Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
25/08/2024, 01:04
General
-
Target
2024-08-25_cf5f6f616b7eefcfc67b4abbcc76bb18_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
cf5f6f616b7eefcfc67b4abbcc76bb18
-
SHA1
56a092115100bfd01d322af3308160d3e3eb2ea9
-
SHA256
5f424e43ef0b5a411c0fee9be36cb2ec18d35e826f122a344ecafc4f0bcb256e
-
SHA512
dd2a58d7c3a234e546f2415efc4f4afdd22a0c913b927036ad2d1e6a454b6337ae6e1013cc6951516ca152a6bb18641836c65b4169a98713833ea453a7718a9d
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l0:RWWBibf56utgpPFotBER/mQ32lUA
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 63 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_cf5f6f616b7eefcfc67b4abbcc76bb18_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_cf5f6f616b7eefcfc67b4abbcc76bb18_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\qBygKAo.exeC:\Windows\System\qBygKAo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KHjMBzA.exeC:\Windows\System\KHjMBzA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IIscyMN.exeC:\Windows\System\IIscyMN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WtoIdEr.exeC:\Windows\System\WtoIdEr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sYCLlFg.exeC:\Windows\System\sYCLlFg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cjkCGda.exeC:\Windows\System\cjkCGda.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\XeNLUre.exeC:\Windows\System\XeNLUre.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QpLmkhq.exeC:\Windows\System\QpLmkhq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jNODBZw.exeC:\Windows\System\jNODBZw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwwnoGf.exeC:\Windows\System\WwwnoGf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mfrUVxM.exeC:\Windows\System\mfrUVxM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TLjMEaH.exeC:\Windows\System\TLjMEaH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fhqOZUp.exeC:\Windows\System\fhqOZUp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bsnuqCj.exeC:\Windows\System\bsnuqCj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QXlcKlz.exeC:\Windows\System\QXlcKlz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hqczJcq.exeC:\Windows\System\hqczJcq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\gHCxDvf.exeC:\Windows\System\gHCxDvf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GcUJEwa.exeC:\Windows\System\GcUJEwa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VoNURCS.exeC:\Windows\System\VoNURCS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fIWrpbS.exeC:\Windows\System\fIWrpbS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bMHOBCS.exeC:\Windows\System\bMHOBCS.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54b75f4f116e034e7b6eb22c84737310f
SHA1d2498b0e269074208a59d7608d85c7a3ab16553f
SHA256844d38d6968ed127685a5ab3836d621871a6e8682589daa352b42b5c7ebc7603
SHA512c603e99609814fe39c3400fe4dd2eefe299fc55ba569b3cdb95fe0f826cae894951dbb686ad16f6e2c1a7f897010332072f1708170f3b5fd606d45c05bded30f
-
Filesize
5.2MB
MD55aabfbed76268f99707482ba17e630e8
SHA167c966409a1abf493de33291ac5e5f857a1ba7d1
SHA256a0ddbabb861dc54e88e8700e7145c344225ae18541e56ff46b9ca947690dae83
SHA5124b7814c21b69e11e260bd3183f619d8cf0829f25693e0b937d9aefbbc12dd482e5a5d60345ea508dcf35745801d46a6d43a978aaea31326ca15671c715905029
-
Filesize
5.2MB
MD59e0ca5596d290c97c21709c6c19afdd9
SHA1327e68d99f4b6bb69af1e1a0bcc855697279a3bb
SHA256811d4cda975be526effe64a6db6ffbcdfac46b0783af837383faf1ed974d3788
SHA512409530ced610e4d1d95f7517d5914ade218484280cb4ea4fdbb89e0f30abe5e8e974824919135c1de3f37082516a877b847f93c70dd21d386eca7f9d4d20cd1e
-
Filesize
5.2MB
MD5beaf9362dc4ed34bfa14964335883d19
SHA1b6616e837601df3dcf4b94bf21291b5ad557dc45
SHA2560a89e3058976b0c09e8108465d6ba74a9df4d5052b18fed7ce7dc4fed54bc00b
SHA5127b14551d3de48227ef75a244ad6bdd81af5a38d22bc0cc121d2f3560ed971ab18233589de1b8815953300ddf04ab24b1c99eacdc49ff5adfc5c20e08354118aa
-
Filesize
5.2MB
MD54bf44bdbd09a07d6de633a5d40290c6d
SHA1bf6164562094553c9f1ce46f7c12d026a4793416
SHA256af65f86a756038bf28a08bc9b8e0d48e4deb00a779d8df32553ca40cc09db48f
SHA512ebfeb7b8138e99fc7e09cf843f8e3093d970b4ffe9096346b2301cf82264b62cb3dfabd6ecc1d2f51ae6e0c46660b9b7d68ba5ec3eb2f8f20d28d7ea9f041e97
-
Filesize
5.2MB
MD5f7ff9342e60269d87c3d9a19e6234032
SHA1d07b793ecba868db7db0bd4d55e36864a825fafa
SHA2566cb5968706c79206a787860f53f1fe662620638b2e89dc9b226c643ca21283f1
SHA5129bd511115a467203b553557ac2a898043f76c06a8552949242f13576da15401e2e8d712d39c97e761b5989ae55ad885d6531d7f1244a15abebe4d4944b4f4e71
-
Filesize
5.2MB
MD5528d6ff1a178f38a448581833905686b
SHA17ca8bd5decf3f3a0ec6f602b1194caba21a53de5
SHA2561b1566b610821280f52b7ff62f04100294af56309b68dcfdb6f5e8a424ee7318
SHA512ec65f506f78b9f172752d3889d44603f120601a2312c1f5d5a176512196452df631b805dfcbbe25678baa9d5e451f25cc77f1c27caf4537ba62f9d3c85613c22
-
Filesize
5.2MB
MD58a3eecb1c3ce547e1db854e7ac98d543
SHA1b8c8d86037b4c2b7d923f948ee57a19194f6f109
SHA256c098ecb3e519558104d23cd50b697a389c85258b77ab3bd6fa3b6fd51c76c8fc
SHA512dad7dcd7c529421930eb3545e325c8525870fe837b2086a09a603b8561ec9afb1758ce891aab6a71a156fc93d9fa1172ea951056b88b85791bb12b69909be0fc
-
Filesize
5.2MB
MD543b74ed2f08d1457ce4625535be1e0b8
SHA117fdf48b300665afc8fda60cf12a971acce34378
SHA25667219951ba40b54abf388955ebb9944f3a580fa2bd7faae377cab70c691f0c1a
SHA5127616aaa99a689ab8458143ae551bb1bfed58d09a4df6662f4b336bf540789819ced56087e6c49d09cbecd8016e6f4a35bb8c36ea19ae4208e2c1376f4e0afa29
-
Filesize
5.2MB
MD51d2aa8960d34715d0c969892cb7ac0de
SHA1bb57c39beab4003009d160849ccca2bd0eb6b9f3
SHA256c889688312e36a346751e0ed0acbf6c4828a70b6d8e2b49ded871a6a0bdfdeff
SHA512962c392aeb8fd3d8526f4866a74100037df9f640b3959d34d3b0bf1764cc183d8508d3559f4d965c27a3fe558d6989e29f83882e1652e17d4e67599fa668d4e8
-
Filesize
5.2MB
MD552275b6dc2ead13b4c14b59217729288
SHA1d4c38bf33dfcf73a7b7ff0ee5d4d2256d23f706d
SHA2564ff79bd5f23b74ac49c9c8168d4a99d55d5dc75a2c80111043eb4843206e7148
SHA512378ece4f80f514fea62b73425c8069686555d73356353d3c0bdc27f03620d64edf18195083d8762b0311a611c240af730aa0f54c803aff3557a2a93d8b87b6b3
-
Filesize
5.2MB
MD5add9cbf8da2d060e351037defecff6a2
SHA183a924c3f474f9b633c1ff8a0660577ffd40bb20
SHA256f50d0109413b244c8541df2b91475874ee52ca4ceda01dd398c28c06c21f9452
SHA51216195243ab4d4f8b7528eb402cb9914657ecdc08b9759f579691f3ce6b080ac5c2ac515e0f5288a6b93854185e92e4af2656770abd689d982451c053a68000aa
-
Filesize
5.2MB
MD5ab4295fddf1083a290ff15e27208b761
SHA1303a25e55f44d098a31eab3d97260c5b18f810f6
SHA2561635b265028e33760d8e2a1ff6377dbf1f8bc08a0d63de0161078dabe08fbdb9
SHA5127a2d1d26f66995a368d4a5addd25059dba6a34b0c062c932f50b8f473def8324b25fe288f64afe4ce6e40ecd5cbebe55f5af49c32a91fec6699d34bec954b8f1
-
Filesize
5.2MB
MD506106e6798adf529c18fd74bcd90d3e0
SHA189d9cc1cb29c1ed936ca236cd958141fa7cd9935
SHA256c2b747f4525c98ea3315480f5a658ed583f0d9052beb89023027bc77ca8ffb5e
SHA5122424132132c818f7d4ec4b43d57a95237a743eb846497231d0d6493f49f7984416e4e647b180e9bcd4cdeb9a0e94759964ad72661713bd168ac1e87279261af1
-
Filesize
5.2MB
MD5583a72bf6f09daeda9b2c4c1f086ad04
SHA14e445c431e54b17d78430f0d5b17a3dec595891f
SHA256cc617c079c0447d0052921efcbb3c64261e8e4a88e4578729be0ba21d4542d31
SHA5124e5f8e016bc0e5feb7b9f7a4177aeb87accc93a1f8b7312d4a0b6e79b848a23446a4f868ed5dd95d3dbcd1d688b326fe9f41d74d6024b5fbcd66043d8e17b86a
-
Filesize
5.2MB
MD5eaed49026975c5fd6aa8cba4b39f68cd
SHA13bd3d91710a522a809627b055bfe7301fd9a1769
SHA256953135eac9dbc3d96158ab8ef012e33d65059a7c92304b44e5d271c1ac045074
SHA512d2b36f683d54fa5f1617b13e1a6468125b1542a0521c475cfd907bf28ce98150f4f34ae056c44f06e02d50801d9b8e5949251770a2f236fd459a08fb9e7bed9c
-
Filesize
5.2MB
MD55c7ec80632e5a1d709d7f9ec14f01d12
SHA1fa9a8f3daa4c10a573179168967224f370305abf
SHA256d641bd8cc96254954d370ddb1403e38f2fb07547eda8be5de0029b81406700fc
SHA51248ca85b1991429efdd9faa5e7f576f21f850d0319cface5e13ed5f03a1e6969866101dd4ea6ae261715ba4f55ded8920bd170c7f2218eb68fa7c78925791477e
-
Filesize
5.2MB
MD5382528a8911ca65ba914d594973fb56f
SHA121aead5c8dc9d254941284aae0cab83217c0ce08
SHA256714cfd58390a2917aa683881a2bb6b01cac115f0c27421aad2fb4a2b33c6dcf0
SHA512f2dda531599bb27eaef0d7b6e93783216e8c2e0abee9b5f158a33ac7d9716bfdb4703a316f36b36f5e2a6d27d47fcc8eaee926966cf03b03e465432e7d19ad57
-
Filesize
5.2MB
MD5774ae02d07a5c5ffaf5c223df317acbe
SHA1da09e1f7644fad694d7a83ab5bb3661d1e5999e8
SHA256933b3c3d99a99424457671ea5a45b8a29e6b5aec89707b783a1c7479a5e214ad
SHA5122afc93996021d968729f29aa06a96fa461dd06ac13ec0950054f59752d052868e4eb345d7445f2df34b8e5bdb560ebab0d432d941b0f46e04c5f876a4c684cf6
-
Filesize
5.2MB
MD5e15acc7dafd5f3376516809318815477
SHA15be7e71dbbd511bb4dde0958abb3845f5217e712
SHA256b0ae5f97600eb32d49fa91cfcb35b957dabbff00590a4d934b7e952f21780116
SHA512285b2ebfd02516d6b2f0bfbaf8471a2633b25f1f997837e663fc68a861946ea213608b3b687cf6a682102c7d20e307d04445bffc69ba83b1070782b5cd2add9d
-
Filesize
5.2MB
MD5e84a69ebd3029415b0e23ef96eab5c14
SHA15e26e7eda841d772595b2ec1fef30b87c6292e86
SHA25653d75398c3ecc1b084f3f6b53bd744d78b559067e99eb7ab088951acb4fb82d1
SHA5129b75e3e7b2f08d1356f8dea6e1752229b62f134acb8abe817a6ddc2b08e13e3fb1d38842856cf487104d1386fb0eab7a0aed100c9ea632bb042eef418847ab95
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB