Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
30/05/2024, 13:31
General
-
Target
2024-05-30_78325fef59f4218f566f53dc512cb2ed_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
78325fef59f4218f566f53dc512cb2ed
-
SHA1
0a0b278439d2bce24287c439f70b5544205c4677
-
SHA256
6b7f06541946df826c8019760f8c0aa6b7b4293f9d76d7e3e1884b2ee9f45fc9
-
SHA512
4994848b5288045a5fe4e2b7ff4772af12e77771e870d63247198e6e7d247e03ac1da3a279764979e97bdc584c0b4a76e7257c5fa3d6e0fe32116d14297f79fa
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU1:Q+856utgpPF8u/71
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_78325fef59f4218f566f53dc512cb2ed_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_78325fef59f4218f566f53dc512cb2ed_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\XouROnB.exeC:\Windows\System\XouROnB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CFCDrBf.exeC:\Windows\System\CFCDrBf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WKBaSYP.exeC:\Windows\System\WKBaSYP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vRHjTMm.exeC:\Windows\System\vRHjTMm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xeYSzDc.exeC:\Windows\System\xeYSzDc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iMTWOaO.exeC:\Windows\System\iMTWOaO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mUsHoMa.exeC:\Windows\System\mUsHoMa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QHkDeAN.exeC:\Windows\System\QHkDeAN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kMsKnUo.exeC:\Windows\System\kMsKnUo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XAbIbgi.exeC:\Windows\System\XAbIbgi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WBkcRcw.exeC:\Windows\System\WBkcRcw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LUfbSWS.exeC:\Windows\System\LUfbSWS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iMjGiXg.exeC:\Windows\System\iMjGiXg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHntOPr.exeC:\Windows\System\dHntOPr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UlkuLAZ.exeC:\Windows\System\UlkuLAZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rEGVnAF.exeC:\Windows\System\rEGVnAF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vLUMZOa.exeC:\Windows\System\vLUMZOa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IPLkZyl.exeC:\Windows\System\IPLkZyl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PblSJlz.exeC:\Windows\System\PblSJlz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IxAKjrd.exeC:\Windows\System\IxAKjrd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zLfgrfa.exeC:\Windows\System\zLfgrfa.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5b00c2baf0da63cc3f99c57fe89c403e0
SHA1a869f5006a57f7ede23fb3e862a5a8b611930a4b
SHA2569bc95116bacd7f5e7cd8f12f60fd50b56cb312307699a7e25f665c2b1c93fb97
SHA5125dd4a3903b99deb395bbf27f75c27af50f395d43f1e3f403c7bea0108ba387337dae68fccb414892e60bcc606ecccae631e3fea1b11af89ebff3fd6bcb62ba66
-
Filesize
5.9MB
MD52d6bac7f7de67bb873dfb65c74358189
SHA1887993d8ce5745fdde9770780f111415e0bd43b7
SHA25642a3c0f10e60121a7dac8b7ab8752109c7158bd0cd33e2c2628595e4bd251ae9
SHA5121f86da1b35f3b7bbd0062de98eb474fdfe18f7d3ff2692e589a15f28e85671bfe8332af006a13cee5d911aa539cf83c08e3a222e866d619cdd7ec5c2414c3174
-
Filesize
5.9MB
MD5f0a04c123ec3e292fe8bd720c02654ad
SHA1c7d9b807b95e7ee54155a975245a6b1a4bbae9bf
SHA256f13a06f363337d901a9980cfeeae4422539aba96c092a55a51b241d8fb9ac691
SHA51243f18065d5bfe036f2d598dc9ff36220dbb669da9c7cc2b27078feb2cbf22e6107374ce6f3ba1e6b608cd29903c911bc48b5977ed2b345b51760ef4aac66cb24
-
Filesize
5.9MB
MD51d011a47a5416ae3d2aa000ada5d8aac
SHA18c77cf16f93dd666802dc25f3aa725d66f9fbfbb
SHA25626fc76068a024575ba6441eece12ba97129e8142e175b736fdfb63cee65943ce
SHA512b6be1cfd2bdc38d35fe4cd66430fc00b7168eb5e34645c065968bbeb8c6408125ba6bdaabbd2e80215092825a871656f55048c34f586b06a4b181e0557df66ca
-
Filesize
5.9MB
MD57d57a8c0aad8e4cb88d6be6f52563be4
SHA10c9ab36525b1ba3a1bd6c34cc97202fd01a47d4a
SHA256043999f8362e2d4106925adad35ca6a812b2ab835de72e5ac492e68222438c14
SHA512b79a6ccf484294abc249e4a78a3dc512762774cff50f67a20ef63f9848c1d8b6a420c24b048c00e11ae72f82f99ecc2995d858b8dec7b5ccb40cd3cfc6549892
-
Filesize
5.9MB
MD56fdbbad993120aab0557dadf950eabd4
SHA1e4fdbed0c9d4bf01053d1c80edc6fb2992c1febe
SHA25615fbf0f487546ed7c4a7ec030f55129659b3e040f17486afecede9a60d9386fc
SHA5121e73294d7ec387d738ebaff08053171ebe6008a3c92c173e4eed1e9b59dd891fce8a23203627f68acd88d82cedb7aa696a5935d386d7e2b52c652a677927d61b
-
Filesize
5.9MB
MD5cf2ca56bd23b740db9aa5241a71a6729
SHA1ba2b8042b083ebd363ecfd6b4a7ff64784e46b83
SHA256d2c6485cd49577b33203fa9a320f0618dfdc7c52999ef717b21c6d286f42cc14
SHA5122a593760f9c7277b56e27764e9c177da33197c25fbb8390122f6c254ba427d59bf6363f6bc8ba6324e0d087ba72da719765f08a2de28cdd4e55a6f18cec9a60a
-
Filesize
5.9MB
MD50e6b3892fd348d9f696ce6bfb223fd12
SHA12cd075ade09086e771845e2b6b28e33a0204b53a
SHA2568a01bb774fe939df6a3baea99d3dea99de79f4f2f096d9521ab9c2da8ec49c4e
SHA512f6d0d41a33b7cc36f136455efc841dda7be889cdef711ae722b574c971dbd616ce37e3fc6828f169bc381b9011a3446c3c4a30b82f1131806502cead55980c64
-
Filesize
5.9MB
MD51f3ac086dc1bdb084f4d4610f50aabdd
SHA10c3d9b9122244a0d77c37c964a83ac374ee8ee47
SHA2568540a0c336be467a587c421cede91e5588011afcd20b730dcd65eaba22009fa5
SHA512e570b6f2b8fb2680c486cafda7925ec417a7b00e5e3de480ed6f897f064be66dbf5164597e943935d85e4a1f11ef906a76621232f3e6a5e60a06204102251b8b
-
Filesize
5.9MB
MD5106612f3600dde6dca4eb6b7d03606b8
SHA15bb29d2fbb89673d7ca5773905f50b16d4d863e4
SHA256da31b4cc1e3aef5960443bd6e515f00116d35dd821b76a629c7728fc6d989910
SHA512bc9c8b43968f2d08cbb9e4c09ecfd52cafc4fbdd1dce56526cbe1c04da4749e1f7831f61f8ddffa336688e1abe566d12660e9d8e3a10e2fd4e82d0ae5e4107af
-
Filesize
5.9MB
MD5d403d5635c5cdc078686e81b7c93efb9
SHA10d0203ba35557b4f6d2eb01f450765a739256442
SHA2565b86128386bbf1b6af3ccf6e0655a5560b1d6433a4619aa7056c9cd4cea795a8
SHA512f42032fea06514b3ce5e53e2ae5618a6e0586fe58855f89a7e9c48bb2aa6f0457493bb6e3db4652e5c9eefccc1d844f7d510d7e5d7218b1bc0635268d3bb8c1e
-
Filesize
5.9MB
MD593614974811410a624e452f5aff1d600
SHA1327d03f7b1ac09dfc37b93cca3f1157ecda07093
SHA256ec9b769962a025e658db8a517347ec81602af574b73091b48f0a6db3a38e324d
SHA512ade4ad7a72f33c9f8d27f750be93cd461900e4177ce406a2c22fb9f584ede28ad5e924583fd42f280e5228821a7f73db944d1c69dd0a9a16b9dc15bc303ca70c
-
Filesize
5.9MB
MD5e3b8d7c85cfdc84911e7a92cbb815bc5
SHA10ccc6a31440af0c29cf83ddf67c5b39fff26b004
SHA2564c58ad6039a6a37d0c50c7016491a59ffba1e2f1a17c63bc4ab066a2f06bee79
SHA512e3ab1a264f314825603d19bbdd8792aa5671c089e1226cd0d857608490f7cc3ff9a282deff5b5a7094189de7417a098c2fb2501b0f1958dff372b52a57c52586
-
Filesize
5.9MB
MD5c42995b3a4212fed0bfdb8e897494057
SHA1afbe68bece5cb729417f2cc3f25153ccf9436534
SHA256a0d8538e382309aad93379a00f88d892ff23e649ed29e28228ea7447d9218098
SHA51255dcc057153b76bc830b83245959a2573b4a1e1449281b2dc05b1038155faf3030cef9d8fbb5b253ec9ecc930a6d3cd4d241ab0a6da3783b587c2d4ea6da8285
-
Filesize
5.9MB
MD5caffab6202983fb84e462c42a4f6a294
SHA159489a1124d7a64135537374c002d233045b5ae2
SHA25690d59c4a4d02820823939153b0b5e6ed1251d2be0654882567daf405fef9b703
SHA512167091c6e401764d466de336de2f713b5e5457e2fa6e2bf68baaad367ee16fb3eb165bed2643e736f236648671b80a4144d3ea38c12a8ebe5e20c6707bfdb340
-
Filesize
5.9MB
MD595dde4991502a626c481675b2276e285
SHA1b08b7f1ae7802615788c419b5b83063a026619c1
SHA256979c1ebd03e2a42cf252ac987def7c9b2f8ad26967f0268b0e77284cb38e2d30
SHA512e78975b35a414ee9dd102233a9a8fd9dcbef210996887e2acc9fa970e6b5824c1d6e733e8ec148b385f23f369eecc6bf561b8aec161b26d11e7a9703f30e6068
-
Filesize
5.9MB
MD53b9fd65c7efdcfd9a8c2460da79d052a
SHA1e46dd8261c3d90277e38fb635ed15d4a50d76d6c
SHA256f05ae1e7d114a82130643414b24ed466ff51fe0bf2c6601539eefe9e91b5093a
SHA512e4324e4f2045dd96fb4da1b8959c353bff70c980fa10bbb0cc0fc6d4c9f200e7838453f79b50b3a752a409a04bc07ec37184531e352ce0567e269a90234c622a
-
Filesize
5.9MB
MD553c1f773cc857179b2f41ff5fc1bf7d0
SHA12e725cde83dc8b2e499481f138c8db27458036c2
SHA25629647c5c2ef64c7c5f9174012807e0a413b7f6d80fae59e13ddf78840b96d1f6
SHA512bea2be37c861c043fc4dc7117fe796dddf5fa650fbc1213623e55a47ded62c1a66d5c5846c2da2d49857661d1e97908795bd3ba17b55131ed08ecb94f33a0066
-
Filesize
5.9MB
MD5f582bc911295911f14a232cb5a6c7402
SHA1725dfe42fc710e36f0ddb4f8dee58cb55769381e
SHA2563c589f4c24724a7ecf1c36b02c47b933a5032968d9c8774983498fa807dc2806
SHA512835133d6886bdf9069d8382f827f3a2f334fc57620db74a485611b0e2e5e79f37138b34235ab689df0eb630ff9a615666edb6505cef6a1b7c09a767dc98fd138
-
Filesize
5.9MB
MD5b6a4d001939013511cc14985c4a03c01
SHA11ab27fd31c6cc93cfbfacc8752b17a3c16d6fc8d
SHA256cf8433a192b615bc3d0a23307f806b6d088f88714ec11b98fb88ce81c0201145
SHA5129dd5fa628cd6de18f3f3a131fe2e5917291a8394fba8b4a0d8a073296d095c451e88da468a9153ce4ce12c7dda2d778c9ba61d63257efef699ba84c198cadfd9
-
Filesize
5.9MB
MD51bf7934b638394de684abb2ea8a25905
SHA13ba2d543c0517c58412785041a90ea6ef5ed1e39
SHA2566a819066bff5a10ed5a3ce446364b5f0f00361e9f966f5c7081d5fff5c22f6ba
SHA512c0bdbffc5f1a2cbc0097372a53e804669d6bab572eb5281291832c200022ad24da8f1758e1be86cdb7b1858365da5d7aac952fd7925e602a235f842ffe163c41
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB