Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
03/06/2024, 11:51
General
-
Target
2024-06-03_5a2e6ce520fb33fada7eb5729843e515_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
5a2e6ce520fb33fada7eb5729843e515
-
SHA1
0ecad18a5e7f0a721435aa284958720d775d350a
-
SHA256
b218d86be1fedae2d797031f99246aab2959470fad548426d9d0b619fe9a4dc4
-
SHA512
769d1ef8a5f43390b37bde35b2f60fa25906b8c18f9bf6a8a573a2b4cc246725937b662b9aa1eb5fea257bd32f087c0fe4d59d2044636b86cad4047962d5375a
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 52 IoCs
-
XMRig Miner payload 54 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 53 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_5a2e6ce520fb33fada7eb5729843e515_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_5a2e6ce520fb33fada7eb5729843e515_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\iRfgMzB.exeC:\Windows\System\iRfgMzB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ljWTXfj.exeC:\Windows\System\ljWTXfj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FdZmLdA.exeC:\Windows\System\FdZmLdA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HdcaJXk.exeC:\Windows\System\HdcaJXk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tsZqDdB.exeC:\Windows\System\tsZqDdB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xsoBMOH.exeC:\Windows\System\xsoBMOH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PsKiUkg.exeC:\Windows\System\PsKiUkg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hsoIazQ.exeC:\Windows\System\hsoIazQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qDNaMUa.exeC:\Windows\System\qDNaMUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BdHtLTY.exeC:\Windows\System\BdHtLTY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xvBdXBp.exeC:\Windows\System\xvBdXBp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lzjjQBG.exeC:\Windows\System\lzjjQBG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\psWJsIP.exeC:\Windows\System\psWJsIP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PipQyAX.exeC:\Windows\System\PipQyAX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\esnSKaR.exeC:\Windows\System\esnSKaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cIyECpM.exeC:\Windows\System\cIyECpM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yDADpUE.exeC:\Windows\System\yDADpUE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\orCqatn.exeC:\Windows\System\orCqatn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yOJQYNV.exeC:\Windows\System\yOJQYNV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OYGLNQa.exeC:\Windows\System\OYGLNQa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YPXiKpW.exeC:\Windows\System\YPXiKpW.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD58a42b1c82d61f12c2a2852a0eee61c5c
SHA107edd8d6a18175d60245d6968ea025242fb3f439
SHA2568359738e55b2788408d94354d1a38337eedbf727a975f71c7632b30564c8dd45
SHA5129b776b37fb4f79eb0375302463f3fd3ac0ca029e10272e0b6dd03c999af51bed706324d4541c48b32c195b0c4ff663b3ec7b5389893909c8685fe3402d38379f
-
Filesize
5.9MB
MD5079c32b0b0df2859b0bd5d57c8814d59
SHA141e64d752c7c714e0c2cb018c40e23e7b96855d5
SHA256cd6307d8a545162d0ed52319141db4dd03d440104ca960e7335aebf85db8dca5
SHA5128c35dcab5566af5a0b1f178776a384f64908e686dc744edf21c2399b2ec3f3af041221408ce09a3d9ddef6bf39345f41c177cd78c4e8b94f8849374f8c2978e3
-
Filesize
5.9MB
MD51c10eb8f7c8ab3dd6a4fbe0f94ed013b
SHA1a7500aff9b68a594866d452d5f7ec96d7487668f
SHA256f9da268410a196ce7584a3539bfdcb9deb930b13b1836f8fe4bd5789661901f4
SHA512f132effa5b04615d2c325211234c78880f39b5c5579873ae02ff66d0e9fdf527f921edc685b4c0bd3401999a972b280974c97d141a3c0223e9c380425bdbf3a5
-
Filesize
5.9MB
MD5c81536c43c26a7ec162a2de538cc1620
SHA1bb6120ee88ebec4638e9a67a4d8ed6e935ae5e61
SHA256d15f18d3b50c31094002f6c247ab9aca617c859ca789e479a80f1337294816cc
SHA512d4d468fb99e6bb53e97d66cdc394918b06fa2eead48ac3096662dfbc25dacd21efb39dcbb6d12eca0d724531e262c1e00c470cf7490d63134e490b80e6cfde10
-
Filesize
5.9MB
MD59d5a4f9ef8f48c5f1987f8843c60d66e
SHA1a227dfd6f253852ac4327f9ab224b04c05b66df4
SHA25621670e298cea13024376d5d400b62fff10cc0ef96f57d0132770c6a95c13681c
SHA5127c936095aa63c8b9b768004bbefc289a88362eff97f89fd3922c68ae188eb5ccae99c5859c0f57690765a7b50d84966a3750f3f712ff88d91edff32b0ba5c31c
-
Filesize
5.9MB
MD52631de9e685dc0811266de735242cd6e
SHA17ad9f2a4c4693ff73adbd156898489ad00f7444e
SHA256f9d837e179d6c98400f1715f695af0cabff21b595477bebfe6c07cd2ccb9f92f
SHA512a316d462f19bbe38313a1f06e2272da8fbd8613c4fef5b4cc6511821c0cc9dfd4f4e9a6b2c17867990b8b58d9c8cd1888f78f65a466edca9fc58bfa9402a3f80
-
Filesize
5.9MB
MD5ae9b471a8bec00be308312a00778298f
SHA1a0b72555040254b02c9b16b9ee8a72da8cc1b701
SHA25617726f210ecce51159ef58bb88c51be0a3ac46f9a117ea9d6e8763acac79c42a
SHA5125ec50ef83874c4e71efae26ee48d9f1625d96b00a1b4e423cb3eef7f7aa7aa56a1926143b7fd1008cb4bd909d7d29d6c36769423c891e7118bb60017f51bbabb
-
Filesize
5.9MB
MD58495df2ee09e790eaa9151ec52955117
SHA115766d6fed4535defec103edb52223c461b9174b
SHA2569c85338af644c5a2e0c5d1c1389d165e409acd4d38166537cc73a4fc407bc261
SHA5124019c84585c30fa6a16b215f6944386bd83bec01b40163db8e0b1a09808110482380999681e0eea3b83833f22c5486c587a26787d6a03f99a6e4e671882ab445
-
Filesize
5.9MB
MD55589d1dad3fb1439eab63f0219af388c
SHA1af792aaefbc2ad8bcf4c80847f7b9262aa6f78d4
SHA25622822b860486932be5079cbb9ef3882f1168a919f002e3c4852a9d2b3b195b19
SHA5124e1308104c308ded8ef67286dfa90958ac1ed8f25a0c53cdf80d3aeee3d03222e3c2197a3c3e04eaba224065a8dd71ca334a4a74429910ef7a4c88e3f729f71f
-
Filesize
5.9MB
MD5c79a385bc60c2b66ec0b83b79adb5465
SHA1820fd383d69416de2204356d652ab5c1d5955321
SHA25644777204271abaff601a42ae4b52c1bc4a8cd81f4ec9fc8a01e945424c0e63e1
SHA512d7d6fb63cb4ff8d83e6a57b7bac5c98694621e6c7a6ebc5e772e0fabdff1737bead929140809539b55ffbf22b9595d4d99bf3b8264d589f575ab6fdf6ebe879a
-
Filesize
5.9MB
MD53a862fa89e2a76021e3da38cd437c3ee
SHA11c6514d71bb5edbaad09c11fd739d7f51ef7c7bc
SHA2564b41c7e4ef1afe9494ae2ec3c4983860b4f0138e72430a1cd9e4015159e3143a
SHA5121914c04b9bdd0f09d2fa955bcaf03db8194fe0eda2a479d5097bb52d6b16e880b7037d2bccbf97ac15248044b0fb7e1e1778f28ae8f5f3bd93d57a759c4457f0
-
Filesize
5.9MB
MD5bebf86e0ac445134a8e4142efc98371c
SHA1bdc1d9a2e574ec4d797eecb45047696454940ae6
SHA2567c4c1740a5af6c97ca58bf4adda55037d3eb5575b325f340eecb98512fafec95
SHA5121c761788b644f33b3f00358f0e04c981d8a9f9f4c6a06adc7d9a3bea7352d7890c598513496182cac02da130b98c8203d44d9ea1b53d208ee070c0c0c50201aa
-
Filesize
5.9MB
MD56090151462135f34b23e45f18847036f
SHA1a90f77e77b2d0ade3b79a3e271d7c2bd3ea912e5
SHA25692ec57d393c7196cccd69c18a0b416465a507d445eb2708f85e774412310a89f
SHA5124dea48201bee5b352ce65523690f57798431c11dd6bb6bad09fbdc9f6100470e8b4ae9dca28e80bd52b1020f7b1a07c0fc55cea2de339f25909e5dd9e62fcb2d
-
Filesize
5.9MB
MD5f98339196f5c1fa12fff120fffa05c6a
SHA1c71480ac6b537ad11b76f553abec77abf9b13a2b
SHA256dd0b2354743dddc9733688bca5156247bb2d4ad0a0f7c3b204b69acef2c81c86
SHA51289c2b8aa84295d8e6bf15d7e3326c3a4cb17ff94a4f0a81d6a5d3459390edd9145f10ec2084c701167862728dcfa1367fa88f8e470f3d7544970d9d2c2efd7e5
-
Filesize
5.9MB
MD509bf0758abe1ed0a7e01bd1cb1e104f8
SHA1183449ce68c10568cc08ce02543d0b6d7541f1da
SHA25660d915077bfbda3d3946d1739506f0ed4f043e72d331bd0d3a4fef129691a0a7
SHA512feae8ea10e19d6c9d5c8bbf3ea47acb5c66f4bce5a6731e9f220ccd5de8c31d4f94f5fbee570c6924962792069b6174c0a3f710d742592dc05238e05a0ef203d
-
Filesize
5.9MB
MD52424164573a7ebf1451cc12a557a6be2
SHA128b13e7bc718c3a628ed16fea75169edda6a2fb7
SHA256077d69987f429c92c0e0da923ee3873f220e9e57ddc2948d7a7cf3bbdeb21686
SHA5124d1d639ee4b3322dde04bf9b5ef873b7727192481b7818ce02bfb130e910f8be1211486d35cea55c9084882df0d14c72e602754c0a1f0ede96ab407c82ec9052
-
Filesize
5.9MB
MD5fc3d0e17a221b28bee69c53d9d4eca1b
SHA1b7e40a63408e1a5179b2978a7883983aebc4eee3
SHA2565a30c4923315f51351a652e97ef0119573ddea5a03510a8edbd1f8e48072da4f
SHA512807d6b1f38598f84e8a688daa6886fa8460e549025028ec98471836c1e01a2cd57147e2bd5bed3af14eb79bfaec8eb7ff0c3a39a457de9c548bcb15921ab82e1
-
Filesize
5.9MB
MD513911a5b482cece33b5ea964f41eb40d
SHA1d1739b499e52f77805a3e6f755b9316651709b98
SHA256e10434872d69dfdb89e2fc56d4f5ac9c6421117cdfd4dbe894b5e0652c9fbded
SHA5126cef2bd52070edca31d2e457499282e4b6c7466ee814fd073708ae632523425be20b4d9766956e43aabe2ffc7848829c058e03ea7931e7fc00e4ae04a0d36970
-
Filesize
5.9MB
MD5235beef97a06af852cfec917d38d771c
SHA101db0dff1c616c1465b818f640fb7da90329876c
SHA256ef470473fae688ad78aee9874f0c357b61175c1e8bf2a7c9852f0c38865d0928
SHA51289d062c5fb8bf8d8d1932073c300ffb90eee8467c1609a149cc3e46ac9847466eaf61da4c7c966d0a93c37055fc2fbd3cc82c6bc86a20ac4e0c4f29b61370f87
-
Filesize
5.9MB
MD58c302a7cbc93de2219f76d390496be51
SHA185c1ae89e99c32f749113426d559dab333f153d8
SHA256eee7bde20131198c02813027656e472afe914f8fd1b0f12b17d45cce0c44c978
SHA512a591f7b32869410f9e943a26f0d2e2efcf15c91e63ae98bea1069effcc9c8eb40b3e54615ba955ccd46843d43c860486347c223310bc17ae777d5aed9ebe846b
-
Filesize
5.9MB
MD5bcacd81b0dd3c8fdf472654090fec1f8
SHA1bf96a2ff3befbbd732e444b29aa706003f4536c0
SHA256ba801b559663016b05052c3b6e74b553bfa32e848c110c5e55a355ad8ff64511
SHA512e1193082e828d74a5c52480c867a7245a6ab3960cb6e74bbff80916e9b2d0c10354696a26fb8eaeecb4bcdff0073aa327be08ef8f98e55e4e9142f5853d0f316
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB