Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
16/09/2024, 05:48
General
-
Target
2024-09-16_615a686480c1fc11ff80476c48f7a2c1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
615a686480c1fc11ff80476c48f7a2c1
-
SHA1
ec5db36d6c4c0d87ad52c9bb14266b4941028de5
-
SHA256
576d9a34f89e6f9edfbdbc7d119e5035598c7b9814ce56c92b56952b42dec065
-
SHA512
58844f3ff24ffa54702628b1d271662d13d0de48eba4ed98d5d03b14a0080ac9a4f874cc75ce53ea4d6d854466a3aaa7652454bf2bb038ccd64bd8ffabdc10a2
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6l3:RWWBibf56utgpPFotBER/mQ32lUb
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 41 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 62 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_615a686480c1fc11ff80476c48f7a2c1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_615a686480c1fc11ff80476c48f7a2c1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\fgcIcpM.exeC:\Windows\System\fgcIcpM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DVHvaem.exeC:\Windows\System\DVHvaem.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rCvbhSa.exeC:\Windows\System\rCvbhSa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lFlmoQG.exeC:\Windows\System\lFlmoQG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RzLrxFS.exeC:\Windows\System\RzLrxFS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ezczJxJ.exeC:\Windows\System\ezczJxJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwrHUOG.exeC:\Windows\System\WwrHUOG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\edwYJXb.exeC:\Windows\System\edwYJXb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vrsZASH.exeC:\Windows\System\vrsZASH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DnQzvAJ.exeC:\Windows\System\DnQzvAJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AVHMmaA.exeC:\Windows\System\AVHMmaA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nTDtuoy.exeC:\Windows\System\nTDtuoy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KhOsGsT.exeC:\Windows\System\KhOsGsT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lAUqFkI.exeC:\Windows\System\lAUqFkI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wWtFhAw.exeC:\Windows\System\wWtFhAw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MyFXuem.exeC:\Windows\System\MyFXuem.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uiseSIQ.exeC:\Windows\System\uiseSIQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SCNkiKw.exeC:\Windows\System\SCNkiKw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PtdKGir.exeC:\Windows\System\PtdKGir.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qQRpdhK.exeC:\Windows\System\qQRpdhK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hMYtbyH.exeC:\Windows\System\hMYtbyH.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5a8eddc63d5358ffc20899e072939888c
SHA181f35d42f1af35206e592ec5843c759ff1243481
SHA25621da1e281a3239e96eb16eef760adac9e7a44acf176eba3c5adcb36b5b8373db
SHA5123af9f9564359c9726463cdd5b15afbc293b18ef79bc4a814822f892443cd0c0b4f3c8ca8f69a6c436e0da1960b545247c65cec91428b6246d37ef1c7f8046999
-
Filesize
5.2MB
MD56138c7629d3189215be116619b71d791
SHA11113c329a0d9fa299d6da7ae5d6ec5b2356c16a3
SHA256a4f5c04f06c2926c18cd696300dd4590315e1ba6a4fe63e9db10649dd9379def
SHA51255c8d8552aca1c3219ed868872578e123e24d454a25b9acc6e040ed9e3c351743380fcf4ee867987e77b3ad4d1afd74503344d9497718cceb15e82cb468ac236
-
Filesize
5.2MB
MD5eaef0ba2145af7d3f734b251d9c76c0e
SHA1dd562cef4ae0da796ba22dcd97043714ffeae27f
SHA25654d7ebe0d45f71df85b2d8f273aaa5626e8db6530b6824e538ef6dec5d801b9f
SHA512fb1210337326415089164085d9b9d8ed38b9aa5968c151486122b89223c0e8df8f55344fd7bb1a2ca001cca565cdcead292365dd9e32795d40ad6b8ee5d952f7
-
Filesize
5.2MB
MD58e8fa48000515fc654d1deb1b64c9133
SHA196073b94a7637ffc0067c2438ce1b63817b2e16b
SHA2567dcf55fb12eceadb3052865de2c0dba864c147d0df421addcc75045234193681
SHA512640ab314f90e16866aa521102b41354d44d25e27bc259e1d641293318e5d23a7198ee00bff71b164597ed7afa57da5b5c07c137ab1d4d87e4a368b5cf5d1592f
-
Filesize
5.2MB
MD59e69f406bfed0a21b3c77dd2720e68f9
SHA15f3dbade5c62a03035e408aeaf5f890bfb1e9128
SHA256d6265305d87c696aa11f94244e8a838c82335ff3e8816e08d8cf31b63cd46e31
SHA512d5339e29bf0f6c32393b7611afab60dfc901ee32b95329d2fe5c0f4a425d08bcff065c4051b4a267688ffec8b271e06e7b1b7a074a7f6f6ec1fd0722ac69abf7
-
Filesize
5.2MB
MD53ea999f5e0074b471acc70d1d6ba9541
SHA13d212640414ea3904edd70bacda1b138153e37fc
SHA256e9f71b2dd8a9acdcca6bcb54c365703f17429141f3718face2dffaa67b1a7aa7
SHA512432fe5c215dd483012fff1cfec2b9661b374ef0c4ffa9e79495e23ef79c4271bca5b9d31ac0e21989776d356065ddbbac1639d358a80f3c020f667c2115e058f
-
Filesize
5.2MB
MD564aac2dce34473ebfcb76eca0bac3c98
SHA1a7394f1e0c32bb4f786372909df9373823a09ad5
SHA2569370c9fa60c0c18a9e32622d8f672d91afbb4fe1135a5e4d916550123c01468f
SHA5122210d419b67c04f0c86faf1a9cb9562c071a9ef142ff2923632539be13f77df2d22a2067965f380e10d6c276af605b67310fc38b361434210e275cf5cca6b0a0
-
Filesize
5.2MB
MD5c0234f4493cf6a5436025fb0024f3b8d
SHA1cdcbe3e30c53d31f4bb9e96e5e21cdf3ae5a2f14
SHA2567a5e0ea961c8217e321fdd84bcb6fe8a5c980ae748d0bce68998a7a6ac802b51
SHA512eccc97b4965f1b8e61a231708a7393c52bd715253665a24c57602cda1d796856c726c03602f26362aad537efba8fe74609d185638f6677b7e86e14abb3df6712
-
Filesize
5.2MB
MD5065a07b77909e81fedcf1044b576aa2b
SHA14c646c880913b1c4d6437bb8374d06bd5404a97f
SHA256c894d2de4f6a103700a7d02148ca3917ee3c7e2a2b40278de04ad4bd559b96a0
SHA512a3680a8f72bfddaf113ee165c8f512ced132788aa60aca7d1c5fbaedada698138f3924b08da27d391542f21872995e86beacd430998921c5b317bc128eb08644
-
Filesize
5.2MB
MD5d2c7f9a06381d79120bdd214aa79a85b
SHA194da968f65310362f2e3166973f83056099a5a8d
SHA256f210cf45f5e79d309b4efeecb97dc4d4b115e2638bc2f8611c6fba0ebb3419ed
SHA512ef58f3bde941e441a944ec9a865b44b1d3986efe85ecc7e749111039aa51055adb49de51afb2f8f9fcf22a8828585c6af403dd59a965503342d86ae3927cb9ab
-
Filesize
5.2MB
MD5e73d0dcec6320df8ab6c61334f91c5c6
SHA10648f6c09eb6606741b54fd5f44ac93963ff86ee
SHA256ecf2db13c19b0eaa2bc06d308711f9d24d48041f964a8a0d5c62078a1b19589b
SHA5125ded205b08d5860007c0a6ae9a208a3efca1d18b60b63d4995cddb7694b7eb00499a10535617ccc37ba2a2092c7c1206859f056336e82c2b45c03fd08c2a5ff0
-
Filesize
5.2MB
MD50b5e4623c46e48bce51a5de6992a9735
SHA163173f3c917b249db5ab356bdd5fe5c63716aba6
SHA2566a804cb7d460b4a3b7088bd5e4a7d96d9aeb466b386f566f20ce8c62de889f8c
SHA512e6cbd43ac6d0764800e72563bd57b964a7fc19b3172b444a2cebef0e173653d594a94d3ca4a5632d31892d3e3d1a71bf6e78874c336cb627ab222d2eb867fd76
-
Filesize
5.2MB
MD52af6d91bbbf907e531ee4971ee6225e4
SHA156d62bdb19b3792ef42d55abd5ea5eda89d11834
SHA25630372520b52bf3c954ecfc8a00b8cce5982d77f7112279c5955901f86fa6dafe
SHA512263ce79b32b7aec8438e08158582bca7c2937f852157742ff0bc708092a68d8c781c81dda250854ff5393bffefe3ee074e2ce2b23cbb5f6f97e2cbcb0c9ca796
-
Filesize
5.2MB
MD5d91ecb81dc33f542ea07c97bbd74aece
SHA1d7b0e3dc22a9fe0f71536d180639f6beddc8750c
SHA2560b3229378bec5162075240bf3c88956f80f907c4a7aca5f420b6f606f3cda231
SHA5126340b7ef11bee78c29a2a3ca992e2227913a852c5d989fbe51a064abeea98e91546f3faac8247157d38b03fc4dd70c37595ddd21724d2113b16c2eb74bf7992b
-
Filesize
5.2MB
MD5e7ed8f5b87211147e44ff86bff4089de
SHA159afd41062ab31043e7eb5dbc5b571aadba4fa70
SHA256a60f0fed26ab3c6d1202f9902e1fd002c78bc1093ef2092e67db92c5ebcf52a0
SHA51262db7155d57625f2db656bed453f0572da4c441a306e9395b48b4af49a72e32d96403cd59d5659194a061175b5cbfc9520cf1135b5bd9453377d4b2a03a2b88a
-
Filesize
5.2MB
MD536c479bc3add44fb6a5c8de464cf7dc4
SHA1a4c95f531127f6163bf3cf51b658157b312a9ad7
SHA256a726f58ced135b638f30666e20662b899cd35ff412db92cea03ab4508c08ed14
SHA512ac9bde0fbaa85ea70d8e5cf7a47051f55051e807a391c0957462935690e065cf53605a478de5df53da73d580fac397f30a09bfbf7847de3aa9d838bcdf6066d6
-
Filesize
5.2MB
MD508e7fb8cbac0a0494473a6cf4e7bc148
SHA17fade7eb4c6ec6d3db4cce6411b229adeebc0623
SHA256f16b37e59d0fb5b9d5e958dd57889cdb37241acdfda8c7183073e6649edf4a66
SHA51236a05bac9bd1abcc59e1ddd9bef94cf453077102ada115cfb01ea6a7d882d271d8ba1e6478cbe1048c615a50655ec6596848955df0261067275d126658b3084e
-
Filesize
5.2MB
MD545114c1b43e6846e45736478616b8c3d
SHA165ad3e882ec65be9d2b2fd2e6b738b99369dd32d
SHA256aebe7bd9d975b5d031748cfab0bc5c1de1338c2f11980374981358fb8e83f71a
SHA512c7e5069c5563219384d9326e342140f3bec9630dd8252380fd45552d62a0d5614209bd2d451a19ce3372af22e2b03175cc01b224670fd831e4efa24052a9f886
-
Filesize
5.2MB
MD55887dfd21d7988d57dfb096fa5230c6a
SHA1424bac1a4dca12ebfc95087d53f1a6c5a7f6f7dd
SHA256f66ee017d3194347c4a3cbc3d5dbaa30b8acc6a44f2a23478de354d4d5157ab2
SHA512f2d671c11de5f029ec35d28e3d2a5602ace932e3118a0e40424c8ddf40c0edb50b6e88e27853c9aa12d2c5ca8cdd901644e8d0cb5c02d9e8bb8361446c469a2c
-
Filesize
5.2MB
MD58bc89d76499febec00c5ff526cd7963c
SHA19cde697d44405c9cec80a3aa384a9b5f67a60ee0
SHA256fa09118b3ce09ed703b0a08310af1bd77e61267c29d042c04afd55cdc3fc13fe
SHA512d94c794053407f85c4084a7337ec93a2b3e52e1d037391e919b0a2e14d412261d465f9836f1759f82b62716ad82d4ae934c40cce432e0409b7623c900150cef2
-
Filesize
5.2MB
MD5aca20d3112a783a46b00746a8400ad8c
SHA1bcdd0558cdead86bb252059a18bf1f76d97e9bd9
SHA256e16c02fdf5b26c6ab1707cd2f957440529d70cbf1f62ec62fa424f808ba6858d
SHA51207f0153b766fcaa06d765f9a183f786d17a64a8d459c24d1ea5db41b165ee6eb678033c2dd2c3ed279eb550d64ccccaf0a5c73d59235383e4de20b3834ff0618
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB