Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
02/06/2024, 13:01
General
-
Target
2024-06-02_ca5e5eb0c47f9f454a8172af0b3e8310_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
ca5e5eb0c47f9f454a8172af0b3e8310
-
SHA1
b82218fd9b7cc35c64a68e238c0db61ce310509e
-
SHA256
5cfbd54efd105c01272016502b47acdac9410eb23169f3602b465cf30d57f289
-
SHA512
2f5b94f8fff73d3e23dc338101c1ec78c85895075f455e7f6293e9fa64aa29f78aff5eff13c5a2c6304aa1e7fdded1509bba51ab14e7c58e4c579e46e7d99239
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUs:Q+856utgpPF8u/7s
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_ca5e5eb0c47f9f454a8172af0b3e8310_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_ca5e5eb0c47f9f454a8172af0b3e8310_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\NbudblI.exeC:\Windows\System\NbudblI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wsHtRUV.exeC:\Windows\System\wsHtRUV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YVnprWf.exeC:\Windows\System\YVnprWf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BXJwHpS.exeC:\Windows\System\BXJwHpS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FyfOODq.exeC:\Windows\System\FyfOODq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SfxPLmk.exeC:\Windows\System\SfxPLmk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FLnUYvm.exeC:\Windows\System\FLnUYvm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CInvwtP.exeC:\Windows\System\CInvwtP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ndCeNYZ.exeC:\Windows\System\ndCeNYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\atGHQUm.exeC:\Windows\System\atGHQUm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BJQwgNw.exeC:\Windows\System\BJQwgNw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JZKhGDV.exeC:\Windows\System\JZKhGDV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pFmueGc.exeC:\Windows\System\pFmueGc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wTvkNKO.exeC:\Windows\System\wTvkNKO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZjuifcE.exeC:\Windows\System\ZjuifcE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lSSpNQv.exeC:\Windows\System\lSSpNQv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JPvebdZ.exeC:\Windows\System\JPvebdZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TUUbGEM.exeC:\Windows\System\TUUbGEM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bfccjiH.exeC:\Windows\System\bfccjiH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qZFmufH.exeC:\Windows\System\qZFmufH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rwuERGx.exeC:\Windows\System\rwuERGx.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD526f1d865187a9dbcb5de3836ad042b1d
SHA16c1ee97a7ae000d2df3b1ef78717659cd1195f5a
SHA256aa8dac382e130cdebf5d4752afbc07a6392d1266bfa47880198fd51fb67c5a5b
SHA512a8f670784183a1e5458447e000eb3dd9c490f361ebef7eabbcee207b3e20808ae127446537ded3f4f1b7da68340d50d16867506688c2b44e091dd19ff4e71d47
-
Filesize
5.9MB
MD55fe09abb34b7b147ccfe1b468a8113d9
SHA1cf1b9bb513dfb2e927d4c1a7d5483712ba3c5fd1
SHA2567350cebb6e395f2eafcda0df51ab0057c29ec17ffaa86da6436fbeab35a56a20
SHA5120eb41a57863fbe1125066932cd07cae0630b8b63d4256050a7aa40d7061723146615ca6d89fa572bcb6cbf5bec172e6b31e33683f5459027901aa395ea37818a
-
Filesize
5.9MB
MD5a7a3d46da961acc7f87cb4f9cba78309
SHA1b492f5121552701642c302a43c9323e9335ecd3a
SHA256b7b6331bbe98809a97b52c43a01f4913df541c36cf751947b4c9a8be287bfa85
SHA5121b262a20804046a6fae47e9a4791bcc9183b2f2354b9ce582d024985e72493580a3d6134f093585b6fb46a4ad08f63a15fa92ba2aaa9d877e02c79fae140ea7a
-
Filesize
5.9MB
MD54b5df2b2997ce109e66e6feb873db1ec
SHA17436cf8f549a5839ce2074340d29c079cb20dfc1
SHA256dff5d280d7a4059f48960d9c5da219431a35b4530fa462fe1fec69413fbf90fd
SHA5123ead9419f42c7742140d9ad120ca982a832d8b217b168c3a6a7738ed26e11f8cba659d0972b0cb39cfef436943655ac1e6cf1f74c684930ffaf4efe959eac6ce
-
Filesize
5.9MB
MD540b4146ca9f944c6e5ecbc1bb171f2d6
SHA19b79fb6c8c3284a82bcb309094b29775c8b53398
SHA25694b116cf355064f4684f0f679927ada612c86ee3ef60767c5fe960632ac5ba0a
SHA5125dc021524c81d1afdb2d1d8d8d77b1f1c50945e4e39cc5b9450a356c7a1863400c30ecb6152777bf248a8d49056bda7facf6841aca6efa8cb605e9e2483c4cc3
-
Filesize
5.9MB
MD54baa30c1a49255ba2e538e87dbc383e6
SHA13ce9abc71a4c4a22d1f32fe0c424007d7620612c
SHA2564ef317395185afcffb0e7c315c19186a468a17885f7307ff89f2e1718dd1b151
SHA5120aef0bbb58c050d39abd87ab12d466b87cd55c908cddfb955b0d38902a6ff54f0e7cdb38885938e882d70916dee69bafd6df57b64734145da2537b484380cd18
-
Filesize
5.9MB
MD5b19129daa0250d8aa76aff0e62464fa9
SHA1c621619b376e1c755fac013976fe73082d07e481
SHA2566d79d3cbfbaff03f00e6c5be705ee551b645a86c9554ecd3e0d458559ca1ac2d
SHA512327bc337cf6a00388ce99006b1efe21fdebdd665acfd16f833e4fa285484875bc4986353bde326fa33783c6650d4924b0a2c0aee951357d6099ab9d8dfef6f67
-
Filesize
5.9MB
MD5f3352ce4c172be0657463b5d89c69cda
SHA198b0905e004eaf5922a509ae6d9dca0fa317eea9
SHA2569fd2dc1ac4695530c623dbf58d81d641b6d9a742594cf51b7f6bedefccc9ce3c
SHA51268bbd6b3fccea2d8a06bc33ff43d8e95472e93cc70692c6a8a802f011e6343d7093d5db4106dd68a1055612b7fa7c809a1b2a0ca5b10f911ac85487e97f8781c
-
Filesize
5.9MB
MD536b151abfa9442204b6d7d146d7b02f9
SHA168515ed5f0fd3987ef0a44db6cf5057744f77a19
SHA256a3b33d593fdf534fc99f7f2d76922501bee6efd3bd15e396e590d248095fc5d3
SHA512758a05631fe182cf5f5419b961859be1d29711f9036e4b3265240de9b2c3615d4ee4ea07b6655312659c1772a303598e97f4f463349221a911e35e01af2326b1
-
Filesize
5.9MB
MD5b92ad4031071711e638346ddb8c3e492
SHA1b95e75c687c3b6a48bec810e96508156ba23468c
SHA2565b44134fb474a062301d8beeb92f645e9acfa911c59866b30e99a6fe1521b5c5
SHA512c6a414be7f89a6cd46225891f322582939b23d71a4e1d156e666824f7c94576915202756a2c27ab296f2de8495f35e6c96a3a116294f637c65c58bf5b995e9bb
-
Filesize
5.9MB
MD5e53e73060800e97cba05f1b0d721a0b2
SHA1f9383344477deb5debe8d912673f7b859a9003a5
SHA256b089e193a37a05ad66771672033ce473651b175dc0d290bdc47ad38a5ce5bcbb
SHA51228660a53150df3c7b2af5318ef67ae10c4aefeca2e41d158a3a42631115a5e4efc98a2867c358a88910957ccdce414f0894d05d392fc4f423e9e9e7aa0796307
-
Filesize
5.9MB
MD59aec43a63ab75efcbe18fb4d461ca8d4
SHA188a40829a8d465259e2181e2805e93af222c2e7a
SHA256b8e5bf0f5f2b008a237723a3945a3be561282e998fa4232ce1c4b73bf2fa8b7f
SHA512cad132ccfe55006c4968a7bbdec6b4cb17df11c23c0e95cf2dcdbd06973481b29806acaf17836dc768938d5ea3f5896f60ad401e79c8b12016283e03570afa85
-
Filesize
5.9MB
MD59aa2c6117b710db8fb4a039c17e09fff
SHA1614c3da586068f98bccbe63fce7707478cf0e8da
SHA2560a0cb661aea779d47d7b963e4ccd934b11906f0dc5e3a950a68ad96e71a0044c
SHA512a291252819305886ae5114f5a3a1125941d8d8e9a5ff7029cfc4c364577dd758533d1cd60fbe544d4b271eae26be7821a94be81cf23ca7769fc880d184104137
-
Filesize
5.9MB
MD50fbd435fc21020e0cb743b460238ec83
SHA1657e1792b90f25a774176f4adc22281602fbc16c
SHA256cefa5c70bc7a723e60298a326bc67a5d470e561cf8b87bee7164339d5e5a1a83
SHA512b8cf52f45b0527f718fb4eab9f679b7eea2fd1f975bda57bc2acda60aa0bcd14436baf415640966be539c9d642d656853b01312cec30d28f74196a883602474b
-
Filesize
5.9MB
MD5ed1ba7ef83a121445b4e3a1b905585ed
SHA1ec278959e0ba710f70ec6089f74eb89576676856
SHA25668cee38f3211102df3dc1533da17b1e36bd1766bf525826b38e0aaae62136173
SHA512f56312948051c1a6fc8f02d1632c619f828e1464d27827e12c859c3fa18d90886aafebcd46b41e2df9af63625c249dcd77e350964f10a3e789d72a83e6a64cea
-
Filesize
5.9MB
MD5e43d79c133534d0db56557df6bb1a8de
SHA1ed08ed9aa22abcbb0a7ba32ca1c2ac887185b6ff
SHA2563d19427dad55dc955f6d8912ca8b5d91f8bc8ad03a343c886b1413e1e5fef771
SHA5122bd0705f95df75c5a97170346d5ef51b22c5f9645e836f79e507e92f186e5201eb919f0a3130931ae735fc49a6003971a731476eb4967ec00e1e0e092af2c629
-
Filesize
5.9MB
MD5702ff1fb8fa2c471ef0c5a838ccfc724
SHA1feebfbccc97cf4615fd31bcd87bf37b61fb417ab
SHA25649ac8a63cefa6f8e51f435e7cd52180f7df681ec644b11222c9e66cfbc143568
SHA5122250cb6dcf45caf1e165b0be7498d70f7240298e6ba6cc8f9f898ff89a3ad7c84a397a7d6daabf7851954f4d51311b79c10121e8928a618fc9866d77b998fa0b
-
Filesize
5.9MB
MD5b93009230e258dcbe468410d0c2359f8
SHA159cf9771cde658cf59637102186f1c88f4bcec63
SHA2562265cb0e33123623ae71ac965cefd02620a2b75b1d1a582291b481ebfbda5886
SHA5129cc6d3f6b691cad5b2a1a57848c4e1c15612481f48c0fb6967974d01098591ad08036ca512578d212dedae7cea9af908b0ad197e3a24918b3c84ecc7f058de72
-
Filesize
5.9MB
MD570a8bc52ffd09a80adc8ca58b37ea3eb
SHA1c2be379d8b66a9a8918895b28b05472463256402
SHA256cc79da4dbe5e640ba4d41fa345713e3d131e83b7244f5cd31507a727d7507300
SHA512942ce88e4077c15ab85986f019d9d2df9df7d04baf4500bb7892494e84ce3274a03add6a99eeb7d13974a9eda231872d80344037083476e16ac0067865b0f8b8
-
Filesize
5.9MB
MD5bc0ade021424d0463f09f232610a9900
SHA1c84cfbad95762b1c94b78f8736c832e869d8fc3b
SHA256113b3b0ce47ed9461067be1a0a40363cff41fa4f9d92d7e140dfc79eb61fe0d9
SHA5124a383e82582e411162e41e33a82d1fbee4b793a9d42b261230ae58ba82de3f8837014467ba5335ff9328f8a0ac3df488c2c3aa3a8db3fc76f61f423798f675db
-
Filesize
5.9MB
MD5f12c20155a1833edc000321beb395ad1
SHA11942f45b142c77ca7eee2ce73202c5c5c7c04871
SHA256ace3fc1de059fdad6ce7321b0fc682dcad4491edc8a3e7e2100e6eef36cdd59b
SHA5125bb8dd1c40332abaf65ebcf17d5abaa9140a585adea03b613a274174c34e08dec2744f00e7688fa30f1fe8747209386689431d9ac8c0bb49749981f3b3417d32
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB