Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
01/06/2024, 03:36
General
-
Target
2024-06-01_438176bd096892c7be381d2b9923bc1d_cobalt-strike_cobaltstrike.exe
-
Size
4.8MB
-
MD5
438176bd096892c7be381d2b9923bc1d
-
SHA1
2ebd6a6dea041b77185dd1b211d3a205b2c68f0a
-
SHA256
ffd35e982e0e58edf703fb99358a1996c8dd4f977016abf9bd45b753f7a3dd68
-
SHA512
44f5d436fb44f138367ee54ab6d4e2a7aa2cc2a0d81c0b270f00d51b4a5bfe6e2cd221f14c3c63fd3f8f3eb830ec9fe298f4bcb15135934002a1812141a9aa3e
-
SSDEEP
98304:SW1qiPgxn+cuSuxx8Svt73qq36IdKtVxNw6pUkp3bkbRxCUe:53EnsxxDt73DdKrwapwbte
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 7 IoCs
-
UPX dump on OEP (original entry point) 9 IoCs
-
XMRig Miner payload 8 IoCs
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops desktop.ini file(s) 9 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Modifies Internet Explorer start page 1 TTPs 4 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_438176bd096892c7be381d2b9923bc1d_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_438176bd096892c7be381d2b9923bc1d_cobalt-strike_cobaltstrike.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
MD5ca0dfaa2ef19c6943f408c9e02c3f239
SHA13bb3accf2b0d9bf0f6b88495593013f1de807e2f
SHA2565f21733b01a9a088cc08add68fa5c394521c22c50e1b29fd95cb2c8da00d2cdf
SHA512c1769188d5f31577b4a8b546964aa06b53c1bbbcc1e48a33deb3df0ea1dc8b8f6c5b2c37807b078681eabb964feb9551e8280fc356f640c0b945f89322a1eb08
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
230B
MD57f1f863c2e4988d01a06e0a27b972856
SHA1c866737d12c5ce80448311b2e15d6e9e5ec554fb
SHA2560a952643c2613f5ccfcd95a079bf83e998f92524f535d83ccc3816139f1566f0
SHA5129b08bc38a6f6adf717a07667342fdcd8b709fb8c88d4cf1ad30d040c71d65e229795646619dccd269791a39e6e166ac89c96912014492148be1baf99191c3790
-
Filesize
342B
MD5990a87f0286f8d74829e1ce4767d3400
SHA167f7038f8292bc2e71ef467485ce0cac7b33df66
SHA256f6674898bbf19efbe19852a11a5d3865da3e372a4eaf34c07e61e7e5fde99be9
SHA5128fb4844916afa1b5d8f892a8fc9de5e46e7250045426bd10346f38c739021d03f6677d63cda8e9994c399e6e227e9837afdf614c374b8ea3f6763fcb3f126210
-
Filesize
342B
MD59d12949b7841a7340aece6990b6e1c1a
SHA1b68b0a48ba2bbf100aa6b61fada0c2b9e010c8a4
SHA25686ca3161a027e682bb60a0ffb8dc98a6a9f6d41367322b11c2425834ca172e31
SHA512f82b9b035e2391eff3493b0dd593b50671372e5d8207f3071b10e9216e37faf6cb7b584d4402a1e7525f07511ff89bb363b035c46c70debab5da493f6fc834ed
-
Filesize
342B
MD5b408f1142a942fb69fdad180276c3072
SHA1c092b17a6cca16aba78819315abf5631b953d220
SHA2563c902c790d75d0a90d9ae85f5dbfd05cddcc82d08192bf92d36f66d6369d9ec8
SHA5124c3bbeeab364a78d5365f2af90a36e980b3cea3ff870ba17ceec9f08efed55ed0d48e76eb93f1a0b6ebd4aac2135cd1d44f6b6d8196667031cda1975638dfbef
-
Filesize
342B
MD5d8f43cca3b69d513df8a1bd3b87f1b0d
SHA1adb8becd4606b67526bb812af2d9817df9bbad69
SHA256bfea6bd1d3b9dc527844306e8fc06f58e5dd46ac9f17341f70df7c875ea0c3a1
SHA5126dac7209910bcd4458edda23e963daa066e28effd87eec02f2d58b32ba08085ca475d52604a9db17f61cdfad22a5ddcac4badc8a0d408fae516f6a017a8ba2ef
-
Filesize
342B
MD53ac274292123498fec4d74f09f461c43
SHA1a47411967367f45ba4b220b32f2946807ba36f4f
SHA256dcfc87d9a44e51fa04c83202fa965f7253ee0e52414f8653db6d97f40f471336
SHA5126e74e77bb601023a52851e1ab36fc5fbf26919f51c72eb37b5203b7e277df683e5f10614e70023360b00f06d8cf5ded9a44f6a2c8765a399bb9e0b23fa3e59b5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
4KB