Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
15/06/2024, 00:44
General
-
Target
2024-06-15_b16cc90b62e45626102f436e52ddd03c_cobalt-strike_cobaltstrike.exe
-
Size
5.9MB
-
MD5
b16cc90b62e45626102f436e52ddd03c
-
SHA1
2965ede39a97f11a54260f533adccccd53b59f34
-
SHA256
ee296b4d4c9b1033637572ee9c8a544e6e9bfeca2ef255ac180987c3efd2417e
-
SHA512
64496a85ea8a4996684246df715ed3bc77604c2bac4878f066ff827b7aaf32645a91226e80f0aa091e7a9557b8d0e3040bd5e4b3aff12963a8a9f97ac70a1e32
-
SSDEEP
98304:oemTLkNdfE0pZrt56utgpPFotBER/mQ32lUU:T+856utgpPF8u/7U
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detects Reflective DLL injection artifacts 21 IoCs
-
UPX dump on OEP (original entry point) 64 IoCs
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_b16cc90b62e45626102f436e52ddd03c_cobalt-strike_cobaltstrike.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_b16cc90b62e45626102f436e52ddd03c_cobalt-strike_cobaltstrike.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\kGiWWEJ.exeC:\Windows\System\kGiWWEJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SevFTTD.exeC:\Windows\System\SevFTTD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SCHOBZG.exeC:\Windows\System\SCHOBZG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\deGmubT.exeC:\Windows\System\deGmubT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fqmWfii.exeC:\Windows\System\fqmWfii.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KBvCpQq.exeC:\Windows\System\KBvCpQq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JeByuYq.exeC:\Windows\System\JeByuYq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\awvGaBZ.exeC:\Windows\System\awvGaBZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CBfzTyZ.exeC:\Windows\System\CBfzTyZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cTWVYYa.exeC:\Windows\System\cTWVYYa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\NsKRsRb.exeC:\Windows\System\NsKRsRb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwweLPa.exeC:\Windows\System\WwweLPa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yCsLybH.exeC:\Windows\System\yCsLybH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aXNmeQy.exeC:\Windows\System\aXNmeQy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uPczDWI.exeC:\Windows\System\uPczDWI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MoIorpN.exeC:\Windows\System\MoIorpN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\advNTru.exeC:\Windows\System\advNTru.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CrjTbOW.exeC:\Windows\System\CrjTbOW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wDbMHAf.exeC:\Windows\System\wDbMHAf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zIQDfJF.exeC:\Windows\System\zIQDfJF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fjFqzLd.exeC:\Windows\System\fjFqzLd.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5577b9e4e6af979266ed3c53e79f43b6b
SHA1e6a01a7aa069fb952f12ef33346c5b3869549830
SHA25627c7c28943170943e3664b139aa71a1c2aa7e39f8a7e40df59524ba7bd97c5a3
SHA5127b0006f4018314c16e9a02e8294354f0a314dd27aa6b6a216e9992eff15a63b9e12ddc624902c8c5be4fb71a14a59ba1b6e7bf07267c5ac9bdf830cae101d618
-
Filesize
5.9MB
MD5d5a88dfbfecde4024228091482321cac
SHA148744cf475d2177c60b7e30d16ca07a919ea6462
SHA2562f71613085674d8ea3aa71ce5f7f352ea1942bb1c3f438d20ae9d3692af8e2c8
SHA512871147760ebbaee120b7e7981989a5de36aabd404efadf8081c91ff3f371900487e469188c2825cbfc9575a340b46f12d7265674b721746f5de9062825cb15fd
-
Filesize
5.9MB
MD5b922013d9e9aea927349ecece927bd01
SHA16ce63225dfa43f5c21dc85e3b55deb114156f74a
SHA256726a89387942059bc5f6a662cf2a9d5aa81019513fcbbd1cec0e82615450517e
SHA512162ad0e98644ce16eba9d098a8e46f5e56d6ee1666525df8dbc197243d0f9c9369243595cb6f51eb69ab9440162a36747574513b3254b187b290eb167b6e468b
-
Filesize
5.9MB
MD5c30a27aebbe6ee381dab60900159b7c7
SHA1f4f12bb19e06cba6af16cbffce92446213d3170d
SHA256726cfff72c1073df35f4370dd91a57a5a54104797ee7855b6db093da0f0bafa4
SHA5123594585eac6e05320b0fa5459c9a0c75c3b10c5808d64e924d9b0ca5d5906b5a1db97e7dcb2e0fa3d77725c46fb53581a0ed413b536971bd67f2ee0774e71288
-
Filesize
5.9MB
MD51c8d5676c4e805e03cf0c086437d9193
SHA1f098ede8ad768e20f9bd50bcf50077f391cf391f
SHA256bdd515d19eea26b558d9d68ad12d8213e8a97134365d9387304e6f78276c1edb
SHA5127adafdbaf6914c8834976a2c72d6271f0129f6f85c67816b25bfedad7bfe5515bacb2b33e6436bd68e802db6a67014539b570d9f8713afd913de36b7b0f73c23
-
Filesize
5.9MB
MD58e9ad19bf1453e7fffd0cb45caccf060
SHA12e74d924fcf40bc8e2f9663389650dceac2c164b
SHA256a581a1c997ab7e488e619de912e678219839d1ac9cc65f6609a3cdad315d2ddb
SHA512b1b9bd8f8e3e2feef7cfb485d0e9b284929f2fadba4751a1f06c6421d397b9ef573d503524c4b32c301107b932d9af8415c771bb9b2413186f7a52987bcb0cfe
-
Filesize
5.9MB
MD5a12fef85302fb0b84ba60233329c6336
SHA108f2fec37b0a7a77803f130f317dc79eeda62a0a
SHA256ec80ffdf0d2268048e340a5535d4cf2ceb8d8645ffe3d47f361bf53573c77e00
SHA51253f544a4ad56754ebc0fa52b5e16a1e667636a4aa2c29875117e3eb033d013a3a68ece1ceb36accd79e956754f578b25d0daeb83206adf71f4e62727e2433d68
-
Filesize
5.9MB
MD5db6290d99c71b7f96dea71eb348dfb40
SHA112592a152d9ac19b4b896240e4f948352cf10a66
SHA256691e2e9dd9228c76116da9cb3c52d241118abf8190cba9177b029cf8590583e2
SHA51201bafecb5eeaf882e311427f88b634fb33e92da7c8907ac6c5f6d2836344765141615b3f0d30c6d9bd99b2f030ae9a46dc940fbe0fcabd7358e79231cace8825
-
Filesize
5.9MB
MD5bb521c9cebac58866e53e56e54c79b57
SHA1752ca5937412ec12d86508cf2403bf34741a6b81
SHA256da0b79595b1b9b2cbb1c912b00cf28d3fd1a4b2276437a58d13893a986b3d214
SHA512d107b2f9ec908ccf0187bec9bb5a617904e6a0f6fd19cd1b3222a0b58f5f7ce4e338da8ea9a35bf1be4f41cd0f4738d6d249ed89d897e36975b92d172335e3ae
-
Filesize
5.9MB
MD59fb9a43b0645f887eb615c72e860c47c
SHA1eaf578709b6bc0a3193401819382ce04961b7a5c
SHA256554c202b763916fc7edc4aa1dfc99b1dddc0a816b406c2c25c667f0e3ca7bd78
SHA5127165420661b3ad63b21b9def965d01a70f43984df4bdd5163efdfca15efa4abf9522783b6bb97f5ddadb1a738f37a4206398605fa5e1efffc12e79bda28be4e3
-
Filesize
5.9MB
MD5dbf2b4cfcbfab971ea4a399fa55f1930
SHA14c65e5697636cb8370d3a72e6c25a5b1a1e8e183
SHA256e582966ced9d607efe4d7079b3bd9e4e789f333e1424a29c14897cc9f489fda7
SHA51242fa51136ff463ee736840a06fd4faa763bf445d5435cd2a2b31f6363706c91d8f3958722fcb1f00b9620482c04faa636d6c23b0abff9f0e44f5ebf590d82838
-
Filesize
5.9MB
MD53e3a1247bb28beeaa74a3818b62107e9
SHA1dbdefab1305c97a803b12fac87dc6958e17bf910
SHA256190e121809613e696cbff6ea3418d84293d13132bed471e36cd29cad88fdd389
SHA512773818f7dba11aad68cbe9f15931226976441e98d86879ed21dccb248aa096acb3a7886578cefdbe5c04d16df62a85001f0cb8c45895733845e210a89c4a3eb7
-
Filesize
5.9MB
MD5297304f0dcecf1ef0b7d16befcef1e0b
SHA178ca3fab901307aef289c27a0d188aea789e64e5
SHA256e21279a99a6d9ea58d213ac9a94d509e2eaefa918e11f29a38706a12272a1963
SHA512d68904633e7d4344dad9ae4b6473b5eccf964941c79ddb29456375a8874aec5a23daba34d844d778837e8614c5f083dea05ec1366bb3e55c1976bc3a5909b589
-
Filesize
5.9MB
MD529ea04e22dca6ef550e2a1f759f00695
SHA14f98e609869c3dcfed17cd796a12cd0ed9f69792
SHA256942c7a167ecccac77c9dd1fc7bc0aa1c3a9a5d96848b0c839837410762949e1e
SHA512275de0d676d4349254b085c313cb4c48f806a948fe0c15f6b24b60b4d687813da50e969114811d2a1a248177a46ea2a943b3102606b0e0d2d84bc2a9a7763c65
-
Filesize
5.9MB
MD52aa4050ef6a966efd8e7201f4338fc14
SHA1fe8e1ed52e9c3e70985ca0ed3c5708d17faaecc9
SHA256c0044d53806e97992e5a53c2e50ebd5074a4daa308e565e8670f3a94d577f7dd
SHA5128e489579bb631ad6c25e9e44b1f09a611acc247c3ec9728f94cfa50d3d9a2d3533aa181328dff563b67d56961e93d6394c35d1da6eee8ee1c17a398946852275
-
Filesize
5.9MB
MD5bd6e0c013c0da2605fb91a583fcc95da
SHA15f178751ec3a596491f1a14e33cc4bece1101fe6
SHA256cb29844ccb40aa791a667aa3a67c353df5433332b800b62955a36b68d55cd49e
SHA5128cb311719f539cb7c3dab015db4e194c11de04665eb6723455c5249bd95a163eb11b21b5a1534a21dd93752cdadc7e737512bb367e6f32f992b73fcdd7e14bb9
-
Filesize
5.9MB
MD5b1de8b20dc68e23c890c924244faadc2
SHA11a4b71111de09273617061b36254a16854579e19
SHA2564acf2e8cbf05685177910e40bf2209b5b427f5cda56abb9e4a761a7ff901296b
SHA512254c96a55d4643ffb5aa4dc0582a08140370d983b01f5fdb09a55d9ad7ba3180c9817ab5dfb2c511815bfd811f93e4287a028993245d0f3390e1e51504f5d45c
-
Filesize
5.9MB
MD54eb07fa2cf75da9a3f59f2db7fabaeb1
SHA1c10e18d7d8a030286bb0cc403b9521e6fee177b0
SHA2569799eb2416582c1b6cc47ba557562df7d3326348d4675ece8efc6152067711c9
SHA512deedc160d5e11aa0ea7007699d8f16891d3da661d78ab6c969549547dcd72b7f53cf47cb8d91dc1f6b7604d6c6bf03c51d108ba58ffc806f60241545b4417df9
-
Filesize
5.9MB
MD50fc4a2e6f06baa4ef5b13b435da16904
SHA1ee604da50058b2d684e50e4f52bcc444af2a4e13
SHA25673b3a8acad9f33f25bf696bc6746132bd6c76eae0d53fa32e3ca7babb222407c
SHA512071e0abfc26265949f91139b738b66897e03ef7435eda934d8634b1b8bdce8bf6e16c47a7a6f880d1913577d32ea96472a214fe9cb29e74c649924c796ca98ec
-
Filesize
5.9MB
MD5d46bb981fe45bd4b7cfb45babacf6a1b
SHA18f386792951dc8a86022e3eb5068c7164371d7a3
SHA256a13670cde3bd7a3c325d3618dbfe5e8f7474618f8677a3b48a3db9a4e840c8a8
SHA512422d5775fc08ba85ab7a3f99030cb19bdeabcd6f9682b900698d8ed151414e4f8bb5d575785eb473c394e33bc496fdf8919ec7facfd8704ad5387294a3a72c6c
-
Filesize
5.9MB
MD56806ee657edbc230e6a2576ab017eea4
SHA1ad2e84b5b61fe4f0188433909d263d94d6f84a22
SHA25657f1051265ce0d6dd80dcb76360a62d5723183aadb2aa1da00f7292dbacc696c
SHA5124e425ca7bda9d51a8cc02cf48014e4b3db900194a157fe3c37850f5f68dad9a55562067ba06ad709b13a3827c6136b3cd055b9d0de01a2dd3c2c2d88c9181c78
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB