Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
03/06/2024, 19:14
General
-
Target
2024-06-03_f8ee575b38e5e8cb77defb63bb547570_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
f8ee575b38e5e8cb77defb63bb547570
-
SHA1
278c201404a9c37ba1a860ac18f81adc77e254a8
-
SHA256
b1e2ee470b78ae5b34e997c2adab810dac726ee69ea7526774c134d487304303
-
SHA512
dc37534470e319257ac9539677665f3b65b79e157e0116326ebc57c5f6e09b7bb68168ad96e63794506a2129eb814b39fd3cf5ff45573e6976b9f440df193338
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUj:Q+856utgpPF8u/7j
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_f8ee575b38e5e8cb77defb63bb547570_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_f8ee575b38e5e8cb77defb63bb547570_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\sqSeear.exeC:\Windows\System\sqSeear.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nCcbsDO.exeC:\Windows\System\nCcbsDO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WzWjNEz.exeC:\Windows\System\WzWjNEz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IFYBNmO.exeC:\Windows\System\IFYBNmO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hIUNYIF.exeC:\Windows\System\hIUNYIF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VWwnkXK.exeC:\Windows\System\VWwnkXK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dAcavbR.exeC:\Windows\System\dAcavbR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VCnwEyz.exeC:\Windows\System\VCnwEyz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\onSmesP.exeC:\Windows\System\onSmesP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tgJDtnO.exeC:\Windows\System\tgJDtnO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AlnEDjj.exeC:\Windows\System\AlnEDjj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DHgGzIA.exeC:\Windows\System\DHgGzIA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rvwVFAJ.exeC:\Windows\System\rvwVFAJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sSCLtMw.exeC:\Windows\System\sSCLtMw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JylfzBz.exeC:\Windows\System\JylfzBz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EyxZQVc.exeC:\Windows\System\EyxZQVc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KWpoNVk.exeC:\Windows\System\KWpoNVk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UFHzWcU.exeC:\Windows\System\UFHzWcU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ytYcZOY.exeC:\Windows\System\ytYcZOY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\oyOrWwL.exeC:\Windows\System\oyOrWwL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\myDsBgK.exeC:\Windows\System\myDsBgK.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD542197cc014ee48ee9fc12422b1d4503d
SHA15c0b45ae2a7b3d28885f1cc7786f5135e603b019
SHA2568a736ae006ef5cbf7d944fe003968815638706a4d7731931c4d4a37185b396d5
SHA51275c05a2229ad697a906c058edefa60b1436ae39b60a895750c5ba3f2dc521fb1e9a3f9672c20d05224607b51fde131e8c71eafe79ae6b113173a0158cd1d63bf
-
Filesize
5.9MB
MD5c79d99b984408eb4ce86c0da7c568993
SHA1d1b13c6d5ea60ba13978fc5460b24691f1ac34ea
SHA256dce6654510292cac9678c43785a8c7ed5eddcd8f8e5555912cfac4c739e8a858
SHA512315ead560821967efe7e6c63af8e6db596aa93afc8edc3c38176df0a4daff6ef910b96087c95ff6e0f8faa2b5f4d4daab57d7f13c61e6ec58a19ff5a6bea2d7d
-
Filesize
5.9MB
MD5fad52e880c1988ac966aedbf800ae972
SHA1254244811814975ef9ce4345c6e440700e3584bd
SHA256e269f6cc30f46804e894f29bb2e5ad1d4802f747d4ccf0d7be76bf4493179a4a
SHA512b623040b1df83c2306c7903f9749c0bbb9df40600d641dc844f77b43ab1f47bd3f1c494da8eacbfab6da2361072e9b7e592787ca1192d1cf7e496a81365eb81d
-
Filesize
5.9MB
MD5f5c8ab6b8d83d82caa2537db02fbf408
SHA11c9d29166fba547bedce3a70e75241dfeb90780d
SHA25604aac98596cd68621bb6ec41a09a84e6728f5f8c2babe3b5706cb81c39dbba47
SHA51223998691cf857cff43ac3e3f11f7c84a05e011f3be76884a3b2bbb7a8bdf124f40519b030ac203b627cf0ad8a8c5dac75ad45a5ee564c432c40702e4488ff62f
-
Filesize
5.9MB
MD53743338daf6ea6d3bd92c05dea284b50
SHA18954e68846697f001caba354621fe48c65d4b198
SHA256bb2a6db47a4f94a17b6c7257afeb33a596c9015fe8ec087f0897ff8607092093
SHA512d1f2c7b31b8c27acbd65fd1696130958fb25043aa5ff0d16b754deb6f3a5bcea8522c93884658ca6166856ea0883256e922b9f267a7dd3292e02cb845b5a56a7
-
Filesize
5.9MB
MD5aa9af27079f12b8e1458b72b551f2054
SHA1758a32f3fbf0fc9ee9410dbc6188539003cb3b89
SHA2567e84ff34edba3399b0e08a323c8d1337f19806fee9e4a606a7f5b8c1564ca260
SHA51222ef975b52a6b03f7552e909bc0ead9f202edd5eb9be549d38c014f19ce3c02e029e4bd91cf8a5539156f1fe4cb37ec72255097d8e5b6e195024feb36b9a1cc5
-
Filesize
5.9MB
MD558924b0b947d56d5a58cd9726d4310ec
SHA172f49a36c343f80812a11e23efa309b8995e36d0
SHA256baf1913d2552fcf9f43f72caf2924794ab74ac440b2e1790c290e090922d9f54
SHA512a17a182eabb9cdd77c879e6a7ab1ffdc6ac1a5675ee5a89d76bc9e17de7484d186c3f30ae5cc08434a1c50fb5f7f8e54efd65fa36c6138673deba795a598ca95
-
Filesize
5.9MB
MD577e6d63462cc7cc320fe4c0675b58118
SHA14fd630f46c8f0187fdadfc465d760d58e8e2959e
SHA256bd8ee33e7cfd65bc02c8a7b2c603c814234958a8318758271821b83425896390
SHA512b7af0b4da874c502a8f88f556dd9c9a441a1e85dfca08fd0d13afe3f833a41386816abe6241de00278905511a17bea8ea9767df46908a880ada69f7c9a6bc9cd
-
Filesize
5.9MB
MD555854ad011a85aeaa257fc4a17964e3b
SHA1f1ceda79141b21dc519e0ff1fc2069c8dd2769aa
SHA25693bea78c91e03b462bade6c78d4dade9fccef3c46c1b879035a1705511dbb8a5
SHA5126e04f2bb905c0e9b3222caf70480cc830e41d6e3212cdf5aa7f580f09e687af99c52b3c8aaca1e6afd74d5009f19aa20fcf0a1eabf1dbbac950873b23e63ef3c
-
Filesize
5.9MB
MD5894945cc83a0336aae41542aa5e2e75d
SHA1de1d2fab4cc6bcec47097f490fc30672ba33114d
SHA25636badd1c757f3f646ba6764aa5f5b94dc0f92674a5ec09d3106d1a1c7008d4ad
SHA5126afd86ae4b1b119347f5cc0c112f69e4edc782c26a7a564d03af114bd26ba67a872cf530b92d79fcc5013a5c9e9941396a33ff0d8875ff8ac00837175c3fdacf
-
Filesize
5.9MB
MD5ff4d3b3d46e5cd1f3965ec09bf7772c1
SHA11153b1a4cda982dd713bb49a8b9f056272c8df87
SHA256f84dda827562877e88b417dbe80f9147c1e7a31975705b646a99554c718933eb
SHA51217f0abbe80ffa18c1bdb9ccc434aa1d96da28cf4af8bb0dfee4e4e7f659e386a6a72473940f18fe3d917643faab341570830a1fa8c058e98fb396cc36e6f937a
-
Filesize
5.9MB
MD521394d4c9a69e0af77a08d624bd84a8e
SHA1a06a8a1ce13745f91e2cc41aa7b075c81126a13f
SHA25640c777d94b4d04ab5515dc05d07583ec2d78e16f9d07ba40c88ec3b74b7edc17
SHA5123dfa193045a056ab60fc879bb6790d558638c0ed1f05f59016ba58596be9d4c5c4eb777e50c8c13d9b430c2649fa64fc09f03e3992320ad5a4a8fe4f672b3fe1
-
Filesize
5.9MB
MD500793a0141a0b81f8d8d83fe19eae496
SHA1ee92846662349492f8e8d608c9ff23af83852032
SHA25602e684027397db8bc86dc151020fd7813ac5f587d0c94e6beda2cab33eeeeeaa
SHA5129da6f81eb78d2b36141dfe874af2f190df41b1099abbadbdf14ae6b61856981b012c4b4d7611c7af3450768dc16436a49eae501fc5b4c563b457287a629eb807
-
Filesize
5.9MB
MD5703da52659691331abdfd2630fcf6350
SHA14b56c4514c485fd6da258474ac50ac4a66d08018
SHA256a41334c85e759eef76d4c8c974d7a955440830dd9dd183da0e40a6a3dae34e28
SHA512a117427c2afd53155b318162230307e0e14771c1ff964995cb77f6b42fbb5e6c7c31f19366b9dbf5f0f3198ca63604db01a202c1afb6b66af5f00dcbd331575a
-
Filesize
5.9MB
MD5ea6cb8aee59427973f7b5244092e9cee
SHA18f484a8021460823bd80cac1b4aa4710f6814cf0
SHA256ec937a0ef6308f6b0ebb0652d4da73c08c5294414324dd86135001f80241c559
SHA512d0df70e3b18c3cfbe35dfd67009883a0c013513221ab509772fb0c37e1319ed6b38a772301b56f4e6419d914b837c77371d59300c16f63447778aa278c411fcd
-
Filesize
5.9MB
MD5d8edf06306948e38eeeb3235c2352da1
SHA16c42e37648b58ac55c250adebf645a9a1957c59c
SHA256c8338dd00d485f005517f142883d9e33bbe1f364e8a31116932dd91ec6e2c29d
SHA5126dd4b3c4ccbfedcb5ef94d3b73c067dcee4ac8875ec8603871bc3ba5186d5f1a95dca147539eb9b7c9b81032eb46630cb09894bbd61267e0d5843c022d931bab
-
Filesize
5.9MB
MD54c2e63bbd80919e323c84e1fb8395699
SHA18f4b6ecf60fc26ea964372a1617193401eb8257c
SHA256d9fe41f53a26ba81c58bd32da94e92cda8713617aa79dec5b65306c2c80a53f8
SHA512a5d93ec46061badb655ab0935a0650f0fa71d0e1183757895a8738e3f90c3a36060ae63731f56dad529d149f32c497eadfcff92cc1525c06a4b4f5004e4a2153
-
Filesize
5.9MB
MD5bca39383cfb420248df1794dbbb5a027
SHA118e147b06e4c0b0021b8c9308ff54f77769ea932
SHA256c2a04e71d531b6408380aa04336fd1647288882e4fe6c84f39b7624ffa6385e8
SHA5122c7a6ecd7cf39f138efcc6775093cad2725b2ee6e9cf67ba231dcdb14d0553d5bb3c21147e5f6ab30e29f248a5e80cfb8b094d1fb81ebfcd12dd18464ee05480
-
Filesize
5.9MB
MD5f08af0eaa55abcc05eac837b4bb530ba
SHA19a19a6b27d6f99cba72429669d3ae79421c9ecbd
SHA256c7cf7265849465a67892de12aed75fb5bc68a59e5b0320c828b538a5482cfc4a
SHA512c05bbc81a380c2720c86465220648349078d18092be5882daac9a770a5d77088dd087a58edee18b324fe9aa7122bbdc9a65d397f9ea9396fc14ab400b2761770
-
Filesize
5.9MB
MD52d2817ef19d1e3e1a6edb929218e9d46
SHA1e38ec52eb22605f620192a518aaeb2e47940e3a5
SHA2569b385a0833a5ff11e2d08b9277133cd534df40ac25dc892bc629b2774b56a70a
SHA51258ab840481d722c22ec6b6670791362e6086358f5049fc37e4d7490ea868fceab3c48d4b903e10991b86ce7cf6ff533f8075a8d53bbf628eb910937d7181ecac
-
Filesize
5.9MB
MD5bb7efb611d24745efbaa9e6babdf6ea2
SHA1d0ab4e36f213fdae9c951944527a3977df92b4da
SHA25672c3ceda4dc159a74b4419c3c808319c91fbe53d49bd606aa056fe76759f0116
SHA512eedc48e1c8c41fcedcd7b07fa10c33c39d0515641d90a87a710e5c842e7eed20b3ab693633a9bcf7574ea197f80b0919e489728831f6df804876787c31a6882f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB