Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

1

2024-08-02...ia.exe

windows7-x64

6

2024-08-02...ia.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/08/2024, 01:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-08-02_7c2a252c08e163e95525b49945df4027_cobalt-strike_mafia.exe

  • Size

    231KB

  • MD5

    7c2a252c08e163e95525b49945df4027

  • SHA1

    17ef47856f9042ad82a8f543da679641a51534a3

  • SHA256

    a28aab40b66fa98ed63ae038695c5c74cd3616d7b3cbc270e420185013ca2c97

  • SHA512

    9cc88921411cc1472ebfc56c6a687a2e94a88edf549c21fbcf4f8b6d0de1e6ce9cd0e8de1c8d1654fc0743407ce1f8adc8a79de4d8b4928496c8c70ca039827b

  • SSDEEP

    3072:xqQWod7VaZNJyEsaoejKUKyRYM2vc1mc2eUs:0QW+kZfpscjsUYvc1LrF

Score
6/10
discovery

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-02_7c2a252c08e163e95525b49945df4027_cobalt-strike_mafia.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-02_7c2a252c08e163e95525b49945df4027_cobalt-strike_mafia.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1312

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1312-2-0x0000000002EA0000-0x0000000002EC5000-memory.dmp

    Filesize

    148KB

    Download

  • memory/1312-4-0x0000000002EF0000-0x0000000002F13000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1312-3-0x0000000002EF0000-0x0000000002F13000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1312-6-0x0000000002EF0000-0x0000000002F13000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1312-5-0x0000000002EF0000-0x0000000002F13000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1312-7-0x0000000002EF0000-0x0000000002F13000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1312-8-0x00000000031E0000-0x0000000003212000-memory.dmp

    Filesize

    200KB

    Download

  • memory/1312-9-0x0000000003680000-0x00000000036B8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/1312-10-0x0000000003680000-0x00000000036B8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/1312-11-0x0000000003680000-0x00000000036B8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/1312-12-0x0000000003680000-0x00000000036B8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/1312-13-0x0000000003680000-0x00000000036B8000-memory.dmp

    Filesize

    224KB

    Download

  • memory/1312-14-0x0000000002EF0000-0x0000000002F13000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1312-15-0x0000000002EF0000-0x0000000002F13000-memory.dmp

    Filesize

    140KB

    Download

  • memory/1312-16-0x0000000003680000-0x00000000036B8000-memory.dmp

    Filesize

    224KB

    Download