Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
01/06/2024, 17:01
General
-
Target
2024-06-01_9939fa0286d6eec50d899d5064baf15d_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
9939fa0286d6eec50d899d5064baf15d
-
SHA1
52486e6fd95040485b7329cf23d2991de318f6df
-
SHA256
6931c38c3fd5ea1cfd632c0c300d81e346294bc9d6fd131358ad5ad5750da7c4
-
SHA512
53a62703c37eded63ecfdc4e290a03a74bb48eeea3c8031e0d5303a1ca9e8fc1e50338a1afafab5513c078ee496ef62f9a089728bed77862d5f9955a3eb91572
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUH:T+856utgpPF8u/7H
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 47 IoCs
-
XMRig Miner payload 49 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 47 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-01_9939fa0286d6eec50d899d5064baf15d_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-01_9939fa0286d6eec50d899d5064baf15d_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\RRdfeur.exeC:\Windows\System\RRdfeur.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CDarvbm.exeC:\Windows\System\CDarvbm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yOqkvlw.exeC:\Windows\System\yOqkvlw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GyukSRm.exeC:\Windows\System\GyukSRm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eqvfHqJ.exeC:\Windows\System\eqvfHqJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dHxxwyH.exeC:\Windows\System\dHxxwyH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CjiBsUh.exeC:\Windows\System\CjiBsUh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HXoLwnv.exeC:\Windows\System\HXoLwnv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jNWVScM.exeC:\Windows\System\jNWVScM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pXSBCNE.exeC:\Windows\System\pXSBCNE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WYBsIEk.exeC:\Windows\System\WYBsIEk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RPoPUao.exeC:\Windows\System\RPoPUao.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AGSljae.exeC:\Windows\System\AGSljae.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sfVYZEj.exeC:\Windows\System\sfVYZEj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xUNuTFF.exeC:\Windows\System\xUNuTFF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gzIjdFh.exeC:\Windows\System\gzIjdFh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\exqhdMm.exeC:\Windows\System\exqhdMm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lqDVDNQ.exeC:\Windows\System\lqDVDNQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\klHDXHp.exeC:\Windows\System\klHDXHp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oOeAIlh.exeC:\Windows\System\oOeAIlh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TGMUpkp.exeC:\Windows\System\TGMUpkp.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD590f6ce316cba85bd3f44fb9bc3f323ee
SHA171a7a36bc9c9e5978bf6d1d20a7f08190ebc4ea2
SHA256ae0f5acc63aad33b94ebda63bbad1970b69f583fba235911eb108618f9471d5f
SHA512de2a86a60a931a946649bb7b09a44138454f7bac9f5d417a162a40ba149502ac3754600d78850572029b65629ad2255359936b85e26d929cb06476a24198d520
-
Filesize
5.9MB
MD51dd6cc7cf6fb5a0a21689c0732674219
SHA12a5662dce415876aaa91acc48e170dd482280931
SHA256fc213dec94a64004a9e6945a90d9551dc6d931c372f475a0145af74935dd3efb
SHA51293c10141cc9cb47ee0a0a27ba40316d0cf802c71989b98dfa294f7351738e81661d3f9538d5679d2258e0a29c6878c135126f197b91c99ba546411c0216376e6
-
Filesize
5.9MB
MD5cfd80e3a11330b1a1bfa0069c8686694
SHA1c085d1d63f68d8662ff1692b5f120804bed532d9
SHA256b3c378e8d1a41462a9ec51747ef184ca3c71a7a93a4877a9aee9983cea92b72f
SHA5122d55fc60a3aff99177d598698405059d9ea5aed15700f81b61c9f19499b6050d6c4b880b2f7ba8981c1d4cc73a71126def0d4aac1cea4245eea69681b8d0ffae
-
Filesize
5.9MB
MD510a5997c78dead6dfe92ed69e3dacfec
SHA152e379a605600db3e4ad9af210bcc51353cba661
SHA2569e264017447c01a4789b0f1bc8214dd9c6393e60f9b72ad5b32352a03f86d560
SHA512a213b38fdc72ab86ca339929543adcff544ea70ae570d392a85f8b7da55d46d1cf0b0baaead748a505182e8fc856c3cb2a228d57646339791546c670b1144c54
-
Filesize
5.9MB
MD570999bdafe61208705cfccc5929e728b
SHA1f213be038393d4eeb1d2342390e0991e9f0fed5a
SHA25611bd480245c7e3a70c77a6122243e530d901f084a9ea357bff8ea2d2fa8077ee
SHA51211abd2de3c9a44ace2bbb5d08c13ff1e4a20a5cd47d4e51c7236621b9ee46162cacdb72dfb80b28a3524bfa35552f2bc1bf3e8b82aab737a0b63fdc890ab9a28
-
Filesize
5.9MB
MD56bd33f93d2d2d3f6096f9d4b9688f2b8
SHA196de9bb2bafeb5d278032e4cfdaf14529c749231
SHA256eac0dd48ca92b743cccb1b3fbd2fdcd5561addcc1bafb06c229b352537e40c59
SHA512e2d2f717332b0b8dfc43ad3ad7de35fc4f070a2e1e83230892782a197e69be6521d22b7de1d82795f4740fbf8014910825ed973039d816b428263b9c2547fbd9
-
Filesize
5.9MB
MD5b5bdc12efda685ea402f57e0ef1b26d8
SHA18f9de694139689cd3424321e32e77fce59eb99e9
SHA25619980ac78ae73366675bf388ec63add4f0690ebc365ac81eac8e2bd79e93a296
SHA5127ca4bd6dc3dc1e2716da634eb90f31842820b58461ce8345584f63130f1234623780c17d1026a42ea845e20313894338473a343cae9f0db7ded44d14fd46e3af
-
Filesize
5.9MB
MD54c4c703a464e81c929b35de99cc56c79
SHA1ebad8d1a48d9e60bbfb06b7a4e5bf6262b559996
SHA256560240d63acea6b3819a0efeac388781673353c93516cfa1f7850476ef93e5bd
SHA5122c96159958ef7706f4c68ef7f2957b506d209dae6eb7008086cd7aa9d7934715cb63e8524b483cbd250e41854706f8f7bbb8c9dee9024c49f0bf3dc6f31816c2
-
Filesize
5.9MB
MD526091a67d07a4ca7ee723077addcfb07
SHA1b527f3b4ad5c8dce189d22063976bc44cb89093e
SHA256410c77258b7ae83a27a11a29863c25d7b2d06d38a14884101246fd54625196ba
SHA51284e1cdd237fba283413f55ad59116e7171b91e1311b71fc12d25b40dc12010d860162de78c3254c8b026fe5a08a0c0a8ab64220f5bf3d7f56270fe987d738038
-
Filesize
5.9MB
MD57d6cae4194bc506378dff116d30f8d8a
SHA1f459c442ba6e0c6dacf414d55273a5b477617371
SHA2563c00a13197e121b0a20547f58224aaa0c8bdec7d833ebb09f25cb21425b29fc9
SHA512e71dc6f7c9e79708ef86f803577fa7e684a015f468ec8b53a25671a325792ee43f1eaf7e47f094406810357ad0ef03f4404398172072555f0c359b36de16a0e0
-
Filesize
5.9MB
MD5828b59124cca2ec4066179dc742f2c5f
SHA17fc4e111e5613c6032636a1db81b7733ef4cee5e
SHA256d0afc1a89bac8c8741f2d5361a9478001f9b3786884334a211b95c0d6deda3d4
SHA512476b48f8db97945d3c6cdf4533b484218638e4ad7ceb8c9967866722b1a5995f9d6ec14a06accf8f6f8ceb745309aee256043984fbb299adbe1d1b661ae6e9e7
-
Filesize
5.9MB
MD5ae76b303065d71f7fa6bc957f0fbc891
SHA19f215fb0b444355d0f6882cc8e573eae3ee73bcf
SHA2565eb78aedad8db92af7ae5bc1bf13a220cb7fe1778d368ae5af1f988bf59b8533
SHA5120d06e896e9f19137c5a5fcce726026b137b0533deed59cc0a3806d47c88d890ded7db1d5a9b82b6117e8fbb9d0a1945b6938f666c1bf4f6e1ddc889be36d0409
-
Filesize
5.9MB
MD5feefd32d839f6cb6df9630c382c0d800
SHA17faff234224678c49b0801d2fac06068eec95013
SHA256e3f8a005def19c08b7af99bb4479e84b77e5f91a3bb8c981d8b8238f0d90fdb0
SHA512cc22db9d63224fd55dbbf76613af6491dd4d112c58719c88ebef6b8fea59544ff7bc760840fd0c24ec0f2786a684fcab157d463a366039f7ed7159e1f0f489a3
-
Filesize
5.9MB
MD5b0e80db814bdbeef75095218f82c5364
SHA1c1e064f02f9e8ab5915407406aadcdb81eda4b18
SHA2565ec79c29a343b0ea5ec8f9ca334b27ae9bb4c5e4addeb79e80e9dd997a041425
SHA5126e69d2d791d1dad7b22cf31940ed29162649eeaa9d69836b38f610a3a7e425098ae06a4227c121290d8d04a6e1fde757773628a42b44fa5a722af35ddb87048c
-
Filesize
5.9MB
MD544709ee073c7585ae2f3ca253872bc68
SHA103d2504144f07cd7e3d6a69bcbabd921233c266d
SHA256f92c6be81b4c2fe9d04ece0266f2d3058011358e8f7d615bd05cd8016376440d
SHA512c52f6b470d63d291a8bb00137de9c2f649fb2805ae2fc1366a1b2097408416040cd5f5f8d0c9256e585da8b61d86006a71c1dbcd15a6e028d81faa397294f6f2
-
Filesize
5.9MB
MD5d4e6be526537dd1981681ccf5b1e5551
SHA11120de6bdc1139d7d7071a4fb245c8ae02ec0675
SHA256a48197c6bb6f7243c781652f9f884249605c654c0a982f0c60a11e17d3b0d407
SHA512a5447cffc864a5de47f4f5a4289a37a3a018d1ba47cafdd4392b172b26944865c08637d66b80d82f274ece900a34dd4f745453ecd472d528e72e6f0ecd5346c8
-
Filesize
5.9MB
MD567203355aeb0738da1b35fa90adb084d
SHA180a778b6b423e0e9510966ac436fae27be47c173
SHA25696f95fd09a1e5ffb5230368eee1db968dc30ec5002d079f0c0f44320d7c36d7b
SHA5120b967a44541e5f557ef9edae16b348c719e3835472f533d2200493fe47b7649026285fd445ade517307dcb02a03bf229e1fb353b541ffe4756cc149bf12a3277
-
Filesize
5.9MB
MD519fd6e74cdde69344cbc403967c76220
SHA1e5fb3724392574ec92fb1f5f256dbb3c81f9bbd5
SHA256c170acc11001311da68ef205f99d2994d892c702c05195793a9f3246b2a1dc8f
SHA512d24b97da6796ec0334b795176c56ac02a24b48cfd27f0cace82976c38a3b93cef97bd2c9cbc80bc10a3bcdba2a34808b749143be45ade670fce0af29b9d56724
-
Filesize
5.9MB
MD5e8746e9984439b6f894a6df54baec353
SHA145fc0be8045b407da75bafeb982b0c18277a46fc
SHA256bf2b50ba60e4cd0e5e9e5925d6ea76e6fa25fd83e60a2d04bf4a8c15d75b672f
SHA512d419f6c5f252728fa7b92ac6c460153e108453164ec928b65b2a28a18daecd2624c0f41451d334fb67fe897260ca03dff293f3696d8c6aa64b85a88fc4436895
-
Filesize
5.9MB
MD57ab3f611ac2ac52c8003723a36ddf28c
SHA16d24a484508091107f44c50e8da3f97d84c4474b
SHA25603d587d4501ee55950472f4e909240b596e8c2fa13b1ea5eb0e988e158896c77
SHA51234b75c7259d6500e2495e4330c2871c4c1449b6bc0decf1d7d0bc926341ed5eacc0134220691aeb191a4c2f52771e313c6dd5dbb8bbbfde36039037f7eda60d1
-
Filesize
5.9MB
MD5cfc748eaa4cc190822bf006b1e785804
SHA1b2deb798b20b04a031c0e68a28c57a464af92809
SHA256d59e39374c145abf36c7a8c79e7734f36037b9b76f3549a7e59a988de952d2ad
SHA512b31ec562caad68ff000c05ee11b76c302e2ef71469fd6e8dd35db9aa42d76d196d54e3778746cfb5d614435652eade6274e0f2d873a434fc71b0a443e440aa64
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB