Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
04/06/2024, 12:05
General
-
Target
2024-06-04_b0af12dde04abd203ed6ae5e85c72080_cobalt-strike_cobaltstrike_xmrig.exe
-
Size
10.8MB
-
MD5
b0af12dde04abd203ed6ae5e85c72080
-
SHA1
b891ffc4e2f22f62bb7619b0c1d1f374d5019a2a
-
SHA256
7a9d8ed156e2647c20f66933e59ed4fb73c180c33670a6bcb9a33cf79f8b3de8
-
SHA512
14aa2efc4fb851591d7cf12ed1bfed199f7c0c3b3220861a8cd8e5c258beec48242cd3e2d6136be6e69bed270fa85a218121a4ce69104257ec51f47f9384f641
-
SSDEEP
196608:dvg6YpjCa8BMHwNuD7PKUNwabNJvmrMQwHEFoWZg:dYXpkG6uDBuQjmrOH9
Malware Config
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 1 IoCs
-
Detects executables containing URLs to raw contents of a Github gist 7 IoCs
-
XMRig Miner payload 7 IoCs
-
Drops desktop.ini file(s) 8 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Modifies Internet Explorer start page 1 TTPs 6 IoCs
-
Modifies system certificate store 2 TTPs 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-04_b0af12dde04abd203ed6ae5e85c72080_cobalt-strike_cobaltstrike_xmrig.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-04_b0af12dde04abd203ed6ae5e85c72080_cobalt-strike_cobaltstrike_xmrig.exe"1⤵
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Modifies Internet Explorer start page
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.1MB
MD5ba5f7131bb163fd5e8dd88600d1832a6
SHA15af9c2d085be60b9891b96b8728d9ac11cd630da
SHA2569595019b0bea5b51446e59d9d4dccf06adbe6303aa613c098a161fb6b2f766b5
SHA5121b8cd3268c529fda492a81901ae282d647d9e8f7c89609198b7dd1f5c5b5defabaa88d0e6cc5ac761b00eaa22c88a789bd4aa7ffa9fb48e63aaddba404681a0b
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
230B
MD5d38d5493c86493d3c599aac315bc140e
SHA1356cabbfeafdb8d41bd7530f735648b9f38ff6e1
SHA25671572587dffc50d22cc3fa1a5291301f3dd8ee536dad45cd5846dc7ae0ee527b
SHA5123fafc57ac7bbaf4396ff1687eced5873cefcab04294fbaaadc0dc8b70988457966da5ebe9e762d44e7be0f89cfe95d33ab436020a43c43a3508358dcb8bd6543
-
Filesize
342B
MD5eab37ab69c94fc275605d7e14e4be9c9
SHA19b6987eb9d61e9f6bb00b1e41ac15960a6d0e7f4
SHA256f82b33be1566ca68283ea07dac3de03c3a841946f5690b830c1f5cd389eefb9d
SHA512a289d83a6a824b558a8a2635baf7b1ad97f03a44cd7faaacce5e27f81fdeb349cb716e03561f839cb9d4a9bba4243f138eca211e5204edb71a72ba442808da58
-
Filesize
342B
MD5d3bd68f3cf0dc8506f319fcab0d644b6
SHA1b5e5a0d9347d00de4914ef62372f26ecc7697ce1
SHA2565791073f89b6919642e8db64969b9ac72e3228fbc1664a0e0c26ce87c0c958ce
SHA512e8be4161f1fb412901946501aa7be934302feb12bbe49ee26eb9590ea36786c944ef30f9ead4d5d17f9590eb2bb89722754d6990ec059891ec69396f2354d852
-
Filesize
342B
MD5cacdc45eafb0c45f973b9a1cb5a08abc
SHA14116d2d3d797cb28753188e9729c52903a109b34
SHA256a8454d01a48f54898e4138029108ac527813d5c401d53107413ea9e1396814cc
SHA5120a856303aad575fbfdd253789b4f4727044364da74757a205291b0212625fd7ab95c574947871516a17a19aef4fe7899184a85aeaa7b046beeacf4cfbb0b4e9f
-
Filesize
342B
MD5a83c81d1e692a6a8d98869c772fccc0e
SHA1c6cdf2c67d3aed999966082ed24f92065e098fba
SHA2564f1257f42ee544968ec5f4607b13d25303ec2f6dc61b5a69a151138b56d75806
SHA512bdd5572ae8848ea724c7f13903ee8b1fe0aa10841f4e61151b20cb947664c9df5c28a4430afbcce074d713467261b419f703596d5d8b45fb1848d2b1a21efc20
-
Filesize
342B
MD57fb8b72973c79a4cd8a9122353415ef1
SHA18558c1c838f16ec52f4bafe614511980d8410b86
SHA256242f8f3531a368c53b26042ad277c873ddf40619b62749aebc0df58626856256
SHA512cc94492f9693637462c41073b37415dcc5bc03fd59b26ca40d41b40b402d0009f81b6aca92e7955386e2204fbd78d144a1db8dad361863b71ea0e677c61f3e3f
-
Filesize
342B
MD571e50190be00cacc86e492ff7f5a2581
SHA1e9963462783edcdf5591c1236a2e3c7c6eb09244
SHA256ae0bfec639e3effc1f222c995a91a07dbbae4e06a6595b455ceb330cdc3d7be9
SHA512f4f3e2c335961e9204e9bc6d94421b3ad0d39f440ea272d785fa104505195bc21eec476debc09ea4522a225dbdf5070e7059d82ac127d40a80b5408a0793ca17
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
12.7MB
-
Filesize
1024KB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
64KB
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
12.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
12.7MB
-
Filesize
6.1MB