Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
09/06/2024, 03:02
General
-
Target
2024-06-09_012d7d7aba617660dc8fd939a0de7d65_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
012d7d7aba617660dc8fd939a0de7d65
-
SHA1
7edf54e4717d322538140882cc36ac9df4cc2d69
-
SHA256
533968da5f70b15825c3d38ac86568d335d754e3ebdfc6d22b3fdc90f72b8416
-
SHA512
6d9fda5603796731f96d1d7d27a18f4e9cdd461768a04148c2dc47aecee92f7e0d170bccad881fa505bc72263a7446a1761e31c454cf3a75d27e7db816ff8ba5
-
SSDEEP
98304:BemTLkNdfE0pZrt56utgpPFotBER/mQ32lUT:Q+856utgpPF8u/7T
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_012d7d7aba617660dc8fd939a0de7d65_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_012d7d7aba617660dc8fd939a0de7d65_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xIUttia.exeC:\Windows\System\xIUttia.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iXyRZeq.exeC:\Windows\System\iXyRZeq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OMegZrA.exeC:\Windows\System\OMegZrA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EkArEbC.exeC:\Windows\System\EkArEbC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iwVjgGD.exeC:\Windows\System\iwVjgGD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BmNilDb.exeC:\Windows\System\BmNilDb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqmFTep.exeC:\Windows\System\hqmFTep.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\atEjRrl.exeC:\Windows\System\atEjRrl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aSpRErZ.exeC:\Windows\System\aSpRErZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SbDVbyL.exeC:\Windows\System\SbDVbyL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PtaeGtp.exeC:\Windows\System\PtaeGtp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qiEpzmB.exeC:\Windows\System\qiEpzmB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lsIuKlo.exeC:\Windows\System\lsIuKlo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hzroJTS.exeC:\Windows\System\hzroJTS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HpKpTlJ.exeC:\Windows\System\HpKpTlJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PSKFIfM.exeC:\Windows\System\PSKFIfM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wVNGavI.exeC:\Windows\System\wVNGavI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CBxtNQT.exeC:\Windows\System\CBxtNQT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rsZMTQQ.exeC:\Windows\System\rsZMTQQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xkLJurx.exeC:\Windows\System\xkLJurx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GzBpVvt.exeC:\Windows\System\GzBpVvt.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5076d6d7c34d78cfa42c351c6aa5bdf0a
SHA1044af3e8604e91738eb2cd8354446e041d9c854b
SHA256c5fcf08c8e5986fd951ac5d6f1919b178d53c3679bc62e32469bbe3881fd2965
SHA512be7c5cd4ad9438a3455bcbeb40470b8794519838dd07db35d86dc8360dcfee0e713c3ffaa90e0e3fcb770ed689c3257fbf677bb03568734a1c5b1d60b64d1d3f
-
Filesize
5.9MB
MD5e06730c8a600ab7aa915e9975e600a7b
SHA1b15b3e64a25fe283c8c0959665c948e05694aaf9
SHA2564c76ef9292a970dee241182402102457e26ca1ae7d60825dce1ee2a5b31ce584
SHA5128260537b9e7ac43ec39fd0cfd40cf8ee4cdf048f7963927d413586b0a5191774668f30ef0242bc52e724015c2672c753ce8ff7648f6c6e8721180e2cf8c09874
-
Filesize
5.9MB
MD56acdb7f94dd7a35d392ffec3a4e773c3
SHA1da28ded8d12a97b56b93292a78e5c8adfeb940f8
SHA2563f3b239882ee88da34b691d762588437598ef6b055529a8da31ff69f3164704a
SHA5125d44d22d39968eff68901dc28d451959b91d4bcc791f742ee229a0a2e9f8b09de784fdbd2e2937fe2e6ad7f33c090156d9d624546d0a72bc61a2050ec3dc193a
-
Filesize
5.9MB
MD5173a4d0df9e365310a2f2f232c34afe4
SHA14301c6add570b5a6ae80b876cc1a838364705b2c
SHA256b178805e8b4ee5ecb12b6ac655d46d538494d1149934b2ab599e7d140330f829
SHA512dc80b2cba61b8ff6a25bc3899b8e1f8630373534e97afc2f795cee178180d5762f76ca3e22f744f6023e53dba2b06d56cc4b7e0b198eecd9d56c6d7d3bf2593a
-
Filesize
5.9MB
MD582cb98afec5ddbf7866e220748323b26
SHA10052626241510dada42a446fdfb8ee81825cdc7b
SHA2569ef5d0deea73bdf3aa72ab953727bbacdd763ae2a9315e539c6716894de5e855
SHA512682ca2f3b89777d90a74e32d8cfd7b62f7f7851eb32fafc7d173bdec9e652dbd01fb311ec26ce61ec23e391d160854b7a5e4c763cf0bc637419aa9e39faae3ca
-
Filesize
5.9MB
MD50b19319807c8f302fff7624796b1aa0f
SHA13d8a1f0f3f34bd03baeac3cd584dbf9b18cef349
SHA256be8009faa4467007e048c6fc7693d7a0648bd9f1b1209eea9fabd490a45f7b86
SHA5129a919c687dfe283ae218a5d984663788d54f85cdf7ac034b79126e3ec40a24524f3b8ae11b459e70b7eb2351a4c8aeaedf2e9c9e1ac00c1362810a715025d23b
-
Filesize
5.9MB
MD5e3a60e0aebb2ccde299c1760f6e79f92
SHA1bf62c7d1665ad22bb0cace14a7ac9cb55035bb2b
SHA25629a2ff4a3be94cdfdc79f86470828bc55efb649fc7198495e6a5737a0897af52
SHA512d7ed48073ad567326b6f48a90d929ac852254680233660cfdd5af0723d6ae72ace2a965d6fc03b3a2a9f3eb4274f7371f22f68c9f6196160d6c49f1e2cb4c5bb
-
Filesize
5.9MB
MD5bc951d066d7e8f95d61adffd30336c33
SHA136782bf83a3fd9575ce65fc5c3fe06588a2737a4
SHA256cba3968228a17274f45f2577aa87ce372b12fda31ed47eafe7b47b8cd8fe9cd1
SHA512d643a879fecdaaf735398e372e806c8e6244b2b3de8e4ee895b11afbb62fe5ffd2e332c07a08a6dbfa2f167f5728a7cb38c9871c62491bd4917237eeac86dc01
-
Filesize
5.9MB
MD5ea243355682d00abaa75aa5faee76428
SHA12ce35d89a7515429990400e84c970c33c5002e6c
SHA256d6b2f340d8eccd57fa9d68e86ad580863e98c7e566e77d1a1e960f3d89fb2052
SHA5126569ad89f52da3931119cf80b911528fb57fea8e2f7afcf8adc6c67227655d045ac5529b66863a3bb6ccf074afff9450b97102c1883e19ccf30238ced9e61f44
-
Filesize
5.9MB
MD5a25f03c5ca806657f204038e66c6faf0
SHA1424b9d1c673888c3a9d3edb4bac2ca26312cf0a7
SHA256777bf7fdad74b5487995d69136f04073e859a0efb17eaa70f5723761df49bcdf
SHA512044bfffc3cff2e3cfefd42df605294bd33f7ee07f759635b9334df6419ee896f15982c20b4672a59de3c7d0a9eebf003406edcb1833d88c6ef5a7978406e4414
-
Filesize
5.9MB
MD5fbdab45f2c133e9cf4527033966f6591
SHA121c02928ccf114ebcef118882cecf6518286e393
SHA256b37df4e22fa8c2915840d7f101a1c75f4e56e4eb1f53e4859b47f91197e963ea
SHA51252541dfcd3efd0d3c13d6cfd85f047def6158576f53eef0e58364a787b97f226e2c30d52bd409ce3b876173bd08818b52c27955bd28d915710d4379aa78f1ff1
-
Filesize
5.9MB
MD5add223615610735f034e7b872db43230
SHA10b01f2618702020a614d5d5d6e2a193f75fcaee5
SHA256dbc4990a617b6220792c4248837520cb70099724d013ae28b0160d87301d209d
SHA5123caedcbfce6a7d06338d339351be3711b537940443006352c253c46db5f4e146a9c702ec339e4d77c0054439b6f7e4f0bfd5a7356f4a6a249ead0d337f9e15a2
-
Filesize
5.9MB
MD5feb30dc6597f3cb193f7d3e94b853a02
SHA1f884be67c293357db477c2352d25dd3f9aedb3d5
SHA256d5d60c4bb2406a9326dcbf3bcc84a96edd372ba76d722d7832d8137c8ccfdfae
SHA5128d0d7be84024cf9630a075e3fc5c0c7372d7d36812f4611ea73c21f99c99b5961bfa6d6eac16b070cf84f3cbed94b57947f27b93c80f47af994e113e2e6e81de
-
Filesize
5.9MB
MD5bd5652bea0be3209dafd1c0b22ddf9b1
SHA1ae0bcf70fb4717d4fedd04e209da426cf575a6ba
SHA256bda287214cf31f94c63abef3b62b81da6a132ea6a43f5e29aa35c6033d06fe86
SHA51265ff9451ada555ddb2e7aedc2b14fc4404052049402b7f232078ad85541715a3b46de096e66e6ca078f87ad58b913d2f86e48377d327bc92771be7a5d68dfa85
-
Filesize
5.9MB
MD5247d69728a81c5b36ffd3638fa17dc34
SHA1ef6b982b1137176448c64d0a74a9cddfc571ecf8
SHA2565d94deb6bf7e26a0816d4e3bc3a5320331c9d6511cc3f341cfbf00716f93f0b2
SHA5129ae7c53d2111c1c8bcbe6f522fb70d04f1b920b53caadaf08667b2614524ae0e781a42e36b55959c2e7cb4b1981ba1ff762bc42e0f325b14370bb791162a56aa
-
Filesize
5.9MB
MD5a683e2890d3d8dc385360c5ead12c5de
SHA19106d5ff524ba0cb89f2160a3387eeaaa2dde4b8
SHA2569a4423f9584fb7e64cc4db5ee51ad9e4a9cce3c0d7a096a64cc662acbd7c55e6
SHA512f1f7504d6f69420d9e68b212d1d6b5f49002cab12c5595ca2b350d6097a1ab086005a1e0bd64c570a14cbc12c439a04fc4c52a63f06008d32dd92596fb00cc3e
-
Filesize
5.9MB
MD5ec2cdac2d28aac477b92f59cfda95f8a
SHA1d2e0980b7c603dd0e302744c8b4b23224882a4c8
SHA2561e23d2cc5c9b29fe28e60b3da1e6e0a8f051d405557bc13518ba78b16fa1f872
SHA512785714f79f08efe90e8a9467788141db4e8280a10951cadac3615255f9875c08aeb59f22853b7dd9b08a6bdceb06b79babb7aa086d58a6e4abaa7106fdd1c885
-
Filesize
5.9MB
MD5a42ae5c26492287bf9244335554e18d9
SHA1d7088eb21c7c2858dbe2d23272cfddd288370bf6
SHA256a51c2b5682da955f11d5a38eb4cea43948121dd2472b0ac52bc71e5fb177263b
SHA512b97d6aefb228056b147377f08aa4bb0aa4acf8b9f353d57c29963cebf83734801a0087485f8f936f9dce08df357a87b3d726439b160a5ba96975287282cae847
-
Filesize
5.9MB
MD5221f66433ed60584cc07a7daa1d537ab
SHA18ea0cae839add18a33a884a8cfa50dbbc29eb1d9
SHA2563fb70b186cd0d79c978470641bdcb67b2594566c850684c3ea464c5f8e0818a6
SHA512087747290829f21a8e9527c239045c25c79297d0765093d5ffae18fc67a313bfe244c71c6f74d4260627df3ecf397123da98990b7d8c4540f84df4d24b66cd68
-
Filesize
5.9MB
MD515971c3a967e8175aba8f4fc79a53f8b
SHA152295ffb22935781547d01b1e8dd37c661ab0c87
SHA256e50f3e6c8cb686460a57dbc94f8a2f729b6b5acbb6e063cfdfc615c63c9624cd
SHA512a9eb7aa1c5b998fdac8c031e039041c3f1200322af1a41c69bd310032c70e9df083b9f7742e61d018c4941668b93d89ef36e5e40b873dc02cce8c361ccc771f8
-
Filesize
5.9MB
MD52bac9d52ad7378bce41051af48afb70d
SHA1576487c580ec2b9c826e28527f87fcc0713acd40
SHA256413908d0076fcf04189df16092e07bf0fe9e0aa1d70ba653921dec312720933b
SHA5123c800d8a5e28137ae7bc854b698af75ddce4f7d668401e22f2266797274d88541f6f921db4179dd2a4cd5d544af13e87e6cf87aa5b524009fe7f0cfe1a40e43e
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB