Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
01/09/2024, 17:16
General
-
Target
20240901082582edd44053bbf44279b2640b7bc1cobaltstrikecobaltstrikepoetrat.exe
-
Size
5.9MB
-
MD5
082582edd44053bbf44279b2640b7bc1
-
SHA1
53b5c9f93c0bd15335e61d38d32d39db941a19c4
-
SHA256
1006bf08fa76711dcfc5d651d31e90af2cfdb9b0fc38939995d9530c7e7bf98f
-
SHA512
d303eb8a6c4f431a97b0db556f1046b003d3003a8372156d030ab2f4ad783d8a3c89ed0acd0f684e7b6ec1cef65cbfdffae7d1299a76fdc322cacff986fc93f2
-
SSDEEP
49152:oezaTF8FcNkNdfE0pZ9ozt4wIlr6GjvzW+UBA3Gd7po52xWKQY2v2V6liK1uOCeq:oemTLkNdfE0pZr9/mQ32lU+
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\20240901082582edd44053bbf44279b2640b7bc1cobaltstrikecobaltstrikepoetrat.exe"C:\Users\Admin\AppData\Local\Temp\20240901082582edd44053bbf44279b2640b7bc1cobaltstrikecobaltstrikepoetrat.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\lrMdpOZ.exeC:\Windows\System\lrMdpOZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qHULTYZ.exeC:\Windows\System\qHULTYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TbIHGrX.exeC:\Windows\System\TbIHGrX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WhvxCCa.exeC:\Windows\System\WhvxCCa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QdZUTnH.exeC:\Windows\System\QdZUTnH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OBPMsfp.exeC:\Windows\System\OBPMsfp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ywzewdM.exeC:\Windows\System\ywzewdM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WUHLOOm.exeC:\Windows\System\WUHLOOm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OTmZHqq.exeC:\Windows\System\OTmZHqq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JrpmsaX.exeC:\Windows\System\JrpmsaX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bBxUlqx.exeC:\Windows\System\bBxUlqx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JIBrMxm.exeC:\Windows\System\JIBrMxm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZkdCtMR.exeC:\Windows\System\ZkdCtMR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lFufSBD.exeC:\Windows\System\lFufSBD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xYAzknx.exeC:\Windows\System\xYAzknx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bSsQDQP.exeC:\Windows\System\bSsQDQP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ToCFPuX.exeC:\Windows\System\ToCFPuX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fgaKiIJ.exeC:\Windows\System\fgaKiIJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\smpVLrK.exeC:\Windows\System\smpVLrK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZFMCDqS.exeC:\Windows\System\ZFMCDqS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QChelkJ.exeC:\Windows\System\QChelkJ.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD58226f6136944f24db834b896c1417698
SHA11d001d575424287112fdd22c24385a4acf3256c6
SHA256e12d6d3019ce5b3e0beeca08b57b5fbfc47b66256eabbf5d59e1ae695aaf9777
SHA5127be355279d8d7a3c974c051b5c417b2411b97dc820966ee5e6632c82181c57eb5e6b9fe97452789756d6fb275ab69a6839ccae2ff298971b6572299731355c20
-
Filesize
5.9MB
MD528dd637ee0979039dd61d34a8d0a5639
SHA18dde4c922dc6f6440fa1a8e2a7a32b13d9200d6e
SHA256dfcde52f510e9d3364a7e476947dda166f2cbb41c9c918066cb8a1f8fd367b6d
SHA512046754aad6da9d1e733c82fbc5b0fb3561ed3e423fdbb87ebf5ed689c3b65fa71891a1400455157d04fbf9a6c9f4aff40856eb4ee1fb8886786a405d241727f4
-
Filesize
5.9MB
MD57933c1f102d4a234fe698079505ec3c6
SHA1890352da08c544bcfc3c33ddfcc56b29135ce7ab
SHA256da5d41b89974bb2dd5852cb8703f40da92b0175ad69ef8b32297157f101dd6dc
SHA5120fd1fae3707421f96846d8fbac43048363847d76720431bcceec0d1a9dd36587d345a746e1d67180bd70b415ebea31c530a615a6d6bdd0d9699999d087e63b60
-
Filesize
5.9MB
MD55a7100e20102ade20a83aad54b7b13c1
SHA17c60f0a8065941d915b10baa45968478d7a4fa84
SHA2560c4079ec0b8688699b2b22ab0bf78564928a6c6d2b89f711dc558d0271fda06b
SHA512465408fbf0fff7191969e96f7eba5e58febb91c162cc64e559d99b462fb2d6cef59c793af1d8aa2d54bbfcdf89de26e77d726ee6239a2ac2260382c231232d1d
-
Filesize
5.9MB
MD596785858f229e94d5708ac259e10342d
SHA1bee1af0d652e6ce0a57f78c4e1798f2135a006ed
SHA256d83204af58d0ccf33f4f5df2076253e02d92005c964ca9e33ae6b8dd3dcc6d81
SHA5126c9df239e01900d2dd89b9342479dcb829a6afb51ed88e5b930c72ac92801e39b6188c6e56c73c13ee2f7c8413eaa6abd81c935c84af0e51887cf50dd0871c0e
-
Filesize
5.9MB
MD5c335ba399278c050e74bb048085083fa
SHA198d94d3965d3eee8f70ff21033215bcbc4b845e0
SHA256cdaa2940483d82853ecdf4853ff71962e4be1181f7fa1972da29febbe888ee54
SHA5123ab4f2486bcce1523d3900855ee86b175c7ce2c872373ba43dc5a380a7a4a7a990026436ef754584d3e5aa2b21fd0e350672d39db694f4028e2aeb331d2f76c6
-
Filesize
5.9MB
MD5e1b45da1ec0732b9370bb70c097c0f7e
SHA1944d40b32bbbe2548bc1125f7e8f932ef979df03
SHA256ff8ed3ba2c6c601e92ec49e8a1c18115bd9c1406ec8262be9ba68e12e32a13e6
SHA5129fb4f1f66729f6845031b77f60ed20f3f873c2844e27d1c4f9f848aabce5f39e3c1b3ba01a8cabdac256c48160f0c677ea1dcc91b24cedd0464b563d109b6887
-
Filesize
5.9MB
MD5df5ac9858de78f2f8d5ceaa250cd046f
SHA102962f1cf888a49ffd0db45f254a94fe52af3b4b
SHA25685cba7c592add9b2ddbe51fb0cf5d03638aa5a19504585210a5c45445f08f04f
SHA51246b96a7116d183db42da9d4313647799aa45b7ff4ef4d15a21b2e013cb49282ac82e7a8e970a98c7699a97f3d795eb69c68002ed4f7192584de284f66f317679
-
Filesize
5.9MB
MD58854167fd0d1609c8c8777309626e424
SHA13101f6ff092dacb8dbf47acc2ab71a5fba72550e
SHA25632be7d667cd77501b7ba97971acc9b02d3c71eb0a82d750234e89ee8b147e440
SHA5124237647ae6ab0199a2c0606fc061cfbd88866b5ade0ec4587c35649715e3ea00cda9fb90d95cc5a1520089466491f09eb24a4c7acbe5f80cb2ec0c0051f299f9
-
Filesize
5.9MB
MD5f4cf783b1aa6ca975ec509b29e461230
SHA11e5d2c76d3d2df47b4817dab836ff955aa0b7470
SHA256f07f4ac0431ee3685afba985613917c8cb8be4d490f5279c84d6ed26fc993795
SHA51294d42eedd21a5e254fc4a305c77ba5feb256edaebb80d7add6f909646b95fd9d951f89fd6db91fd8fb6af1d862e3c45c1d7cf26ee63a4a5a2fb6d7a7eb63d988
-
Filesize
5.9MB
MD5bcf1142865182efef0bb27da63ac3038
SHA17fa7aca797769c56566617f17f6f4ede33698fb7
SHA25639936108ff154aa54fe84a01ef27368ca9ff54ae7bc281f2855d5f26c1a17390
SHA51299ec881b36cbaf9460de3aecd99c0fed21719954ca50a3900abbf74816ac976c0a47b5c5314457690e9e4953633fd6cf9943f2e3d3566b4cbe6f39e6d124ac88
-
Filesize
5.9MB
MD5cdd50a07344d17b9601809c684044dd1
SHA1efc942bc00c61dbd91f9a94ea0d52a5f54350d1a
SHA2568bf064bf860b7f2dbab956ce2271a5027a76425e844e27645ecdbcafc8066490
SHA5128c3a67cb3ed1b62f4aeef08b8518aeb48f1b63c47b560ea27823c0c70dc2ba6a41324f8bdd17462dd771073786eee1e9c48164a1d8b3e1bf9cebb75c2b1d8779
-
Filesize
5.9MB
MD536d7d5cefab48ce8e57cbddbd1a6333c
SHA156d0dddd4895c95a3f248a80a93947e2a389db8a
SHA2562250a0cdd1c129061f88619074a23e6e6541eb9198df8618d737b7ce964ec1e6
SHA5128e2de60aa206ddd0c4db7bece9235eee5c1d28d908fc520e0b8322d40dcbe471c5d13f27f8b3d5647f06c5287f32c3efc8cc75506a01d11e1df05ac5727e0a61
-
Filesize
5.9MB
MD5e5690e1963a05d51903c0d17c4612d60
SHA128364c356e3486b8533b28c0118a1bfaa987ae31
SHA25673823c74faa1cb4fe1cb93887597699fbbfa7743c521adfe15c8a049f2753daa
SHA512e85f001d7c25a5b2aa82d34cf264e417d6f77e01017ecf780d1140a38348a4572addf7c6ba0003254ceae9bad5c18dc24878ee77b2bb48e6a11cf9b54440a18b
-
Filesize
5.9MB
MD57d1dac0d5420e63ab32edcbaa6dff31c
SHA186a923819f2551b32d373b85c1c4f46e0fb7b95c
SHA256c957bc05f5966386ea14d53b5629a4f616de5f267b5f6abe7285a2bbc3e447ca
SHA51296211594e6c08f9740142a129fe9a2b0b2260a4301956acc639c632f130b6f2784e7eb5a1ea746fa38eef5e756e430074baee4138b10d6a6da625942d576eddd
-
Filesize
5.9MB
MD5726e3a662e55b0eba867868de7ad6121
SHA171b9611e32f7954a3bf6e1aada5664da5098e7ad
SHA25696f3e2cdb5d4e62e27f4bbff95b8582dd6b13a327ee1f5699385ab56d0c4d602
SHA5122067b0cddf5f12071bc73a4bd6c7aec843ab2b7b3dcce51685adff88c29d56bdc6d07273cb941b9b1992a3d718f311f1aa147e31620b247deb4dcc4f62172d89
-
Filesize
5.9MB
MD557e6b7f0118de564239461e50a25db21
SHA13a8b8a49541ba66bad331bc1aa5fdaca4db349d2
SHA25625d5a0978abf442963b920c72d84d1dc04f9ce7c6a03fbe34e4d542e471198aa
SHA512207640edf7c53b125448f904e7fce3d7f4c25d4dade92018650e514467ddafc10fc08f162ca9f1ff02d4381b5864b4bec1433be95ca0fe6b77d03f3b6c7c060d
-
Filesize
5.9MB
MD59590b21d6842ae417d2b36355d570d58
SHA1a5898cde6efc2795aee853ad410d0033a1ca8209
SHA256fd58e9df9bdb802799be94b49e3242383ec62ed60a1a9707bb2838531ea3e255
SHA512e1eb97375d276cf245e9c6e9488e4ce0b6f65eb778481d8a871fc78fc3c0fb5f122cc26483c1ab155d830f8ff16072e04d0815edfe3bde0be23c86830f2b8058
-
Filesize
5.9MB
MD53d847a1cef4179660a556872c2476426
SHA167ab3f701b7ab6097bab6772d821a0c90c6e061a
SHA256d6cc63f11fbbe81c96cba6d209bb7f09da6956705939f37bc29be65bf85ee2bf
SHA512398a3f9e9de96a1d3dec649d5ab838f99d8ae0907d4bb80a040b2eec78653abe2feec751566a74f876053f61bbb1434037a52ed91bab75dd2164278099c6a48d
-
Filesize
5.9MB
MD50374397e348892dbc048d7deb3bb3f46
SHA1aa21488ef5c8d226d2ceeda9b94a8371a7e50208
SHA256131dd604d9fe5d65f0d790488d0aa308287bf01fa64f88723291b124364e4281
SHA512205d3e7abfd1a585551d801ead3f8b834e41753a98183aa8387aeed8a9183e192b63374c1c5ff7ef9868ccc68b86926f290961660e58b9e36ca82f48ade4c12f
-
Filesize
5.9MB
MD55dffa75b288039a67e10dbf8549b34e1
SHA1b839890ed8981ba49710e8b752f406f6a25e3603
SHA256adc7ce07d55b9ea14d98cfa409696914bdcc30b8bd2e5f811bf15595152f63a2
SHA51271fd6c2fc21b6e4d1a79adafefa97e9407d21e15def95ad4aa54d2bb3cc61286d5244001d74cdb197aace564d0587e21e9660c08df490eeb1c9aabbcb4bfef22
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB