Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
06/06/2024, 08:33
General
-
Target
2024-06-06_d019a83b5d82dfd5b43a37c2e9167272_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
d019a83b5d82dfd5b43a37c2e9167272
-
SHA1
54c0bcdcc31e109f9448fce9f369f512b85b7904
-
SHA256
a214f0d5f1ac086d59f8f00ae6932bef5d0d3c862b1c61d99a28670018c4a867
-
SHA512
77820c23b25f914971d9a6abb49779c4451079e660e69632b4249f112ff35b934f8af75b8a471550d0d8f1ff7c01c5cada4237ef75173a4bf9235bc5e28c6b45
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUa:Q+856utgpPF8u/7a
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 62 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-06_d019a83b5d82dfd5b43a37c2e9167272_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-06_d019a83b5d82dfd5b43a37c2e9167272_cobalt-strike_cobaltstrike.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\euSDsTM.exeC:\Windows\System\euSDsTM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\tGLJPuo.exeC:\Windows\System\tGLJPuo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xBWHmtz.exeC:\Windows\System\xBWHmtz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xnGgNlt.exeC:\Windows\System\xnGgNlt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BNhUSiu.exeC:\Windows\System\BNhUSiu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrIFZQf.exeC:\Windows\System\OrIFZQf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qqBFNmt.exeC:\Windows\System\qqBFNmt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rhsKlMz.exeC:\Windows\System\rhsKlMz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OVBQstc.exeC:\Windows\System\OVBQstc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QRufNDW.exeC:\Windows\System\QRufNDW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MRsuXyj.exeC:\Windows\System\MRsuXyj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bEGNIIy.exeC:\Windows\System\bEGNIIy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JzYdaof.exeC:\Windows\System\JzYdaof.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HHkwbtg.exeC:\Windows\System\HHkwbtg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aNgMOxF.exeC:\Windows\System\aNgMOxF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xKcOsVg.exeC:\Windows\System\xKcOsVg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OiFSrjK.exeC:\Windows\System\OiFSrjK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ExHaRPZ.exeC:\Windows\System\ExHaRPZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VkpgEJy.exeC:\Windows\System\VkpgEJy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eiuKNUO.exeC:\Windows\System\eiuKNUO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WnFxRnI.exeC:\Windows\System\WnFxRnI.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5fce92d8c689fe18894558292c534f89f
SHA1a81f05d7f44690fe1d6805fef003d4459c8dcc80
SHA25686d7c32cda53f38a1045ecffd1fb3472c65f839e4a79eaf72342a65a0d055e39
SHA512f804784c7d57f2f68aba287c9cae3118c629d4370711e0a80229d57116c3f88c54e50ec8e187acfd1ec0bcae38e54531b9df07ff84af63a3929fe28509afeb04
-
Filesize
5.9MB
MD544052311c1dbc5173464f42f0e509d5c
SHA1260a07d3db6ea6df95cdd8dafa267e6d7738cb5c
SHA256a51c33828481429728e248249999f1667cfaca52fb095ac1054f7fc6727ebbd6
SHA512dbfc68e996c8241190654738639d26909bfc615ea592e7812c7e640eb81dd7d94fa76a069c8fbc065fa01c421b891d1966b82f47fc37bf31b65b3c66fd14886b
-
Filesize
5.9MB
MD52e38b85351b3cfb93fbf7e9e8aace321
SHA16b65454a623fd755f6c72bce15c4560912f81a63
SHA2567c2bc36585569309268398639a6cdae696f90331a1fd40175b16189fd8f3f201
SHA512bf299b5efdc2f29f70c78adda1289e1676b61ed638c5d45c108d064f93488e532cef796d8c3ef5313ed56da1e0cc1b396e7d323f9d170c9ced2393f2621becfb
-
Filesize
5.9MB
MD580b70f2b85eb88879ea08b60eaf689a0
SHA1cf3507278c789eeeaa0ee0f1c8a4b2bb3e8216bc
SHA256d155fdd7f04424b84370a1faf0a05a65401b482cdf5924c53d88ec51bd95de1f
SHA5123282325de9ca90273d25bf42e984e0290ffff33c81967eef609b08a29c308e9a586969620315ce6da810ccac78b687df77f3afeafd03c4405cabb016d1672ccc
-
Filesize
5.9MB
MD5b78185a209156c29565f1bb3f62607ea
SHA1690c5516af728bc962640bac256f9759be183589
SHA25607f5e4a09626608f640e08abee417d5d307c2c72bf900df568b8ad18773fa4e2
SHA512b1e8da3fa409fc81f075e35c537f82d9fbc54ce3c6271caa4b41d3acb8cfbdd5bb3d2a15ede2e6ff63562e2ae985dd9acaacc32c549ae876514f1ce9c10e6ad3
-
Filesize
5.9MB
MD52e1cf2e6f65befa35436c7db628cf883
SHA1d67c5f6f597bd417042864965863c5459d0436f8
SHA25692e27d1a5239318c76bf238105edbca3a817f27d5683edd58eedb0658455159e
SHA512cf8569b94611e25ab8e712fada39e1af7f7497c8a3e3836994790d79ba5d1547fe4da6856946703872f9962fcccc45ff85633e4051f04ca4639b7ba236c4eb0f
-
Filesize
5.9MB
MD5796647431a625bc54c72940526be801a
SHA10d3c45a72dc2d06d5ad0b320f7b1a441693496dd
SHA256678b177537fbad81a01e6404403cc93a36c47691c3fa06cf7d8518e3358ac052
SHA512fa3a317676302771f4f8629045a1799761e33ff8b74ef35a617704db098cc881067f2b47464b005133c3e9035416b64a57020f868c7e1d345fd72a0d0611bddf
-
Filesize
5.9MB
MD5ef3c10d928f5b6e6f164ef63d00ef12f
SHA129b558e19652ce0c72742e57e7bdb13415394ba8
SHA2563a63d16bf1ddac07e72335a0d50c1781481173c5ce83696745a6a1900099ed4a
SHA512f13dff4c1ba20b1263df1d4da1710a99be8316472dca92940c3b784fbfedfe180cab2861a8f2832f8a60fc0db0cdf6df2c0c0e370305c22f896e1b3d0954cf92
-
Filesize
5.9MB
MD56afd80d7e3f7b391351672036be23224
SHA107938afc2a8116467470bdb92c5fba5b472559e0
SHA2565b36a5cf6c73fde252e95b0add650d929494d43344efbe4bdf5d1f85c691ce62
SHA5121aa3ac49370f7d8fd16e1e6296467981f8ed904d5e3931005f01ce2b753ebed7480479cf742de4938cc8edc49f8c98de0b9f1b804af42e4ecf6e5dd96877976d
-
Filesize
5.9MB
MD579c6688c9b4282d7b3db10d6a885f825
SHA15005f2c211f96b94b72e5046528d532ac3029b6a
SHA2568390a242637cb4f5c8a06634a4dd55868f577c60fbb130a006cd5014bcede1d7
SHA5128b3157881bdf7b901064cf06b21b1c4e75aaee9cd7b75fee467302f448804b184666aeefc8e87b945cacd01d2a4069ec3263a9d371ee0152b5c29efd466bd5e4
-
Filesize
5.9MB
MD5c1615c52a3c8d4156b660df35c240720
SHA1a219b460a7a3fb7c0012505daffad142f1b03322
SHA2568e83bcfebd445d7399764e777a30072b555a708378dc9e0b1239f87a7b516721
SHA512617bf7c57cfc5c88cec9c1ead213613bdcfb2e597cbdb6c5713d70056a1b959f2260648010c282b2d105a7f965d03942f2651e794d43857f06bdb65f66a66208
-
Filesize
5.9MB
MD569c7566c37c1c1b72bca1bb032605b5e
SHA1408346f4f4a079ac17d1decb154dfcd6a1f05580
SHA256d6c6f4e25264a9ecf3b4ac73b5389910bb91917c87a1274abe8954568b00b2de
SHA512e43b8b38d689f53a0c635cfa12d7b4cd88ca4a4bb836b68fb8e5601dd5d483f1afec55b89f5758693b8ada9f11cab6e23e71b01a4c1050200ca614f5ecd77f07
-
Filesize
5.9MB
MD5819d8aa20c162e599530a16b49fb9293
SHA11eb162f235279302b8d682a8deeb7bf4a569fd88
SHA25611be1cc358a7d389c96f8012d9a8c43844492d2a1a9b88baba258215c3693419
SHA51293e475092afe90b1ebddeef3da75544660e8e513f651294d7f53726f80e87ea0cb965aeff3bce791aad38f6c1d32115e946fe340e5cf8b40f7b340d20cae8ff1
-
Filesize
5.9MB
MD56a7f60bd2e314483d0547bd46206d485
SHA190c3347f77dd64144905d9c3158eb89dae43ef9c
SHA2564a7b428dd8ebf517002088569b895816eec8024464670b6bd03be846af742e9a
SHA512b615a2f5ff41d4aeee6510b7d54a968f89003b3b704e8ce2fb47dec1a5dfdd25e6bd871065db77b3841391737bd44224c7178a71b446e3e39af5674342f960fc
-
Filesize
5.9MB
MD5f91af26d422d01667900c923b38dcc3f
SHA1b4f3aa430a2f2ec8a5fcd65d7852398d9eca396b
SHA2564aa394d972bd50fb4865fa8dfd35689ffc8f31d65b57f3d839734c3fee1d6589
SHA512a2a8690634918a7748b48c34ae4eecb7ccf85a9da2a7118ed231778df1b0bb425c5f566fb673f05bcb941167b4dc9ba21beb48dc8c8f1a16a1f02897b796d960
-
Filesize
5.9MB
MD57ba0349bb28108cd08db67ac34f84858
SHA18b3ade0142d49f1fc45acaf9f8a085dc5e2a56d9
SHA25689c3a3e955d6c1b404499674e0b0eb9971f9d69dd06ab80a31893f77eedd06c8
SHA512633a42781a216ff4c3e0a7a3d5f24a18b37236aa81f45f77cee3f5cf76fe22009f62fbe2329653b9f317118db7a1ca5767158b47da0eb19f1044a575be970fc3
-
Filesize
5.9MB
MD572a66043cc61c2109f1a112b1441b9e1
SHA162ecbd83ecc8d7aa9023e75cbb439920a65f1914
SHA2569b14d2e24a05983df131419f101c0fe5d0fc15ada7a16a64e4599d831169cdac
SHA512c85ff6415925ff476bd0c2de515687fb4489451645e09354a2e112a57b49a732e217d0cf54eb5f731b1b2fbfdd0adfc49e36a312754118d893d7650cff7d5890
-
Filesize
5.9MB
MD5909d334f72d7ebe10a340730ec9d6b75
SHA13868cb642026818e5fcb40ae0691dc36e8e7a3ac
SHA256d926e1cc8b8ad92a986fcb4934474a6a999a695a2d9f7103c3c9586891a8ee1b
SHA5121ccd1aa086094283fb207ad2b3cd7fab6698f3dd0c7b0e6d1a611b4a16630f1c616a71303779030e59ac31bd0e103b43848368f01dd76f199fe58eda4793e233
-
Filesize
5.9MB
MD500139605bfd2794f5efd01b84f5d5b5a
SHA1202cefd5abdfbb13ab8cc5ee34384676851909cc
SHA256d9cee547ad8c5404912490536bc9d5c3ad9ad5754383baf2d75c9ea799c545dd
SHA512c1804344abfc45c56cc793ff195c5494e368e30184338a06235c944bccfbe20744a37f3984e76eb3bc627c02f7380c0303b93f300c47d26bc378f72065cd5037
-
Filesize
5.9MB
MD58958f45f5f3b7aaaf9b08a8297e3451b
SHA1b769449ee29be5fe80b44a07817752d9304c976b
SHA256b1c6cbfd845c7d358409565ed286bc8f18736d1f52e9ac80ce3b2e7b8118af61
SHA51214ab385cc696533424e0e8b324fbbeade86a2269c06282861d1d000d39de1d0d614b98543c4d4eeb1f03a17ffd32ddbc744b98e2b9b866fe0d998b0ecb2e7b4c
-
Filesize
5.9MB
MD56686d4bee1a296feab229448ea1e9447
SHA18a7a99aaec79c4356eeae9c4238d594019810c4a
SHA25624d0b056fba531a865bf599fe7154cbb7217624751ac9e330fd870895cc831b8
SHA512cbea9e2d5d6f6962007a360d6b2b6079cffafdc864f1d284370b056edefe1b9e53cf4f2d3a20546375ffaab98ea97ce32b79601e3bae369bb270a71ffb79f44b
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB