Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
04/06/2024, 03:38
General
-
Target
2024-06-04_947e17fe710720ba9b91c4d81cf92ff1_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
947e17fe710720ba9b91c4d81cf92ff1
-
SHA1
bc786d22c1fc3182e3ff2ba577705ef66ae637e0
-
SHA256
011659e6c926b40e18b2aef593382a6681c1597fcb3ebe4afd6084a14cb14d3f
-
SHA512
bc632fcc3b1499e503fae020934f882eed2974ac2d7a1327b852048e3f620ee5195e7dd7f326f0747b8723c7ec01fe96c8aca00caf4381b75002bac4b54fa3a6
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lU/:Q+856utgpPF8u/7/
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_947e17fe710720ba9b91c4d81cf92ff1_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_947e17fe710720ba9b91c4d81cf92ff1_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\oPbuGht.exeC:\Windows\System\oPbuGht.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pmWIYBW.exeC:\Windows\System\pmWIYBW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uifCaxF.exeC:\Windows\System\uifCaxF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nhpiBkK.exeC:\Windows\System\nhpiBkK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pdBfxfi.exeC:\Windows\System\pdBfxfi.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EkBHTON.exeC:\Windows\System\EkBHTON.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mypMACS.exeC:\Windows\System\mypMACS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zcATXir.exeC:\Windows\System\zcATXir.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gXvxIPW.exeC:\Windows\System\gXvxIPW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LKNBJbu.exeC:\Windows\System\LKNBJbu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nqQmHEK.exeC:\Windows\System\nqQmHEK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sNUUYSv.exeC:\Windows\System\sNUUYSv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jqmScxF.exeC:\Windows\System\jqmScxF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TypFtjZ.exeC:\Windows\System\TypFtjZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MfTCytl.exeC:\Windows\System\MfTCytl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ElcbyzE.exeC:\Windows\System\ElcbyzE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yFryGDq.exeC:\Windows\System\yFryGDq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yzlBPTm.exeC:\Windows\System\yzlBPTm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TBrAtjQ.exeC:\Windows\System\TBrAtjQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jmqIzWk.exeC:\Windows\System\jmqIzWk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bJVJWZX.exeC:\Windows\System\bJVJWZX.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD500fad0ea91138fd950eecdd66c22f4ab
SHA101eba41fd4446a6f05830ee99827c1fd09fc9c11
SHA256918c630d10c2f6007cb8bceb4a9884546ada57d327364930464d2cdf4d3057f6
SHA5128cf935ae2cd1b42c3abb61dddb647a800ae47694974ed8f1ded419b16a699358f24d17e84d743ed00d3c8811c7d8d9af56054b3863f1f6fdc76bbfcc40405a88
-
Filesize
5.9MB
MD52d12f9843b15f3ae21decbdacca1a6fc
SHA17d8b67f6520d1bc43f44e528a2e03fc658462f6b
SHA256f4b4a083afca93c035309b8131b47b3d0abda3f341f8a63d3e90f58c784b2353
SHA5128af233339f7d38732c930e0437669cb0542748953fa5e490392a27e3fd6e3e95c427d33d84b1ae890fdf339b4648b6055c849cba89db300e6f43692c3b55ecb1
-
Filesize
5.9MB
MD53cb192f4c4ed8bd8f9b19f57f9ef647a
SHA1a72e819d38061cde996b8e4b14a38279ce280ef1
SHA256faa0d23a3e7ffa8900d3689b8842030e51b1c7e9305f54499ac09c8bb0293d5d
SHA512fcddd139e6c142d2dc6b56b0e1ad384295854ec21ca6ef17461def4423ef1b6dfa49586904268515bee1d1bc24d3f8aa2432d95b1466ec4b9985d84070e2a8d2
-
Filesize
5.9MB
MD56e6c4ad437238d93b3720f1daf079713
SHA151c481658260b6ea1cd0cd6f6f2cf36deebee40c
SHA256230290c1801392295fe6fb46aa980a6b8969dcd91b07c363ca3407dd55bc6207
SHA5121baf1d219a2f836554bb9e838e4bd8f0312545e19ca12318e4edd9d1adb1e98c62c5631f09f0c7a779b3f9c2df9344709f61d2f535554ff4e8dba6ab8fcec5a5
-
Filesize
5.9MB
MD53347d8875315ffa19fdfbcac1c8e3ca3
SHA1961f2b92fa1711c203e6ef2ba1a431d15828b5a8
SHA256f4d5ba36200238d0192e94a1adead967be2aab80e06dff7a37773047f7a2b7b7
SHA5123ec3d401b1b55c73b5e3293d01cc6646d6512ff38a826608f14fb79f0ee65f9fbf46ec96e8da296275552feaabb96578dd69d498796ae619379dbb51e8ffad68
-
Filesize
5.9MB
MD5d87c8d89bc3bd378173e265e2c73d8be
SHA17170c06a8ad8034b7c47f94172fbc5c84f0d488b
SHA25655c704bd44a96799dde1417608fa68f9861ebd196d7ee7ee11d608e54afa3fd8
SHA51283918a635e3dc72a62082c10fa2f6547be8cd6bd2259d7f64c721cd0aa025ef1a22863e9c21a414d91eb8de57d8f3b49cddc2076cd911a91dfa5b9a106ffa3af
-
Filesize
5.9MB
MD58f0f445aa00ed4bd825a5d8ebcd4e054
SHA1e944e74bb06c698647868dc0c7412dc7e1a96b55
SHA256bbd9099409901138126074330eb88e5cb9570799c9bb3a0f2bf674087c800654
SHA512dee2252544029dee55b80c1f38f1519901adb07fa404d72a6cc94c61cac8fff4232d825dd1a095311e34c5b662d1f2b00d5812f358674c44560bd454cf1a7fc2
-
Filesize
5.9MB
MD5a43eb767d99d0c29d8cf17cd0634279a
SHA11bec3d79c1476ce953090afb938b287e43ad21ed
SHA25633dfc58301a38b18067749c7c6f41bc053f8aba82c8c5f5096dba509e74927ad
SHA5128f920ffe461c55b5e69431cad8d54659b0bec08685e14566b65ef64fd6816b9f3dede65953102ff99d4cd46b6389f91dfdb943daac3cb72621977735d73de72a
-
Filesize
5.9MB
MD544632f74be547a5dbeb42a1c7aaf7c63
SHA1e473a392c12b350cceacd4bbc78c16de597f18af
SHA25617475d2a07dd5bebdb2dacdb714b0d353936e3f748e0c44dbdaedbe035754966
SHA5124557241bf0cc5ad5220cb761b339de2f981220651a573dcc8eb313886ba7809a13820162c8b6acd943b44ed6a230716e847812892794eeb7e5286c43f69f1bf1
-
Filesize
5.9MB
MD5eb0162da1368d613ce0a713a3ff3ee73
SHA1efa06ebb25862a265e2d712eebe876003ca658a4
SHA256f85702a666437a045d37115b4cb4c9c036e4285ed20704f08e61e3696a5cb392
SHA512ce31657502091b61c0e7d9a6aa36be21628e914dcf9f3c2af7db3ca5a55e92e5359d40a6f3885c68a787cffaf5698004a4b4bd6dcbc86ab80986546cefe470f6
-
Filesize
5.9MB
MD5f3e0d5a5e3114084736921abc7e5fc73
SHA14d05efa7b4144705022d0e4b4ea35d86ebfc225b
SHA256c929073ac747af6c1b62e496b0536f4cee2cb21f14c2d1466e33d7dcdc738d97
SHA512fa0fb2405782c6f15527c78f3824c04dff30223da6ef53692e7c9750bb0891a8cb6f37e325d62f573234b8f33731ff63ad112dace1d3c12923b3899c805b2447
-
Filesize
5.9MB
MD51de349959b6a4a0729c78da1186df138
SHA1ff439f8f420c14f153a3ce5a8666c0fb3fd15f9c
SHA2568b1751cd08dd4ba92b7e4596aeeb7281d63d44c9de33e1db8c4cc41808c1985a
SHA512e1327d91acb198f3cf4257addd9fe628d1cede64d730d7ac416296df17bd44150a3a87971b433a957992f2f2bde856137ddff4f2b8de10ac2271c902e0e5f424
-
Filesize
5.9MB
MD5969a90c0306304b075162ffd4c013cd2
SHA1c94f7b013bf72409c03c31819f7e2dc1d575fd90
SHA256ea6ae2734173f0bff0ed050b76aaa6a3490e1c56eaa038735e40761f82d9fdf3
SHA512686c4245916f3ab6dafea7fea56c5ca536e214c4505969c1d39a75d208a850b2d3c01219da44e317c56132a68db11ed10df5d9cc5b6a61949a211134c5c582a4
-
Filesize
5.9MB
MD548dae9e1621b208f98e6243b9a177cf8
SHA1916a14a30710294dd324f9141d299852ef99ed70
SHA25691fc9a59fb9cd3ca0f0826b8ddaf48d50afd75cc33ec2e9737cae263fb0f6cfb
SHA5126af548589e5ec8b1ce3be7e2cf4399c5f09a9fe171b5bd2111d92d3f73184d5b67d7c07f1334de4233a8a0fba420ab9f7ba554f3722249aa897f3d26703a4282
-
Filesize
5.9MB
MD5fa6973ec43df5e58a6a0c6fea2ef4704
SHA18537aa1aeeebade17fc84c7de5d57232249d8837
SHA2562b3a1c9a4c4a53a469169e58e876ec7740c89d9f19e0cf3cac4c332815e93001
SHA512f88cdc3e7da6fb90674591481eeb7fab28c207faae013fbb88646e1fa7b750f2ced5c1e70f1490c4a38b38d3c28019e12f9937d6e2519882b403a8d8223586e0
-
Filesize
5.9MB
MD549efd2f015b7f9ebbf471ca5b178e3fa
SHA12d4ad3cf1f8c27d27f9e23cfd157e68c4891a837
SHA2561806bd4c31b6841621d3c7d9fa34f34c11d06c159646ed5bcd6fec9112fae0b4
SHA51222449ae793b77fdb09665dcfb44ea96d1471dec8b267312f93045c7365faae5bf2ea1985abe393da8c47fea5ce922e8b5b81ad789bbac1d9365719dd7fbf1126
-
Filesize
5.9MB
MD51f1f12eb8010cfdc6c2367b8f157de01
SHA1c9e88ca10e38160b082a15d5720389b9442af431
SHA25657eedba564f878541feccfeda22fb94cb105060b7b485475f84b8ae92ffe48a3
SHA51238c5de7dccb72a718bb40d99756f1dc8ce5484274463606d1390cc04d8f60e907f076ab798f0aabb36c06cd54dd1d8f95939156a01669134f22bb6f33e1d7a84
-
Filesize
5.9MB
MD5924666ae681e0e7b4bcc34e0e59d9fb6
SHA1262e1be63c8cb634926bd0840c4d651c9c5df462
SHA256bf737c4ab7a21fd89a4f73370bd6135106d67ef37c42a59e688340a76647eb38
SHA51221365167c286ba462cafd779456e30e49b34987d0862862e6e98a3d43d30ecf62c91c98f7ae83c3a0e614089f0cbbe9ee29cce07899f84749b2d2cb33459c68c
-
Filesize
5.9MB
MD5f5262f97f7a8afb4cbe31cc4e8849dd2
SHA16d1ad97d9ee394631edda30d4aaa6d3faca30e46
SHA256fef4a005f7ac821104fcd5b9e232ea9f1706ab4eb9eb80127ad603b4a51c0640
SHA51263a32b61baae7fb0ae7fbfa42b8ca084fe8e144bce5e39b45215a37b8fc9b81ddb5739bdf42b9152bfed5b267190df7a7d197d39a340eaa5671e8dd0806fd788
-
Filesize
5.9MB
MD520ce6723c7451a5e74b903bb60dde65d
SHA161987f6127cd3448bae0fb9d64957732af90354b
SHA2568277aafb9aab13ee3f452eb64490e85efa84b72153bd2522956c4494b1a96171
SHA512ea34e869fdd32d19f8c4d25813284aa7adbe7a52df3530c8af153f66bde73c71b71f1a3f78d4f28285609a7fb89b030788693d5fcef873d2f994373c218fbe01
-
Filesize
5.9MB
MD575b4b1f0107526e8461c79a243ec4554
SHA1f143ff0d5a78ab09fa64fc794e02829c6468b10d
SHA2567fa086cd739aadf5dadea5f80e77b8c18cc48b61af16123bcebaf173a28e2be0
SHA512d63105f19d0aff43616c304aca9e948d425e8609890b1d05e806036db2729dc33bc199c8e3c181a5fd9465875216b9b754366ef5f7d57978f2a84741d22bd89e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB