Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
03/06/2024, 04:11
General
-
Target
2024-06-03_f9840cd71e714941e9d8e8a14d895154_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
f9840cd71e714941e9d8e8a14d895154
-
SHA1
3767a895fe743d01d632088a386cddc63553989b
-
SHA256
ef617b482ba035bc792feb1158a4392186891afa7200312340b6bc168f645a6f
-
SHA512
678ca4148846a3a48421df5c845d0c975e93d8cf2aed98dc3d12ca5da9f3fc3cb9d5f0dda8682b74ed0343a449c84c174cf531225e122669edeef713442f8937
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU7:Q+856utgpPF8u/77
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 57 IoCs
-
XMRig Miner payload 62 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 57 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_f9840cd71e714941e9d8e8a14d895154_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_f9840cd71e714941e9d8e8a14d895154_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\vkiNOwV.exeC:\Windows\System\vkiNOwV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FmUjhhp.exeC:\Windows\System\FmUjhhp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hzKwysy.exeC:\Windows\System\hzKwysy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BJyQLEf.exeC:\Windows\System\BJyQLEf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NMbsLIo.exeC:\Windows\System\NMbsLIo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PyIOSRU.exeC:\Windows\System\PyIOSRU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RvZqbzc.exeC:\Windows\System\RvZqbzc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sfGqhey.exeC:\Windows\System\sfGqhey.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BuctPhj.exeC:\Windows\System\BuctPhj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QFpVEFe.exeC:\Windows\System\QFpVEFe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ncyClOK.exeC:\Windows\System\ncyClOK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AGYVbBl.exeC:\Windows\System\AGYVbBl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vaTLMTF.exeC:\Windows\System\vaTLMTF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kmgNODd.exeC:\Windows\System\kmgNODd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lqDLHvy.exeC:\Windows\System\lqDLHvy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eBYjLJe.exeC:\Windows\System\eBYjLJe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqZPgpV.exeC:\Windows\System\hqZPgpV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iLRolyz.exeC:\Windows\System\iLRolyz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NVKgaUe.exeC:\Windows\System\NVKgaUe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XXNDePD.exeC:\Windows\System\XXNDePD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VCigNOc.exeC:\Windows\System\VCigNOc.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5070c0b666cffbaa0cbbc565f0b259e1a
SHA1b573f6fd2741660335b3f1a95a96fcc8411d3193
SHA2567ef2e962a9eda7692bb8321ab816bed3e399098bdbdab3e0e6ab70a9a5daa51f
SHA5127a9835783691bff6022262a8496eabacaa528e6392323498b1e2ca6ae7e258e45912a813ecdd76bc90e12d2f8688eadcba5ee1dfc79c599ec59e19a4aeae713b
-
Filesize
5.9MB
MD5437a2f0e32a1daf770d18974cd915157
SHA1e3d275bae2e39c159ee9ac7af55056869c5c9135
SHA256c324daac6ccbb9f7173423535a659e52be2de5c73311e9bb6b934021a42bf2f5
SHA512daa108069b459ba3a2b4040f0f78f26d1b703dd9fc7158455d71dff564b3ea86d344871128610011bffaf9f7c3162be1f91dff467a9faedd7e86b33f02ef23e6
-
Filesize
5.9MB
MD5e359c7bc5cef88b427670ae297bd5b9e
SHA101f9fba6544f0504b2897261484c4ff205c7753e
SHA2565eac697a25af0a34d155ebc4c14189b93ae25a3170147d12122ef4402718a270
SHA5125393453ba4b858e232c55807b433551b15a65df47064f77c44da52f6392a89cc73dec3fe445320fdcd0952258a746677b5797abf60a38717c199fa7b017e29c8
-
Filesize
5.9MB
MD5d4aa3c1e8715d6640d80cbd0b77bd7e2
SHA1e24fb82449b3ef12aa6b01d4220ec0fca29630da
SHA2568977e1255ba03b8621a1a72c0800e9f7d1838e9a47a9df84490ab2693973e799
SHA512622a129f2a9b1b8966850ec43eaf85ee93d58444060f5a449e7ec68f1cc83290fe2e339e255e4762893bc57a73047eec4412e55d1dc560f0dcaf51b68ad2dbbd
-
Filesize
5.9MB
MD5cb3a549ed3d0c13966dd1c424e17bdfa
SHA18eae0220b18747803f3664e13aff9249428ad01a
SHA2565fff7326713573f7b43777366260b680adddaa325d1cf82c32fd33397f80e7da
SHA51267e0648444941ef7614621150751078634749cae8b633cb10f30254181e88e94821970d1f9bc2b5d87bcfb3cf80e8fbe25e6cd53c8ce194b9cfdaf8a4abc4db4
-
Filesize
5.9MB
MD567c8b8fcbd807064457c414682d6ad9a
SHA139fbf171b21766dfbb7be6fed10051ac891a3853
SHA256484d5751989cdfaab8cf682e2180a6547d3290bcc90426c01e85a9265de7a2c2
SHA51234d776b891125ac65023f6ccf754852d17e83146ac904832cf5e759516464eb7c169e7c2b50e5e32ac4ac43787f16af69bed8bfaeda482a606d7ed6f9bf32e6a
-
Filesize
5.9MB
MD549a469ec36f6c8de98dbf56b665220f2
SHA1249cb6730dea497517cd1fdf492dab2f4cba004d
SHA256f0f28c4d55fe8ce1b2fd8ea92ae517b891aa5d7f6634a8accd591bcd48b7bc43
SHA512b7d7afb5d6b4a8b3e9da11ab02178cab6240c73e6ea237ba1576dc3de5f817ebfd37fcf814d337975c6c7410389c27407c35f432fbd354c25f6cfdac0f9d4c38
-
Filesize
5.9MB
MD5d5abacca84245965954b73befe6b74ce
SHA14a5613ac8d6dabf873458a4509dc7965d2bf4ca6
SHA2567e92260839d43869062b0a5116064ae63173e110c2bbcaa8a8cec32032694c95
SHA512118b88147eb30afdecc6a4eb3778d67a5c8f322c4727f240eba71ce3c31d74f90a3682cf1d2ca52ad50993aaddffa07f8e1f5b4937006273b5c240ab7ac91d8b
-
Filesize
5.9MB
MD5e18783e634a562d0d207ce1dd5471d93
SHA10f59c06d48f2de68006780dc30d3b1bec9f78eae
SHA256b0eb4fa4542e32932fd3fd41353d09cde6f26217463046b9801f8316ede93a4c
SHA51235f73d6b9d19ffde80000f616c2bb4a4de82ddf371a27f146322b981a51e4cfb436773baa9736337f7c7a6e5ee14012f6225e63514a08ccfa1d569663c231b94
-
Filesize
5.9MB
MD55f3585a6409b704b2fe42de405c2119a
SHA17637ab7919bd86e8cef40915090cb24ba1b5d79b
SHA2562dd0d391d14f83cbbe35fd7caf1ba2e323ecbb286453068dbdfe8ef66b360293
SHA51233e1d1da4594846fd1ea113cc13732a30b1e743e43d379624cb392dd425772ef3e901115ee9bad882d148f46647585eb82599298c2fdf3c4ee3dab3c894576cf
-
Filesize
5.9MB
MD50485eb73e81d27355219461c0f117f47
SHA14a084f32fd2c87c8412c01fc4f87266c21c049ee
SHA25691df99e92efa2dabbe7622fcc4dc6608c5062f65bc846918b217a3d8e2cb5b46
SHA512222f4b85193b9045e7ff2e03f88bad8a4d2d34eb841cf17368082297e45d8534ea0efb6820b189d9ae26b52b0a3a39939e2c52f448fcb36bdf0c6aef7d4674d6
-
Filesize
5.9MB
MD56f33f2d62e5bb6ffd6eacd34ff09bf4f
SHA174078a88204646503a8d73139f454365a305777e
SHA256fee1819130e09d10b92a6eddb25a530820d4f1495f14b12341e7b963a03e0320
SHA5124ecc0e595b46a902f71adf1b8b6be992b83e77934f551df1592e0212edba3fa58a0aad2ebd59617a37901eeaa847057dbc6500faeca18b976218678a07dd9269
-
Filesize
5.9MB
MD5aa74e17ba62dfc3cff07a0f489ad81e1
SHA1b02bee1e1d14bc4d5f3526e47b6526bfa6196079
SHA2569c40dd9ebe1673d5b1fc6d57c30660c690d72264f38a25243bc7b926886cfbc8
SHA512ebe77e3840f1b9861edd23901cdfd16f2adc2c9fd7ef6a8c4f4fbe05d15a0ec7dffed58d2458f1d131134042ecfb27582936ae3d0d01e46a220dd3deff9cc868
-
Filesize
5.9MB
MD5c2e4e2bd63c05485dcfdc751dd35a1d7
SHA1872542c6827eb332eaad524b8992803497993411
SHA2564df163eadbd922d7428f3e5f7b1094554bc0e8a0a486b978ab2a324fea56f0d3
SHA5121aefb0fae94d05025153da76405a52d76472620550e2505e22774fb0bcb4bcc67ec20f307382039671bf63819f6f72606c851f8de3f6d73b7a9a8c6146c4e77f
-
Filesize
5.9MB
MD55de47c88cb0d67f65b827d7594873579
SHA16626ffe175db52c0b3e2813d275499aebce40653
SHA25679992f5c0b221d7165ac3fce485e303dca92238d3f45a78c359169feaaf58b55
SHA51201331943cef58e72b940e4c5705df10f79b46bef0c149bf6567f228b718276b825faef82f45a0a014a5e620039ff23ad469f12cf709edf1bff500f25ffd5b233
-
Filesize
5.9MB
MD50ffc1d393ad20bea3ba5e7ea1e75e125
SHA12f685dd628a2e2533daf5494d950c2e146ada82a
SHA256e9dc1a75f607712fc6500d4fc873bc0030e5334176a9bc9e2de6d34261dbc5a8
SHA5124af3c6ddda5e08ddc0622776d10af75a92e61336ecef02c938660d0b96a98a44787a77fd36778df7e49f3f147253edc1165c3d10492132642fc566d222ff513e
-
Filesize
5.9MB
MD5b785f14794b10a63f903af43db6b72bf
SHA1e2e02b4b4592644b72a6570d6330a452ac12d4ad
SHA2562e40e11af47ce12541582c183a609f96710f27b4526b71be445180fc9ced23d4
SHA51205180e19a51aa23a98ed830e0b60184ff00edfbd64b683b7dfd0fa1054ce61603057c206c75b93d0593c05a91965df922ec1a5aeae7c5fe41aa53f4bed175cb8
-
Filesize
5.9MB
MD580cb5aac96c351e7406a5de4096e328c
SHA1c045893c57f5560735dd5dcff6c3c3dcbc7a2339
SHA2560b5c7c4822bfb8d1be2cfcfb6cc755dc8d6d52b479458936c5a9482db6e3b4fc
SHA512705a9d5cd8e887ae0eaed27a6b983a4efd4c826efe367cf8636dc7bbca993ca0004e5b26585974637bbe7645db7f5d0a28d927763c12cdc9e9e8e0233fdf8cb6
-
Filesize
5.9MB
MD524312aa68a4f26b97733d5a3d84d5774
SHA1c751a7de91b15316915e75ccacde299dfb70b981
SHA25613ece794b688fb06b3893b174e4d39b77028c9c5da5165109ef5011a3fe7d71e
SHA512f421c9c2da8ffda4b555e1289781e3eae0ef6ed11a2f9bebd1da40c8cf8977467e0f698eb7cf186f59dce28bf4f42a5abbb571a775a0be24ad9215817145369e
-
Filesize
5.9MB
MD5c2a6b930477707c534a8bdd0a7161e2b
SHA1ddaada46c1ac3bce2afc81b7fac1ada5ae098d6c
SHA25672c6181e55b92df167c3d1945ed9bf40c11e82cf4f797845333dfc901cbeec8c
SHA5120ab42cbbd11cbf621b799c875ea1740b01a5dbcc15d1b6fcdb79c8108bd16736db7e109cdb64b958b2a7a3b26221340ce52c549da0b954743855b75b317a07c8
-
Filesize
5.9MB
MD5b6ec92d59ef7e74ee66fdbb895f68a80
SHA1594d1dee465492dcd3c0a59900d07b5f59d6c377
SHA256afd16497fda0bb362e776644d45184ad0662371caa3b3a4d98b108ca89236398
SHA512c19cc2fcb9af68c61d9ae7499c9ddf4870fae2e16127c4bd7f9fa6c3ade95b0fb00dc37b2f5c781eb82ad89145a0c376ed99fbd613ad15e50fe922ca4d4c0551
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB