Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
30/05/2024, 18:23
General
-
Target
2024-05-30_065763a67479bb661c6a95ea07408955_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
065763a67479bb661c6a95ea07408955
-
SHA1
6053c74c6390cce0eb9baf3828eeaaf8184e80a4
-
SHA256
fc240af07e73a4f1ebe9b5beaf1f820e8ed23bf75e3be627eb6c1313bea1815d
-
SHA512
f08138d885a896e44b6cb8cb20e3691bc688178ab64fba5cbe03cbff7af0c9f130d9d7eee86a598b65ed3cab69268ef2866b2bf53e8c4e5cf2945448e2f122c6
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUQ:Q+856utgpPF8u/7Q
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-30_065763a67479bb661c6a95ea07408955_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-30_065763a67479bb661c6a95ea07408955_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aQRSgoV.exeC:\Windows\System\aQRSgoV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CXULgif.exeC:\Windows\System\CXULgif.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fxDqSmn.exeC:\Windows\System\fxDqSmn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XisYWFw.exeC:\Windows\System\XisYWFw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yHlGUtq.exeC:\Windows\System\yHlGUtq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uRCBgFh.exeC:\Windows\System\uRCBgFh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oAaSkvI.exeC:\Windows\System\oAaSkvI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sWjpmFf.exeC:\Windows\System\sWjpmFf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\adltvjD.exeC:\Windows\System\adltvjD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gzhTWag.exeC:\Windows\System\gzhTWag.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qZpCxHT.exeC:\Windows\System\qZpCxHT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kfDzjLJ.exeC:\Windows\System\kfDzjLJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\shYjVgT.exeC:\Windows\System\shYjVgT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SpsebdN.exeC:\Windows\System\SpsebdN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gmflafR.exeC:\Windows\System\gmflafR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\onhUzPh.exeC:\Windows\System\onhUzPh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ValmEUO.exeC:\Windows\System\ValmEUO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYwZHMQ.exeC:\Windows\System\sYwZHMQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\etPLkcO.exeC:\Windows\System\etPLkcO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iZaIPdE.exeC:\Windows\System\iZaIPdE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MhAaZSv.exeC:\Windows\System\MhAaZSv.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5766c8f3bd6f783d8b00fec66ff226b4a
SHA1887c07fc66ebc9d964f2f985b16c0969ac898078
SHA2569a4dfc2c17fbf6475b4e169ee72dcc3724ed490e70ea92f473dcdd16ff8ee5c5
SHA512a44a4d893f0e20dfc487373fee6a1d306656595829758dce85b71de6dc64497003fc79f6593eaad1a7e40b25c30c63798dd186e61d091cc7b7929578471c9ff0
-
Filesize
5.9MB
MD58a5bc68c4c41d6f32b90d5b72546ed53
SHA1b1eab8d982396f68caf6e2e8cb2555d60a55ce8c
SHA256ab90cdf070fffa86e14d64ae89ce54307984c8566497959ed08d0a8345053873
SHA512dfc880cbd519db2a4f7689c42dd2c2df667ebdbc4e707c2e12dfa268c1a863c7dc140dcb563091338c2c86f927444a7589e361a2c458e5dc446c9e86b12ca699
-
Filesize
5.9MB
MD5c2dcfd0cf1f87eed7c961b30826aa472
SHA19ac1f7178c59baee86cd4b1f9b0de8fb1e43afa0
SHA256be49b8eda54898455d300bec6b3dc2b56f3a5c676c9d0f1aa8ff39a91c531237
SHA5124cfcfa7ee8dc324f5411c32326bb4a74aede0a29bdf680e97b0138199f1b12d095ebc9cf6fdcf7b75d406fc75f4b5906fa5f7b6a430e400ef38b28fa41e7691b
-
Filesize
5.9MB
MD54673a3516b7d539b0e81aed0dd4c91c5
SHA19b0ef2faf5e09a543c49f600f439a617463ca8e7
SHA256b1be3b7959f309aae969eedddeba41c39df4285a3e81d7d1f4946a0eb83608ec
SHA512a1c99b872acc8d1e3e5a08773b93bf2d9129d9f3942f420887939f8c10ebdc7723818ae368e1159e0a628edadc119ef9c915edd3469968105f0d0735457259ab
-
Filesize
5.9MB
MD59c9f6d87698dad8a4a320774dc4c8e5f
SHA151bc102809d49019421d20628d4710ff098493f0
SHA256c014e410329d71a98715b71f6f09ff082037fcff5865ecf9b3d9cd4221346960
SHA5121a723362b4f42be967d0bdb2743d553730411baa2c7670e9433e3672f05be587020610fc225afbd54001cfc1c4b6c6a7ce15f0c125ae573d83ef2c658cbae584
-
Filesize
5.9MB
MD56d61df7eef0dd815def29d6e90aac4ef
SHA1e03ce73efc2929d90b7a5ba3526e462dc359f298
SHA25628daaa2ba34e5b504825ee34a44deebec06289834ecf2b876e767ed4b55c671b
SHA5120e13b95cca7050a46af607e0f044bf9f03289b9d029a8e6d5a4b5291d9df37b3e57ae1f00e1613b66dbc95ab278b906e7e9013cafdee39232b278fa3774a92a4
-
Filesize
5.9MB
MD56e627a7003d000d502da97ca69fce858
SHA1f6a5a3f42c9b17e6484daed4b4913eddd5081627
SHA2567d47d0c81cb30941c2a2b7e1f9c7be94f44f2d9aa164babb1e8db692d1aa44d7
SHA51262ef0907b70415aecbe72edc0dbdfef2759ea621305d099c939ce61c76108427bab19ed49175b96ea89f5dd3d5249b554ed103c18ca01d1f1d18883ac39f3c15
-
Filesize
5.9MB
MD53f306fe32cda450f223d0487c01ce60d
SHA1685f151dc5bcec82de52f6e6f74d677ac0918126
SHA2561e4d8b3866b58b2e5a37c9edf0316ac938d5353b470b7a391cb60bd833fa8bbc
SHA5121f1c4fb5c4c07ff5daa81741cf3dcfc1fcef763259102cdadd48cd4c7deb98051387e8090744f5923fd8da2b69e825f89c0184e5b28f978129e8da39188cb922
-
Filesize
5.9MB
MD5b6f37da93b0ac2998847ed2f61475837
SHA12f83b7a4ffb8c399aac4269dcd4885a7086509e6
SHA2569624ca05dbfe7cc77f7d01143898ad7a3bd86869ba53c8b0bba97298086e7c22
SHA512df3a9c5da57daf94bfb2bc2497c74dc97818a05e667e293c13d801f475afc3d846356854f534f79a33b9d5ca58b5a6732fa002635710fe33e8207458eeeb5ca8
-
Filesize
5.9MB
MD50a54136103fa01c33ed08fdbaed71dea
SHA19dde17117762926a6d6a4b0f4a8dcd5ae43e7748
SHA256425b4646af5ee8e949c6d966d4289c5531d08c5d1c52b2c1166a77522258c674
SHA5121f28415561cc963587106e38d4ebdc475350cc709d0efb435dcdc4a49e6dbe4be3af11f0d9818810beac55e6e82f6602ca512dc0e244fbe8c623b3923caa6bca
-
Filesize
5.9MB
MD5f4454fe7e09885b4aa276fd11ba0de1f
SHA161d5a1541248e74c47315d809985611c31ed02d2
SHA256c40f269ce893250a7dd4ce4fe1e4a4c2fb3c0643d0fc65e73b0164c49bc16c04
SHA512610c214fb5b7d3ca19e41d19cbd6e3048694570be1e4cf07a33ef78c83a09b52e2708581f1db896366dd7786c6f25b468fc111cc0b14c5bb6392bb2488f1c3c0
-
Filesize
5.9MB
MD5e276866998b2e76d47424aec1ef26555
SHA129823ce0be542ae7312db41cdedd110830a0c7d7
SHA256388387f9c4d9bb74ecbe059b12ede1c10032b6e59fcffd7fc7f699581ab23d3c
SHA512428254897f17d9601b4244e72d304dd9f856b1b929abfbc20260684f5cef153b9be418a0172e032fcf575393d97a26f748fc0c279c75838cb2fbe2835c061b25
-
Filesize
5.9MB
MD531400833a55c2c85ec0bf21465b7f9bb
SHA11499cd53c8d5677013370cab25c31a56eb5e97ea
SHA25689c4b275571670d66e4bfb2880b04ed945759da38debf4b3a5d0c2f85065ee60
SHA51251770ecca290882f81bfaee22d99bfc1bb907948462baf54b1c49c09aa9b7b38c40990d42bc6e08ad9bfe7ce7b4f494430d0486572d4e85ce5ab51517a197efd
-
Filesize
5.9MB
MD5429feecbad48590282507e704b8c18bc
SHA17ad187d228ce9898109cb7d5a47fdfe2f04d3fa1
SHA25685f06da6f4a876d26796b97340006734bdcb255de20433b546af99320e485907
SHA512ef45a29d490f6838ce0cf4d89ad21e14b164876cb84c66cc6e30b8c5960849c54c6e5c11986b55ed22c864df5f619276e18044d6964a668d54c3809761fd6ee5
-
Filesize
5.9MB
MD5d8cedfe70e5bc2e558370dd76b59b9c7
SHA10fb708cde7feb594d1ee8a913b70a2ea5c58ac52
SHA2563a365743640cc66584059554fb4e06dfca369835ffb3431f09d518ff73bfa4f5
SHA51233de35652cbb4decdfbe1dfd79d337bca758368065762b0abe979d934392fdf34b5dd61394dfd82b7db987b1245fca616cdab820749cbdff35cd5d7ac7dca209
-
Filesize
5.9MB
MD5b1b22c1b8e38766c398fc78c2268fc76
SHA10e71ae89d5489fcfd05df9e6c79ca567e11d42f9
SHA256d51079cbc1b4e2b828b130836309d422bbf70912127d994a2c6a5fbeebad941e
SHA512daa5a8c8995b193cbfff68e90663ff080470b9c7bf84352f672cc960779b78f902157092f7c3c08cf5a2dc183fff9422ce424e6bc03c9f5ce26c269b5db39a5c
-
Filesize
5.9MB
MD561c05241a3d393ddcd483a3bbc7733c2
SHA17cdab423acce8f23fafec666421bd1414abc85e6
SHA256969f3424e49401c6a42f67fea73f05a0747d7fcd6a97a20b7820955cb504b11c
SHA512f3a67551fb3490a39283c5c9bd5998ce6329fbe20cb0d500a1dfdf0979b85b28d14316c01146895053ec957ac8161dbde122fad9501d6a3a704467302f84fa6c
-
Filesize
5.9MB
MD53fe9b7e631110a456dea2797f8b74a2d
SHA16811eb8b7cf81e95e8ee16d6363b1bf44c7f8ff9
SHA256135561a30d44d098be66b05d2afa4276384ca6627ba2d74084d9ecee1f0992be
SHA512d23c17deb95c130b36604b32d7daa2600c72223cb076049628ed4045dd63e0ff4d23faa90cbabca5985674fcc2f513ed014bc4dab446a118ebef254320a2aa0c
-
Filesize
5.9MB
MD547399b3f2a7710e55d3bf2bd67125662
SHA156b9a7d6be64608b8baaf69cce923e64f96f28a9
SHA256e68bf76f745ca170ec23fc484a4e15d9000d889e5f6622b3bd0670f5c045ab25
SHA512416efab90906d88b2901d406c2880d050b2503a01553126adce0429279a8710157824de4f6a22777c067da39dc622a7c7f829b49ca7cd33ab7af72cab57a17c8
-
Filesize
5.9MB
MD5b9c171c7ddb2fae6e7275fcc6c497fbf
SHA15e1971b0fd3f41c5c4b6c6f0927b23a2e1580e09
SHA2564624bccc42a99935456349da4d6651508a2abdf3f1b9d56da3fd45105669548c
SHA5121342e11ed7067db2f88a81e8c6a121f017933a37565295833bdddb43c58028ac2393ed0adaacf98bbb5666810461257740887b1fb0d41e39e83d470de6992366
-
Filesize
5.9MB
MD5df7a2a78315dae6daecb0107254a0a41
SHA114fcc92fc4ffb8c57a0fb706ad8be6ece84852c0
SHA2562242bc0ba5682542a0bc2ad958d3c11e0e664c9373b4e2e89cea1d3c53d5fa47
SHA512e83a69a3fe6d93fa67f663e4daebe521beb1cba98264218b2ff25815b8094d0b942fedee5a8d237299df24079a8bc6acc53a662538bf4e3cc7f30ea0d43dc933
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB