Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
03/06/2024, 11:51
General
-
Target
2024-06-03_5a2e6ce520fb33fada7eb5729843e515_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
5a2e6ce520fb33fada7eb5729843e515
-
SHA1
0ecad18a5e7f0a721435aa284958720d775d350a
-
SHA256
b218d86be1fedae2d797031f99246aab2959470fad548426d9d0b619fe9a4dc4
-
SHA512
769d1ef8a5f43390b37bde35b2f60fa25906b8c18f9bf6a8a573a2b4cc246725937b662b9aa1eb5fea257bd32f087c0fe4d59d2044636b86cad4047962d5375a
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUJ:Q+856utgpPF8u/7J
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_5a2e6ce520fb33fada7eb5729843e515_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_5a2e6ce520fb33fada7eb5729843e515_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\ltzLXZt.exeC:\Windows\System\ltzLXZt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GSPSZOY.exeC:\Windows\System\GSPSZOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oMIRVoD.exeC:\Windows\System\oMIRVoD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pdGkeye.exeC:\Windows\System\pdGkeye.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RTWlYKE.exeC:\Windows\System\RTWlYKE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zJTpavT.exeC:\Windows\System\zJTpavT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RVHLMah.exeC:\Windows\System\RVHLMah.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IzZEXCl.exeC:\Windows\System\IzZEXCl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kgFqsmc.exeC:\Windows\System\kgFqsmc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NDYCUXB.exeC:\Windows\System\NDYCUXB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UHhuKwk.exeC:\Windows\System\UHhuKwk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kReawjp.exeC:\Windows\System\kReawjp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nBuUMNB.exeC:\Windows\System\nBuUMNB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jvvvFfm.exeC:\Windows\System\jvvvFfm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dYYPNgB.exeC:\Windows\System\dYYPNgB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lgnQSYH.exeC:\Windows\System\lgnQSYH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PEOmSpr.exeC:\Windows\System\PEOmSpr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\moZqjRs.exeC:\Windows\System\moZqjRs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rwBdOgu.exeC:\Windows\System\rwBdOgu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dQnpCMf.exeC:\Windows\System\dQnpCMf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jIfFKAm.exeC:\Windows\System\jIfFKAm.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5ea9cf36e807a07e007e3435dabc98375
SHA1cdd08b658eb406ec85be805210fa707c40d89985
SHA256818b79bb51d4fd3ea10e092c6086c947505e279bcd9dcdd03e31580f63f61c54
SHA51268fb9a988459e455093e36e21094a665e50e040bb3c4928c81b7e1bdb7a8377282f0762ca3a4e8ab7f6a8d5f30206e53a0ded158df38fde743d05219fc7f7c58
-
Filesize
5.9MB
MD5fab45e3d0eed0660d5bd0999fe393078
SHA15525538e982a078ae4b198477325f5c4f97f4cbf
SHA2567f9ceb0110401cdbd1ad72ae57ffd46acf66f9ce79840869ff0d1a4bce7897a5
SHA512b976492f39f66330bf6efe7931d6ff786d295a23b7125a81206c5c99d4ec5f7bc1d86a827feb2252263adb1e870acbadf472cb68402f021f5eb4928184dba143
-
Filesize
5.9MB
MD512b088659ecf8d402198fecf460c8215
SHA1fdbaa5f78243c3e883ed6ccc8e54c431d1a46ca3
SHA25629279bd3dd5d3b804f5bf3360898a84e8c56421c6bbf329e672ddcdeaad13ce0
SHA512bb15769e061be1df938961f683f26aec8f92ffaf6f4092d8cba414778b81508aa303b2432bff074ea307ecfef0fa99119d2ba9e9ded0cd52e38bfb834aeb9f71
-
Filesize
5.9MB
MD5f6882063a0df77107c26c7ad5b690e0f
SHA1ae2f1017e4d858378e745b01dc3991937f3867cf
SHA2567550f8c96ceb4cb1d155fa4571827985091a5ad6d5fd8339c96042434ba311b1
SHA5126a5afbb58d0b2216c1b14bc8b89ea4ba1b60f611acf09983745bda7be12d91ae9caeaad13f87da832e62ec1546b17a69a52f901136c350d2419707b907d1261d
-
Filesize
5.9MB
MD510693292d64d6a785faf4e9b0749daa3
SHA15184ef1de71e9d0f0b48745619b894da2103f9a4
SHA256fbe928999d9b3ba165e735d5dde3ed40391176efa493ec358e608889f4141a6b
SHA512a250b949de79a44b887a22b85be3a550c8f0f711e0e5be818ed0998e93e34897f4807a1ccc77cdb7e1556caea7bfd6ac385d7ad71c94e346dfc3af71db7ca951
-
Filesize
5.9MB
MD56ad4a117771c3685e0de35df0f82df15
SHA15e80ba088a8c9a6c57f5414e74d75bbc864b4c06
SHA256e5b487ba6fa770fa42ad7ce28d5e3d5f85a833d39c7b56204b93f1c66b7c991e
SHA512560cc3c79f5c48e813bcadde650e73879ec4df1afe17c3884f6a2eeceac89912a01f803198f450b3fbd4f4661f5f7ae0230ed1206691c1458f13ffcc06980670
-
Filesize
5.9MB
MD5955510f33493765fa5156652dde2d165
SHA11c84e166c79fdfdd49cb933ae7a1ed8d11744392
SHA2562bc91cf43fd9c3b950063f052810927f97930100d95af675a4bc7abc4e290ca0
SHA512543c13bef12cb121fc2695173417e7e1a8a74eaef717f13610ef11b758598a78fa129972989b95695d0a4795282133b4f849571bf8dde766333acb90fe4b6d6c
-
Filesize
5.9MB
MD5da4cfd67672cab47c4d02072ea02570b
SHA1f9ebe0afcf56e97efe560ff4e32f4c6dff15187b
SHA25618cafb7e8c9ad44badf6f098517a2ff2f913a1483a2cf0a683e249e63bdba213
SHA512a437e2a13c3d3558e05497e44582a0186dcde1c11b22e02c83686546d6b50302f69927f5841559fb062335b7bc0fa58daeae3c39e1a271253efe900e73c0ea8d
-
Filesize
5.9MB
MD55c7d52260125b33b76b15e6ae2143b59
SHA1aaede6d2b9d0c75295cc6e3ad7f521ee0f38747a
SHA256e6c45dd921c7cb81f0bf08b7c002f47ca78098fa9522cf67909ecc55c610549c
SHA5125c84552b6624a7e1d6912996f1aaa58b843808183c9e11f3b1c75cb765e867f93b983bcaed6729187a51a21e9e6341d9ecbd9683981b342c49a9761068ed7694
-
Filesize
5.9MB
MD529291b245cc7d8703c241a192d5e150d
SHA1bb15c965df16e7131b758ae850ce2832aee9ee47
SHA256d1afc3f366630ed7e3d74ff3a909889a428467cefb7724efd69ca0d4ffba8744
SHA512e85564c54b33d595193036473b7f50d5a003b4b3286ff7d04ab49eb4d950b93e46cb7933d10d98dd34ba098921e0c4afd47fe7acde5aec551c1b88fb34c595e9
-
Filesize
5.9MB
MD50d3a33ab308cfad4e4441ea2dc8525f9
SHA115b83c58185ab2f23bd4acfb6fd3464b69c65e64
SHA256369f1f338dea04c3748864a4d61e58fc94e6535094eec9c16b8a15511434bf77
SHA512ff2b664a59893d28197e8bf235a3dd356dae73e8844cadfb285d8aa562a0c8a086a2f2992a7f0aae9c31452ca28e2ba9ef18367c2040f79a6ccf6f72f978545a
-
Filesize
5.9MB
MD5560933f19181dcbac9dd57d332cd48f0
SHA14dc4d59e8fe1fe966af49b7d78d9478b5d6c9b4b
SHA2565340aa39aa31f48419615166c9bdd0c1e400f15be400eab20b0b3de8e4916544
SHA5125dc1cbf015b6054956ce06351b1edabaa382153c4cfe3bc02abda2d35ac4b3569339877c41de51a862662a33aa680624c08eebec8e8a031d697fb5a17899332a
-
Filesize
5.9MB
MD59e29663a0444f42081aeca068fcc5bb6
SHA120f2d47a2d22630bb02a9679d2a17a79712a17c7
SHA256321bf2b78ee19bf220badb30831df66c15c5d770bfdc1f3c04e1dc3a6e164990
SHA5125661942fd323c9e8b466bcecaabeea50b4a4ea20dd21180d531a89088fdb7aa1211438338dcf69685705a8255bfbdaf174954b2fe23d84433e7ed265f16d164c
-
Filesize
5.9MB
MD5698e8da0e3f7ec4900ff7b0a26915629
SHA1350294ba61f6100c870be761e1af1b4d9b3632c8
SHA2567e0540c3704fecdfa167f3b0465b39e2c6d445a4a03c6ee9e891d37a52aa737b
SHA5124bcce0f9fe0ed8f594b8ffa11991832110bca32991a54a849a4018dd63857b3c6029b42d7b8b4b5861ceac0749f90737d940e182b89f131e00b7bb5fd337859f
-
Filesize
5.9MB
MD5171c8bc5e2a177dbe45efc07b2e70e5b
SHA19cfd1a19f6b00995befdc5c0c9423e1d536c5602
SHA25608aaca0b24f6697e03f48eb30a62afb278b5664a609d4375bce4669c9bc84331
SHA5124395d454eb99bac095956020c9bb8d64d74a2b87bc1c7bc4b2b753a6ecdcc792ff464094b185f97e42af5c405f3752fad53599494a6d79d0ae6a4bedd6432fd2
-
Filesize
5.9MB
MD55a7d19dc052ec9603babf5ba679ad1d9
SHA194b35d366330ec3837502c5018f86618d50f15ad
SHA2561d17af3a1af98657e94f797bf9eb664f6140103ff93f1bd98e61ba91d15ef516
SHA5129d272f7e262867686fde58e105e37a80194fa7c0ccc450e3e31363ee1b0e0e7446f1245d885cbedc41cf5f6801d2d134f339f9781c16de76c3792629f68e56ec
-
Filesize
5.9MB
MD51d1d248272faa8e9a4ff7677c8dbaee9
SHA15be160a57dd3b1351f803a435fdadef205915a4b
SHA2567e2ba603218dac44e49b07878cc34bf4d0b3201b3fc8370a7787f74c2cbffe31
SHA51280d64bd5402e21c95e500c6058bc6dd9f1051e67869dd82c800a3c5cb49a5f5012498ac415d2a023780d5e3901f6670d5cd36c0a1dc624d74d9ef273b578fdd4
-
Filesize
5.9MB
MD5a0e71066bc77e1492754f637aa425c65
SHA17568eb9ed9d9966c3849b70d0e8ef9ce138713d2
SHA256548995c14f21df75a324ec730dd1e3a60f6c8ac901d0a11d1f9a8e2a41a1424d
SHA5124c76178bafb70bd6d18cd3daa466d03497ecd26c28467e29e7adfb7238d132169f6f007059a6fc9ec7b9027c28841edd7b5dc441e78e150d3887739cca318c4a
-
Filesize
5.9MB
MD5f44e58e8fa1c7897f17f4e6756974157
SHA167ab92691aba32daf0e9b6f9ba394f11169544eb
SHA256c648e93ae8118ff518fc9a1c9a26d22204610bbc782ddd88efb289220289a68c
SHA512c9ab777534ac526da7a45ba2d9ab02e98fdc1514676091196de169876570baa256524e81f6953c433854ab9e21a230ab1d1be9636412f4bbe2792633653540ba
-
Filesize
5.9MB
MD519f88f82b849bf8ebe4b7ede43fb6a12
SHA1236a7755999fc14322504cd3a631ac8e2beeec08
SHA2561f02767afdb69db992e4105d3ab933c6e27c6010cb7ad5f5ef77678a8cf88ed8
SHA512277ca90fb065306e379224112232a557c766480c9d05981efc88444bc3a7302de830beca18d0ffc0d460c60682aefe77b7a3ccd299295d7f26f5cc1026ddd2d0
-
Filesize
5.9MB
MD5022405cb4752549a0e731c016b49fdd3
SHA10e348cc7b8f573b8b09dbb41368ff5b7221270ac
SHA25675caeed79f9b63d45daa8e760d1a850444d63351b6e61927f88687b35a1f5dd5
SHA5120a753e2f28a391ecc329fc6c6cbbfb571599e1b301cf8cee3878f9bbef304ecc7da6637aad393a5c2eedf77d95cea5764bc88ad9b027bb78e44ea70c91d2876a
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB