Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
24/08/2024, 19:33
General
-
Target
2024-08-24_5d94a4a5df29d18f1dcf742580811a0f_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
5d94a4a5df29d18f1dcf742580811a0f
-
SHA1
4fea2a64d73a7d3d82252632d5584c184868af24
-
SHA256
360fd2071b07a821a8b42de61ff1b5ecead26cc203a4a25063be33f88779f1a7
-
SHA512
4e611494fa1fef9468094f825269af2c7875a5108ba111441ffd39ce41cd686701c2c13606d41e4956fae0aa685ce4b8303e3f55ade5c9a78ddffcbc0f65b287
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l4:RWWBibf56utgpPFotBER/mQ32lUE
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-24_5d94a4a5df29d18f1dcf742580811a0f_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-24_5d94a4a5df29d18f1dcf742580811a0f_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\QDVjrNd.exeC:\Windows\System\QDVjrNd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gCzChwE.exeC:\Windows\System\gCzChwE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fZwcUPF.exeC:\Windows\System\fZwcUPF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yeyIyTO.exeC:\Windows\System\yeyIyTO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ogTbMIs.exeC:\Windows\System\ogTbMIs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dgPYuag.exeC:\Windows\System\dgPYuag.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SpzzIZM.exeC:\Windows\System\SpzzIZM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YXpIJop.exeC:\Windows\System\YXpIJop.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gQXPXcw.exeC:\Windows\System\gQXPXcw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RiOPLlg.exeC:\Windows\System\RiOPLlg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PPDfrav.exeC:\Windows\System\PPDfrav.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JUGIOvp.exeC:\Windows\System\JUGIOvp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LwpIZxo.exeC:\Windows\System\LwpIZxo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iuqxYxQ.exeC:\Windows\System\iuqxYxQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wIZtAgD.exeC:\Windows\System\wIZtAgD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RPDDFgN.exeC:\Windows\System\RPDDFgN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iSQXxiy.exeC:\Windows\System\iSQXxiy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qJYKQKM.exeC:\Windows\System\qJYKQKM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\txQYaTB.exeC:\Windows\System\txQYaTB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HWcWkqj.exeC:\Windows\System\HWcWkqj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YHWAFtA.exeC:\Windows\System\YHWAFtA.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD561a55ed5aad2f28f6116b724f92567a8
SHA1a5a6eedab7fb2a368ce83bb108c19011a46d948f
SHA256b107e63563fa713aecbe3e69a3416e141b4f6978cc86fa11b5f786f3a290e25d
SHA51256d97fa64846690abaa18dce4a0a63b9308b0d2d3196700f61e44a9150ec429cea372a91a8b83069d7be139934bdbfd8faa2a2b1bcafc082cd542859a9c44efd
-
Filesize
5.2MB
MD524d037c3fce1cc70c9ccaece1cb79e8f
SHA19313e6bad0ff1be74afbd6c8030e70ea275df2f6
SHA256d0863b1003fb5cc85802d1872a982fc5980ebb923d242bfae82b9b761fc92627
SHA51259b23cd649675d9291f9a608ccddbab70d4013118083c0081e440b1aa2496c420d2f93aeabf7ac47030a82ce4e8054d6d25ee4fb69f4e8295de275596bdd4c6f
-
Filesize
5.2MB
MD5dc00295defdbfee2832f05504398dadc
SHA1cdb2e376fa4938993d2dcabbc2add45d8b3e906b
SHA25609f4af1f32185c145755c2b8b47522438b813aa36be22fe734580d383a78f870
SHA512a75df4c2ae98d740e0a752cc32fa3045911fa6101fd580878f750dcc75244b57291551e35403e06018b0141e14327ff11adf2bf3371678808658fd85d1fffbed
-
Filesize
5.2MB
MD5c06352e3a2de6c3bcc85733dcfb6aedc
SHA147d783d911a36d3a273bb3d245030bc84d912471
SHA256239f38d2ccfe5176929ac3131017864f69f2d7ab1f3e88143e977af75fb035e9
SHA512178d30d9e7073c4a23b5ece2c8e7b8dca6135220d9e6c7060cf8df88c75d3383e423f0ccdb148e0debb75e0a353dd8b0068e4fdb1d0dae57cf65783ebc47a1e9
-
Filesize
5.2MB
MD5a5c829f6a233bb3d765ab2c2fcab3907
SHA12347cd37a1658cd726ca7c081881e44303a6ca72
SHA2565b412bfc7125827f31416949d4543348a1a59eccb95941c60c948990ded64d5e
SHA512958e0fdb382a7e3283eaf5ce6643bfac74a31ab1aa0fb6586df289a6ed6a8747c8b3f1317903d400d85b003822df55f8d758e70fcdea799aac83595b62dfc4b0
-
Filesize
5.2MB
MD5cec8ff919d3becef6449a931c47fa811
SHA121c2528da30fdddfe2ddcdcde254ca2e3a0e15bd
SHA256c75ee7de202d57d2620f3011a89384f9466a41121d12fd3c5e07ff5bb19adadc
SHA512280cbd6f9a0f29c460857633d331e017744d8b928e3ff594b2cb2541bb4c1c01b5ce6ab2f11637d2f41b14d42cb18c1fdf69348576b7c00e43dc098a0deabd50
-
Filesize
5.2MB
MD586d6cd9948397b7d738c9fe1a8d2dc0c
SHA1a16421961f1966454ec4b7e54cbbd2ee9b57ec9d
SHA256ab30c3c3d198d5225e0949996cc909fee0cd0a30eb856d81cbb5497edf3c48d6
SHA5120a5e9784705ca53932ad8bb75e1fa2f8925f4ca4dfd8ff7366ab31b9b579f5e12901e2ee4c9e95bf3abe337323a75a994323d2c6fb3934973b082b5685d90132
-
Filesize
5.2MB
MD5ae18c760a2c6a6312205af65d0934cde
SHA100b2820a5e6d57f97226affd8cc4643a5d090993
SHA256102f8ff37f826d26d1b55007219e81d3b1b1337f0bbef3a9f958d062fa47d746
SHA5125c77e507212b114efd793350bd9b66edb53d59dbac1bb52d23514d831e479a8b1549e55695dcdc9af2eb4d2fdaa0c832071c749fbdf8ef511c4da005bd0bc49a
-
Filesize
5.2MB
MD558b0b212ff2f879f5ae4d2862ed05f3d
SHA134c724d06811701026de3f76bcc342ae2b05057f
SHA256b8f18185597bfda5eccd711e1c4d054b3dfe535dbdfd0973fc67da7234f7b0ab
SHA5126f57879558017436a7ddbb26cd4b56c886e107ae7512f1a82b9a0455c55b07302dba4d7c7fcc06dce3c4672f513622b3eb5f2de6cb7bf6be10bc8bc3942dbd09
-
Filesize
5.2MB
MD56c15b8c8ad85be9f02a47a983309518d
SHA1d94a058d4dd3363bf1dc7e2418301f49fe1324f1
SHA256fedaaf9dbdad84c0b8bcda0c6f0fbae6434b25575185eda7b9956ac279e2e120
SHA512ce8a235144f676f14235903b160e4f16c03541164166a744f00629f39e08af3866bbc2e92e1a7b3dea5763aec672662c42353f7cf65fd04444cce84527e90ae0
-
Filesize
5.2MB
MD5dfecdd982975a994e5e6a2c3ba995bf0
SHA172d08cac527ee6192fd952851bbad6d381cca303
SHA256840c1131eda7276ee359c378420a388bcdc7f5f6d6809632f4d42170817db861
SHA512bed7fa2a8d2419a14ba49313137af2c2e9a563c43c19fd6f0ec92692813b7e08d615d3e558fac38ac3671015d6bb5364c66b4999cfedad5bcb597e7d39c293a8
-
Filesize
5.2MB
MD51e2ad4d9eabc6760b54d0167a1493d15
SHA1276f440e602720baa5447dcfa612dda1324795a3
SHA25646fc20a191fb1c8a544dcf16c7fd243531a89da83064905751c01f867ff043b7
SHA512a2855a47eebcb87b6a065cb7208a15cf1f3cfe80c2d765e0b85d19f629acec34a9549a91135e80da10a281a99fae1fe7aa4c88adcc2c60cea841eae6564c820a
-
Filesize
5.2MB
MD57966ec99168d1ec26c2f4bddb0bb467a
SHA168aaae5847293d86a1de1fad0e2ffb52f831619f
SHA2569062af21d3717c9edf0b5725e55cf114e58675c1d472355d83ffa0088b1e3861
SHA51286cd37cb6bcb911d6d1fe6240d1322351a39a8a70a13a2b4967206910701b73194df2ad56044b961320cd4ec8cc0b6832c81ce75ccd4e306d9d9901bca02f19e
-
Filesize
5.2MB
MD560cd44a369cc239a9b11dedbe1d7d0e7
SHA128f6f5bbe2342ce1bbdf13071db8e81d928bfdb0
SHA2562c0b40b40a7241308d341ea96a2d74ae36136ac3f522673623f2c7accec56125
SHA51200bce24e766eb28dea015d90879705d11529b4155cdb0bbcac538d70cbb36c7a48b51179ca73f07c5396a1de8f43c34104291132136b0580d0aca04eb3936f88
-
Filesize
5.2MB
MD51d9d9e09e33a33ec41f51ea619f047ae
SHA1170ba2f1ffd89b69c147f607a107fce1f860eb75
SHA25654df62b4d9ca3ba8a626afb67ee3e715ad770905cd092c17ba8d8578c21edf11
SHA5124b52b493b51845936085fa0ea9f1887cd9376ed2642b9e09bbece0b9fec4093f9469c368e2e1fe711e2169c8ae47e4a09a3bcb865812bec66150bc662aa15824
-
Filesize
5.2MB
MD5fc804bfc840da08329b0c22cfaa18014
SHA1bdade055e92e44cf7bbbb0da37fab87b5301b434
SHA256ee1b4389811dde98ef21346bfa544998ef60a3468185670ca84de7d9d074bc3c
SHA51226fa7c223c4d44b25cc7e3d8713318238f9fd1a36c7f88415c11ab0cfd1bfd6113c935b592895cd6e5a1d175c57a8f202060d04d235ae36a35ec724064d258fd
-
Filesize
5.2MB
MD5f4b768fc4a8bffea2ec3653553655a75
SHA13a14ba04141628ab0abade01ed2dae05c8933cad
SHA2561677a69fdecc4800f842bfa1cfc84ef8bf343da7760791518dfc996f254d13c4
SHA512f439c8d3da037dfaba7f4f5fc92cc44c59acbfca4286fdf0efc9e4477ef4148be33f619c7bc9d3f8ca04f0392137cd3d7253a53b4c1b0e3efa40fbfca87013b7
-
Filesize
5.2MB
MD54ab9ce4f198cb509b98c7c7fb7c7d22e
SHA1780c2bad65a7f067aa148c6b038e5f395cfef1c3
SHA2563336066349f929b7d05ab2c63eba57a045331a6e2d7313f130edbfee18c63744
SHA5120ccc4a086be8276f37b8a8ca8e3a62f67619b3c0dafc0b6358ea33fef52e51fac0200be1c9a99af0b816361ee60ccf1c04f41971419370949575f8693ca0b7f7
-
Filesize
5.2MB
MD52550712512f4ba0585ae7115fc7dca51
SHA1a20610c24440af6608b5843552fa663842f4d83a
SHA2565191502f9f99cd5cb4c83c60ae52433d6ac7f605045227ca01be0bf78dd12b6d
SHA51297a42e46cca52d20faec594fa446df6aea1289663ce66b1d9581ed2825700ea52b51fb90985443a31e511187a03b0e0e10392b7bf505209956bca390de8da645
-
Filesize
5.2MB
MD5003b491269a302cba60b649e8e75cf4c
SHA1f03b44c676887ecf79810faca6aaee25d8f9b3de
SHA256a7fa135f589a14f99f5876211902b0d4622e8688ce53e05f84e769a7ce73f23c
SHA5120b2d0de3275270c4a4aa512139c008bd3269633f9f66e159deecb82d953b96bc7c73d5c70387c4361b923463e45230f25c77566b59999608f7f8b721553a7dec
-
Filesize
5.2MB
MD55f097d2969b66fe1969f52ef685cca3d
SHA1f02998d2855c1c2dea916bc5a6218e939eb55ddf
SHA256af275d200eadae2ccd1334d0bfa1d1f22498d8b87577e960c43e2d3adf7b6b5e
SHA512197c4f337dc1b6964ef27b2ca25965715cf7999dc42af47cad80c5056afe8d6578ed3a56ebd42da48cc85cff55d3649be2c4164390dfa6d1cb2ad785e4708251
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB