367ce7f428292e1ccaea8
SHA512c71163ef7fe8d01e3a79756b31d6537ec8a6e5f8d46c81be4d484b8854104b76696b77ce2b03e39ce8f2e0e8e8b2dc4f2ab954eac6fc49e142522438bdd201f4
-
Filesize
5.9MB
MD5e9c7cd48123ec2b9582540431656ee94
SHA133edb689261491b129f704623c487e38ee2e0d1f
SHA256e989efdf26b86ed6d5406e7d52fc9b6aa9d24ac034ca031c9797bda26027e688
SHA512e95a9ce5ed770bf52f2f4a9538609a1546e8d4d126f19582ceb95784e164ea335db9bcf183f744fe457867f510d983bdf635bb226e2cbf4543c3b4dcef632a79
-
Filesize
5.9MB
MD5d050514c2861e766c839ee0384795ad5
SHA123a17ad29740b9f001048377b1407f18e93fb8d2
SHA2561d19ae73ba6700b676e365c0d6923fd84f7471982551e95f8c5f63ada511b49c
SHA512f1799bbfcecb235f881c2dc442a514ca1859977169116492bb740abccb6d5a06e25e20e93564db6969f600b82d712f8409be087b7147761a765d039164539763
-
Filesize
5.9MB
MD5ef35f85dc26796ccdff194e0ee9391bd
SHA19abce7d974888250f5ba9e2785e50b1e1fc80e7d
SHA2564ac7134fdde6fb929671da0137d96467b0c27e0746af8c933790b37e465df977
SHA51260e73f45ddfcb8cb3966a3f3fe5ffc090d7ad396f0f3941f0bc07a0bc0ef29d9c134a8df1fdc359c0915130ab8bf52e88f00756333ddfdfc4cea78b9ac584c66
-
Filesize
5.9MB
MD50527ea1d2e6ef72169680f72796acc88
SHA19941a7efeeb3bf55f7034cb0136d3db7f7a46fca
SHA2560792a5aa487a4357c157a08b31745f9678bd0bf92ce4d25eba3ecec0260abddd
SHA51293393232fc25d78cb630037ca81e376f6120b60e57197055b4f082557928e4c688fc9ad4acb1f5ae4cece1cc64c04a27135c3a1554fc0f4bb9d72895e84c5c24
-
Filesize
5.9MB
MD55a0bf1077dd8326a0b08f437ac4fa523
SHA16a09907b97282b8697d0556b0c1dc0907537fa25
SHA2561394d284a79fe8c22e36c3b28137563330515a2059dd8b221f81747bd372040e
SHA5121f99c402cd5bc9b3a12335064a26b981c1e5a2fdde9a584103cbf432f8b1b853164854464d25ea7d34365325344897ee3f5962df0d680b2a465076305f730441
-
Filesize
5.9MB
MD5935d72d788b0b559f30741f539a41a2b
SHA1d657cffcf4bbca8b52d1541be5cec9ab8dfa8422
SHA2568149dda5796a879d61d1ae98e0539ac74b2eca16576c168509e859da7b82e9bc
SHA51279be5c9f033647069d5e49b445134dc794f925ffd309fc128249980e79b6a651d8b74cafc87665a09613039edf084d43f2066fe5f651b742334c3f55f1c3c4f6
-
Filesize
5.9MB
MD58bda2bd386039552663102de254e6943
SHA1884b028de26ab1b938cefe6f4816ea233b7d3411
SHA2561fc32bc3adf0d6c5ea0f3b6616d423ee1e66f0564bf0ba1b6cbb912fa1485e3a
SHA51257d8f71c56b5a91d74ae84dea1b2d88f3b9700befc677dded7d3e171d87bbaa65441196d8d2054ac2581cc0700898dda9b1a7b00f9a6d4c0f395741c32a1c3c6
-
Filesize
5.9MB
MD5d95db8c82c51df83ee93d674031602c7
SHA15d892c87e24f6e6e23f47894f4c47c975c427df7
SHA256aa43c05b254832f8adcff9c063643b5cc3333f6052745adbb7ccc9c1535b7adb
SHA51254ecbfb2d1e5ff0f1f41b6f9d12017c88a4a238168587d283ab755ce75db1256bec467f68b372ee542040d401a2855cfb9d3512eeb8c880cd0fb43d9fb6af0e5
-
Filesize
5.9MB
MD5c71bd990619af2a03cb35da3a358b30c
SHA1d464178b73d5663e919056a62d8bd09c04eb1b7c
SHA256ed1466038a1e7121977c3aa24871f23dbe8cf8d9a791f50435705deb099cfc4e
SHA5122cacbdfdc0e9214b5e31323ed5b36dbe9a98b1401a223a2a2b3aac82f25786dd9d650e856335d37b0425b38c5382c09232c5cecbcb488c9407a4bef30b73f44d
-
Filesize
5.5MB
MD5992e15ebc2245cf970acce9948576d6c
SHA13322f50d4aebf915abc8a5277cd07a23adf5f127
SHA25634aca34b8538d4e7f9b5ca1806b2281a0382769188fd9d2c13b1e312e96b00f5
SHA5122299491ec9c9bd4a6ac0a40bf192f660f0f17c74b61aa4e0097b4c4f83a6d479f7a76f02af36d33e9826debb7591943213a22619c67db9751ef075d87dd44bf7
-
Filesize
5.9MB
MD563ffafb5006689b4f925315a64782d35
SHA1fadd7b307d588082527c8296d71047208a848ba2
SHA256bf799659ace4bf717ff34ce14ccb2a09c48747aabe0fe0f94281f92797a366c8
SHA5128fe407359ea0b166deeb2726892bf80f196fa5764a73e32d89319484e25dc907e3e3c866c06fd5f1db9bee89fa0b979cb0068c3fa42fa8131347a60b60f50064
-
Filesize
5.9MB
MD5fd377addd732f0c19d74a3daabde1e4c
SHA1a4f6fd84d2f396893280bef5259f8742a4f0427f
SHA256f3b4fc34aa9faf53f7cb0859857c1acc78f7558f537b3df38553cbc2f2039dcf
SHA512aa64fd9361d7cde5d39fb578cabd94a53d666cde9d89bdde4a68751b25115df18d6ff75eb8437632c7c7ea90b15007edf77a3088b7bc2d307fc5641fb59ec6e1
-
Filesize
5.9MB
MD5fdc4a8d5c6cada9a3c766b8d55397354
SHA1ebbcc40ef91b050b20785ea506ef7656e1dc2742
SHA256dda2579ee41e49d04de4a354e601358fe4ca477cc43ea2c0f883e58dadc831ca
SHA51247d84be863996376432178e7c51949bf9be0bea0d7d55b4311d72a31c529eb2c41031fb04f0666acb0d1d96e07269d2c314f779e1f65b0669b56709c7468cf37
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB