Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
02/06/2024, 19:38
General
-
Target
2024-06-02_cc219612674837b8e7c41018164b8802_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
cc219612674837b8e7c41018164b8802
-
SHA1
ad0901147e27fadef60e2128df8fea8eecc2428f
-
SHA256
17a5b395d4c4074ed27e4eb021aa0727b600cc5ef63b490c109cfc2ada101923
-
SHA512
882c97f9a17d742397f885d07c06bad635bba98462a13921eb5ef1907ce0dcdffec9855cec771539c74b95ca0cb2d50a7c8b20a0280e4675e41f5bff3df7e2a0
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUn:Q+856utgpPF8u/7n
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 56 IoCs
-
XMRig Miner payload 59 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 56 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_cc219612674837b8e7c41018164b8802_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_cc219612674837b8e7c41018164b8802_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\OuwlcVy.exeC:\Windows\System\OuwlcVy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jkpWKTf.exeC:\Windows\System\jkpWKTf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pgdfLHj.exeC:\Windows\System\pgdfLHj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QMhdQpt.exeC:\Windows\System\QMhdQpt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CblELAU.exeC:\Windows\System\CblELAU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RBpCJjJ.exeC:\Windows\System\RBpCJjJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ShALcbP.exeC:\Windows\System\ShALcbP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cdlIcKH.exeC:\Windows\System\cdlIcKH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\djUFyQD.exeC:\Windows\System\djUFyQD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZsMsfdD.exeC:\Windows\System\ZsMsfdD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AYWWAhJ.exeC:\Windows\System\AYWWAhJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NSauSza.exeC:\Windows\System\NSauSza.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eubqaeD.exeC:\Windows\System\eubqaeD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tCZrNZC.exeC:\Windows\System\tCZrNZC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AnuNzcS.exeC:\Windows\System\AnuNzcS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kgZgpET.exeC:\Windows\System\kgZgpET.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TTdxWkN.exeC:\Windows\System\TTdxWkN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EQugsAu.exeC:\Windows\System\EQugsAu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JNYAHJV.exeC:\Windows\System\JNYAHJV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GnIjkeV.exeC:\Windows\System\GnIjkeV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SjfyJaq.exeC:\Windows\System\SjfyJaq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5941eaa21e459c6459018053c2b25420a
SHA17789f39272e1d4da2ea9b7269653058e40f41b83
SHA256f21362508e312e3850778c7da60dac00f128f375fb2b21a2b182033dbd8e08a3
SHA5124bd23be0da9d6b5df4f8f40be876f4a3d6202576af5c771116ca4af200be83a076c41a6508e0eec7cb0d553a866016b25be5252c8198997e35c06ac732811d44
-
Filesize
5.9MB
MD595d3841fe582d7ca01c0da3a741faf08
SHA1aeb969ec23525adf5fd566cfdb162c9c5491702d
SHA256dacc397a8b616be5813b310c06e2132e3f36a9fceb6d80505004b7ce759bac99
SHA51208e0ab04551e661854c25cb08af752a4ac39a0e7eaee80cd1ef36538381f5b7b8e4b3aa247d523a7e3affd767f4f1cfef9f5f421bce2e57abe493eb0c7a61a77
-
Filesize
5.9MB
MD5cf58a4cc77d7565b338593be8c4a8471
SHA1116503a558945dbe269054c0b8cb6c7233fca1bf
SHA25673071a80b7327431a03b7fde34f34dac0de67ea92d4c92c6d44e57e4457b411a
SHA512062b58ea7b1e84c6c5ea453646cd4b589c21d81c95daac2104b01dc28a9c9ba431973c2d438c31f4ed85f73c8b7c96cf08039d3524111252cd885f05e2d799ff
-
Filesize
5.9MB
MD5aa4d3e4acef4f565752548cfa6dedfdc
SHA1ec6cf7c5b7fd062044f90e742023d83d771e654d
SHA256cf5a234b6e90a20379b5369bc761fa372a7a94e64f8eb8669addd18b28dbc128
SHA512dc968e8926dea4425cc44af86d9ef7968b7f20f72d648263b426fe05773a41850c76251f1e74cb4e0f1c323937028cd55775577a37126ced21715b3af7d7962a
-
Filesize
5.9MB
MD55f39316aa45cbbce1bed5821a9dea47a
SHA1a76d908d43c26f6b9d8bc99d1c13767c2f0cea2f
SHA25614dba1c9d98f936f3564204f1d0137b5699c5978f6d317b7fbe27d1dc826dabf
SHA512a53925441e7375386b044e918c912fba903912c8e1ed458e205c177644400c2f85c71b8a3fce60dbd03c88cc39654544b2e4b801e75b9ef24f1d3e58c99b8b51
-
Filesize
5.9MB
MD541e2cea0e32a4bde2805a87d34fd836e
SHA170338e3e0df350346523951faa7c2f5f72896378
SHA256a56203003380f97af14738ed91d90fffb0a1f43cb903e8bf55f2d550bf528811
SHA5129d390ba344b216adbfa35497896d1a0a7bcc791cac4e16beba6ab17afa87537180771b1833e1d0703f5745d9637025066f2bbe54fc0f471eb2ec78303127c652
-
Filesize
5.9MB
MD52d6ac927f30d07b4b4d68683ef5afbdf
SHA14aa16fda646414ea2a61c9ad045a11ba8ac6a645
SHA25674029a31ff00ea52a345ec2fd6882293f62c1eba65689b327351a18c2e6e5119
SHA5129f6f6147cd174e79f0def87911537221567ee630be7432177f723bdc6af7f22589cc422f50bd82ca33fda91334975469f4270d32b743078454204a9d923be4df
-
Filesize
5.9MB
MD5a84ff765272bcccca91b7c66c3ecefdb
SHA10141541914a0ba00bbd60352a03d3681d56a5b58
SHA2560d3995cd902484f803360e29f8fd8ced329cab7216afdf32b9fd10315b845e0f
SHA512e4802756198f8e56e22bb206fabb030466fb2b8605710fd66c86d063c26edebb3d289081634ed328a4d619b642e38f30099f3d5a3d33207335f1230268d64c18
-
Filesize
5.9MB
MD5a3320533fc018d54163559e587699138
SHA1d69aba67d9a8930349ad2751d5086695588fc68e
SHA2569d1a63633335666ffe8f0c9dbdecf9e53c846a3ca50b20cf69c04fa660c6823c
SHA51216ce9f5b22b2630c9aeabd50ceadbb7b306a9d57e18fcdef57879c6025c97e2c0f57f2b1950ff7a756d98e77d7a9a457b2984439be5030af6c76c4bcb6f08903
-
Filesize
5.9MB
MD555823d617093072cdfd157fedf021f1e
SHA1e1f5fbf52b7485d266cde07c5760dad9ce4c0844
SHA2567a95b93666a0d2b0392c4a6ce1385035e8378a9981673b852b567c09db4dd21a
SHA512e4e03ec9f9b2bedc592b429dc9c183ef5c1cfa706d316050d9acf1cb40d1cbbfc34df6bcb0e9a5a170a51223c013133437a33603061d5da29b644703d36e155e
-
Filesize
5.9MB
MD59b378c7b56eca8f7e7c0b7eb6dcab272
SHA10a1e1195fd259713397a14c3e2dbd848a842a08c
SHA256bb47f6e91d13c184f11c1027df7196417311cff901c27560721eac49f51051be
SHA5125d33d8e3cb6c1a7560c421607abd140b00c3e5e6b31697247d1282d3c52f59c874cd124d2a35183e1ab91c4203cdc127beb1cc388ae7d0426956cba3ca18e193
-
Filesize
5.9MB
MD599f011727dbaf0c10fe7cd3a0d550b20
SHA1fe2bf009e6b3c10f17ad5ee4253a486ac67ef021
SHA2562ec169371db06c64c2fc665d2f4ed1138faefb083a6accc448d172d12a5e9dcd
SHA512e19bd0346343c4988f18e896beaec41f3414c4dc80519460e27ed9db50145ff2324de7fd3214694c7ed8dafc7f62d7e2e1ce2b6dcc8fca4440c4a9d2f1e0b9d6
-
Filesize
5.9MB
MD52ce8546f8bc55b4fd6ba8da21ba3d540
SHA1e7066ac2d5410c8ef2c323187f26faaea3f5aaf8
SHA256f53b4c62cebc0d2bda30632547b4f9c4c4b22838b6715225d7accfbf22b008da
SHA512bc789cd8b510f734ff14bdb9d65a16e3e7b69ae78a33ad3a40143e0b55e8a77a1797a5fbedfe91e544549c5c4f6ef25795e8c827721177b5ae96aec274d5f242
-
Filesize
5.9MB
MD5fb38ee25ebe72f0ec696ce80302886d7
SHA14186431bb2932030ecd8b6df44918bdfd702d1af
SHA256aeb35a6260e308e4bd64c9170b897cfa1d81a139f6750b0385832954475e8dc4
SHA512b4d244b09ae2ce75a4c024c8427ef24f1e414af1fc5cd9a84b8262c70b9dc6470b6df0c7313ca04bb1cf6ed5235c86226782c9e60713a9d792de155a80df63dc
-
Filesize
5.9MB
MD5db182d08fa779a28a3c7a0850e245809
SHA181f68c18092376031e9ad5782c373f3f43d6333d
SHA256f0b563044977164e2a4b09b9f197801015601d94e7f87cb3c8d60dfb211a3321
SHA512661aeac5c05a0d6a3773cfdca7756b5512ae8ad60cbbb0153e8e3720bf0ef337c4a70f7bb23227c742b350e7ed56c8aa970d49be8b95ca8f0d0d99640307b8cc
-
Filesize
5.9MB
MD5d64dff82125a5fbf9d95aa196516a79f
SHA1fafd1afafdc4b8189cac0a49ddf9de36da989be3
SHA25638b39cdebdcf4e731ad9fdcb79112a9d1a563d6c575ffe2432cc8e9493b8ae96
SHA51261d005455d4f373680ac82b3283e96a2b4613d24904798d72b460b098994986a1e8d1bb8b39c8fb8713bffc1cf562a3007bd458fbb563dfe68b21bc47786ab7a
-
Filesize
5.9MB
MD51a2e728dec87737dccc6c2ec4dd6a8f2
SHA1754be80740c7e0f6df195c407df5118362ea88f6
SHA25695d590e079c10cfa6fcdbb5efdd09b234b2c493d03f79aec640add6ec4e43384
SHA512fb89c9b6ddf6e9d88e72838718c7e73516bc5c4b836db0518df0dddf46afd877414c060e7c4b9d8dfe4b72b706eeda247ae55233edf59f928f6e88c296caa5b9
-
Filesize
5.9MB
MD5b6dee31190a4eb402a4465670380e177
SHA13d960ed8e57199571a63680901a0ad5e79cebd09
SHA2565cbdcc31f392b01b0b37bfe74e38e86b6a0dd8fc06738ded5e5ff887e247be3c
SHA51272498f73d0ffc9600ae7e06f8350dcdf9243a9230a7ce4a639a7a12dcdb5a683bf23fd8255549e65ba8d255fecd93673b7e419ae44c8c7ee7adddacfdad4ee25
-
Filesize
5.9MB
MD5ce91eee7def996a0ed6d0bfaf13a6d3b
SHA1a11085608fb38087b1bb04d1fb9859847425fe02
SHA256e5050ff29fa200a61e3ab6f669634b73f31b9c606ae6798c8597d70a1fa748e3
SHA512229c7d6c96835aa7060a1fa862ce8cacf92f51e378318553c3715969df4a221fa4fe5c7bf38ed664258b7ffff8affcd49531bf041a1e5ace6878a014cb99a840
-
Filesize
5.9MB
MD552851f4a4df48c832271a6b443fb34b7
SHA1c596fa0d792e0a11e6fb51e7c87680f1b036eda5
SHA25615ca0dceb001a2cb9713a8270b6c2d8d49d0d8364a3b2b1c7fefc290cff276ef
SHA5129a75d942f33a9d2df49de6c8fe039c5c04d0ccc11c635ec0be45569cef1e6f0314bcab3d9799e7fef71694e7c184c85893fd1a098a172a9d6a044579a42c6620
-
Filesize
5.9MB
MD59c5ce8dd349acad974b5fcd0b4ded3cd
SHA1920e09d9ee8ece01c654aeb35b7ac957c4dbc728
SHA256ce1750b4d676d2d6e992b1b1b38f13a9fbd9420c97c575821a2b2eb2d55926be
SHA512e8bcd9146a6a3b5e4359ea55584163c4414ee53c850725222a263d29dc6d55749c19d8dacc44344683c40828ec8aec894ec7e719e8d262d41c82d4d56aaabab4
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB