Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
02/06/2024, 13:01
General
-
Target
2024-06-02_ca5e5eb0c47f9f454a8172af0b3e8310_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
ca5e5eb0c47f9f454a8172af0b3e8310
-
SHA1
b82218fd9b7cc35c64a68e238c0db61ce310509e
-
SHA256
5cfbd54efd105c01272016502b47acdac9410eb23169f3602b465cf30d57f289
-
SHA512
2f5b94f8fff73d3e23dc338101c1ec78c85895075f455e7f6293e9fa64aa29f78aff5eff13c5a2c6304aa1e7fdded1509bba51ab14e7c58e4c579e46e7d99239
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 55 IoCs
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 55 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_ca5e5eb0c47f9f454a8172af0b3e8310_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_ca5e5eb0c47f9f454a8172af0b3e8310_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\aJnGigd.exeC:\Windows\System\aJnGigd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SchBapd.exeC:\Windows\System\SchBapd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sgIJAUA.exeC:\Windows\System\sgIJAUA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JnZunEU.exeC:\Windows\System\JnZunEU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aSLtnRd.exeC:\Windows\System\aSLtnRd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jhPSXJp.exeC:\Windows\System\jhPSXJp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tncBsqP.exeC:\Windows\System\tncBsqP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZtgmsSF.exeC:\Windows\System\ZtgmsSF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vKduuAZ.exeC:\Windows\System\vKduuAZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mEPxBly.exeC:\Windows\System\mEPxBly.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uNwjodb.exeC:\Windows\System\uNwjodb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BRtnucL.exeC:\Windows\System\BRtnucL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PnHxPkf.exeC:\Windows\System\PnHxPkf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FxZCtXk.exeC:\Windows\System\FxZCtXk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MrdQcbb.exeC:\Windows\System\MrdQcbb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VZQFytq.exeC:\Windows\System\VZQFytq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YaiWTKu.exeC:\Windows\System\YaiWTKu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QGfinsr.exeC:\Windows\System\QGfinsr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cBdbFFf.exeC:\Windows\System\cBdbFFf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yelCYRS.exeC:\Windows\System\yelCYRS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cWSkgyU.exeC:\Windows\System\cWSkgyU.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD55791d75115a225b90a127247c892a7e6
SHA1080bc8eee5b82e889a0271450775a4d073d428a5
SHA256d34142320e673d86ad8b8c658c4a1fc6e29ea00b9c72dfad12b95d4bdb349769
SHA51210a648e2f98edde74d6adef781125d5373d71704c21609a28decd8f1b709d87a5d7905b32a3371e8b40054d0a234556e31f91556d5d83a61dc075676acd9f3eb
-
Filesize
5.9MB
MD561eca69da466ba7c2fcc02610fa396bd
SHA15f7ca91211122dd45a6be6df9741a3ddb025622d
SHA256b30ee4ba743fef5114bf908a7e67c9664a4c85c2d5d0e10080d85363a29d9716
SHA512fa6bf402c007061abc33edb852446e32d7a24e311d68a1b0aad6c6f2482a39f5f833e5368629145f852b698bc18617b9d288a4a98704e5ec41e58f83a1e5435b
-
Filesize
5.9MB
MD5e9d2084905cff36813e6d10c7707f1ed
SHA11bef7f52be358738e31f5aae90cbc0bce329b74c
SHA256c525d9cb901a41576df78a30259d16208522be86a286b471b233920016a58728
SHA5129454b721bebea3851a93a02cc6c3f4e2ab3ad29311ea42f3930f20be8d6c8372dc7831bc5795df539146c3cd7c6be542b25a3fb709d51b1821c35193694a85ab
-
Filesize
5.9MB
MD576e5d54765dbc7614e05e48d3a052964
SHA16caf25b5a6f3e7851eb0ee1d58a9e3fed9752bc7
SHA256728965350febc587dad9265a22096aa03800f660d45001f2aa562baf48d6ccd5
SHA5128f65192e9018c290ba82335e7326eac16b158b540ef1351c515c38950900b3defd53a36b5810431fa903a9f3bcb36acb25f8637298eae8940fc40f662d2aecd1
-
Filesize
5.9MB
MD5f3b11a9874e27627ae5d61e4451b28b6
SHA1bcfceea514a1a72ca4b76e3276a94300cd3b5460
SHA256ebedf06fd7e6f5994d7f0cb46a5be9fcc0472ba84aec707406b8b1a3edde39f1
SHA512f5bb21f3c10f0859db765ee5984b80bbad29ae2fe97d69d3246c65bc01904261fbf58ad95588fb58fe54a85e0ed201acec930bfe548459cd34dd26204949e082
-
Filesize
5.9MB
MD5d21bf1db9561b7b66dcf5c6275afeda8
SHA135836456f61a07116eb57dc0f8a5cf1c1207f72d
SHA256c16e23d5611c1205a0f5923b756b4862b1ebaec203121afefc8a6e3a3df7d3e6
SHA5126d6c427790606d029039eb7dffd8fa684e47f597ebff182030b5ab8c664825d9b6dcf5628e407747a419752953440b28e81d8c2f34be77612b833ad27b74b757
-
Filesize
5.9MB
MD5157889c2cb96a2ab2e97ebe454748820
SHA176406c16ef3c816e560f827aeb33c7d8a0a09281
SHA25697341d7c39f9364fecd16017e030f6d91454a9694feb8736d3b226a62066ad12
SHA51213369a150ee01d382ed014abeee30f93df7275e2488f0b8d141965913219b5a83d82dbf4b20b1248c7cc4d5e2ed51e666e6b4338aeda690660d6e7b94cacae7c
-
Filesize
5.9MB
MD59219cbf14545fa61b4deb6d81c03e831
SHA1ee2eb20f2ae1634407955dc1bd088b5a1e131e2c
SHA2566cfbbe3270570af9c3b739fe48b850a4418c3d4bc4adddbbafcd7423e5344c8c
SHA51299a2bd14217cd100dab2e5c1da5e086ef517c88a7e096cac1084f137f46db6cd143edb3b338a6d7f1d5d7ad9b7a4351dd82938215afbedad7b4ea516da283df4
-
Filesize
5.9MB
MD5bb5d19b3c0cacb224c78c98a99cccdbb
SHA148344a3dca42da5176b48fe45692c955e4f36aef
SHA256941d6a5ea9989d174329962ccb6f9ffb5dd553d5aec6937af4eb53563b3bb2a0
SHA5122f280b0f3da885b6b6e2d1bf9c64df78fac791f294b47f31a4eaf21b5680a650d442bca8601b0bcd38fcd8435e1de2687d65ba323cc6c7cc06e61c68faab009d
-
Filesize
5.9MB
MD5b05dccbfee0bfa0340038b8f873f2578
SHA147262fd8e9eed7666095cc7c1ef0f4913a0599a5
SHA25684a21539b6aea8ccdad991b86b7b03658336e8dd4269a02826bec7ddcbe1128a
SHA51257df28c89de492fb073ed233478f6b8b7965912e3c92400b6e6560cfd8d38f8d1374372dd7501fd949753181f0d72e751a7c85b88a78980e5eea398adb378c11
-
Filesize
5.9MB
MD5de4a21975d9c37abec502ed6c75ab822
SHA19e3eaa900730b9c27030b96064c19363f6053afa
SHA2566ab6c18912e7466a439d29645314c463d38bcafa9b7cb5adbd8a051a68a85745
SHA512aab03a790c5a758323ea404745d2d018fc1aade4b8588a242ec1c3f6e8fdf3f745c806453207e103192e1161f4ca7fce81d2e266263ae4ef471a3be67ceb7495
-
Filesize
5.9MB
MD56c028133f80d04b37dd6970893bca76e
SHA1226c809f1a9e925437d50f149c4a66567a568adc
SHA25673eab7bf54d65147db77f40091f3d28491907f5bca155d35af1276d010a56e76
SHA5124029f66628d6d580841474c2c3777f0a774e350fe55a5bf4004cb4dd6687f15ad8deb479361cc6c021ea5d4f541dbf4c8294432e54bda9ec1f5ac65e1e7f7169
-
Filesize
5.9MB
MD5e65a666d8081eb0a59680b28b661fe8f
SHA173a76a2187410b7aaec1868bdc7fd83667ccf8ac
SHA256813bf00e12b3cb0fb3a7bd619d7e221e5fe4be76cb373cc54d94266fb512ef73
SHA512480a3d88fac0aba4e050dfabeec9e2fc3d9be19e0a2057a018deb8c4bdddb259bac7fb74afb84f00292865cec956b8ed5cbeab95009f180b769b73434616e782
-
Filesize
5.9MB
MD5ae9718d4ca6d2a43d4c70a05e28e1ae0
SHA19c1467d0f83209819d1bc00206778ede6608cb39
SHA256158f74c2ecad9ed400f934d2831aee9a17981290bf60eebbffa082d2c65577a1
SHA512d19c3a550cb9abcc81686145db9be75145a66fd6113f94ad1651515136ba8337cb843ac9f5734d21a6d3d0d50c52caf6559368eea1a2c1ae8e120060ac4563c7
-
Filesize
5.9MB
MD5fbac5e88314577d3122a6e158a952ffe
SHA1fcd3393a1c4fb4f3f55c368d968b233566616e6d
SHA2563f714487565257ca8308ae056e459dab8a879a66b4ce00682f6761d5e46b72ff
SHA5125fee940b15312f125f8bdb51eb90209d3845df854e6f0d39b4e4ef5e8d3640416458caddd35161797f326efd510abbc906783fe506c0d24d5629e70e8b0eef01
-
Filesize
5.9MB
MD5dc52d8a7a492bd1d64d24f8d595bd248
SHA1b9bb575d6a9db10a09e89d5e54c6e1e4709d647c
SHA256da61bc02bdf59f4227953a748a707a496b70d69a868135e2b0e01b0d4a442718
SHA512ffbb219580c14ec4d525c6c52352e58b67ac0e4036ab615dbe44816b90ae0e2d775dc5b2c2cd1200438dc9110125b1c91732c1dcb2c11192f748bf6721d80ec6
-
Filesize
5.9MB
MD5f5f156fd00750380371dbe3df68b5c20
SHA1e8e71c508e201664e561fc1cbcdf2edc44844a5e
SHA256d0aab93db96e52970dcfe3ed5a9ef795dc19eec457dd87db543ccad868ee6d96
SHA512e664ad24a5e8902a4f107cd8697d4ce56e94447d96742ed4ae75a1925be912132f269e085d36188e6449fccefa76b33e816dc9805a91e5ccaa9f2e0f509247f0
-
Filesize
5.9MB
MD5996af320750abf634f171951325641f2
SHA1cbe1be73d2888a39d1c48c1d5f77a5bf3e83573d
SHA256db59c578963a44323986cd05439e9397c35ba0a8139dd99c47de30934c705c1d
SHA51272b35d6221496db4433a3b31e3a23204540a0b3b1b27952d463476d5f0624aaf748d17218ce3cb32603a3aee9b20346ba35dbb9500cb0b009b6d7c78d2c25fec
-
Filesize
5.9MB
MD5dbb8783758cf4fa79fe80ab9c6a85d02
SHA19f11c233878ade4965d97d6616d04886fd3f2e91
SHA25695b95aadd66f308022834fa6e4e960bba0d0b41d61d925490d8e59529b4a0c7a
SHA512b4683cd2a563e2aa8cf280cc25af1dd4a8a41b5d6c603040ab594ebfe711d7b274dda7e506d9fdd60eaf1b777924c2ffa6d571a1de4395924670806b9b5d3841
-
Filesize
5.9MB
MD5d036c2659a44cee90b8fc7196eb0d88a
SHA1074ace010daf63c6c19bb0133a1961d63acae587
SHA256674a657cbcfd484056639fa4c663ae72514852a8d05c0ea03e11308629f470f7
SHA5126f43f5e6e828bc514ac02ec99a0aea51cd7d89bc10b511d0dd3c46d328e36ee72db8795a832e584c6fe7b4859b1482ccc89bb7abf329bbb0eae0b4b6b02cc839
-
Filesize
5.9MB
MD5f7f1ad00ed3ff49707e8fa1822058600
SHA1e3fbb5315d873d3364a35a7c714d910eba7cce4f
SHA256fe5e96a552fd33ae1ece75305ce6173f24526609e42293848d84ed54aede5ac4
SHA51286c0ed09e8898f587692cdad9960b02968a551477210035aa87fcaffeaf9799e0050e7260b048a382253e1b962d354ecaa2cd7e3705ea1e33f19c9f623089f74
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB