Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16/09/2024, 06:01
General
-
Target
2024-09-16_fa362e07e41eb20f8c15f7cfbfcbafa9_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
fa362e07e41eb20f8c15f7cfbfcbafa9
-
SHA1
4c22e4f9d3bdacc5e1f37294d51c59f2781399f9
-
SHA256
718c8366faa8561539cc06a4984793307e8184fb4393d4ace483f79ba504c165
-
SHA512
e915d7ce3671532349e6ff62f5a09e0c19658d20d2647562ca38d79a48b0f7c1fd621d5a56f62b891a68c77d5badc5f7982b1912b9527cc761c512af2fcaa347
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lj:RWWBibf56utgpPFotBER/mQ32lUn
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 44 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-16_fa362e07e41eb20f8c15f7cfbfcbafa9_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-16_fa362e07e41eb20f8c15f7cfbfcbafa9_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\xpELSXM.exeC:\Windows\System\xpELSXM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hAChsWg.exeC:\Windows\System\hAChsWg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mPWnYYZ.exeC:\Windows\System\mPWnYYZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xJkAjcn.exeC:\Windows\System\xJkAjcn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pbPcbAI.exeC:\Windows\System\pbPcbAI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vFoRaaR.exeC:\Windows\System\vFoRaaR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uaezgAt.exeC:\Windows\System\uaezgAt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MjvRVWC.exeC:\Windows\System\MjvRVWC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xyTifbE.exeC:\Windows\System\xyTifbE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ubkEGnN.exeC:\Windows\System\ubkEGnN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xHVUntf.exeC:\Windows\System\xHVUntf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMscczB.exeC:\Windows\System\TMscczB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QNOTGOd.exeC:\Windows\System\QNOTGOd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rqSHpBk.exeC:\Windows\System\rqSHpBk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WTZnKOn.exeC:\Windows\System\WTZnKOn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JwYgmIG.exeC:\Windows\System\JwYgmIG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JtEIvug.exeC:\Windows\System\JtEIvug.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wUCjDTt.exeC:\Windows\System\wUCjDTt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IeKwnTo.exeC:\Windows\System\IeKwnTo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hsLmzQH.exeC:\Windows\System\hsLmzQH.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AwZMMJy.exeC:\Windows\System\AwZMMJy.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD54d694acbbfcd7f51d2667f4d9afb427e
SHA1483b5e50ecb4ae28812337864373f3ccb9782a4a
SHA2564d1c4eee9984353b9d8adba53b0d0f090d920340dedc368eb77a61810cb8684c
SHA512202db6f789cc5bf68f5fc7db09c038ce0c5dcc01eb3f1abc5e1502dd912319530ae6d64f54cf94fdd8b33f6b41c18d25688388eb08c011a5ad2905550ade28d3
-
Filesize
5.2MB
MD55c941b9114b61884f5796480aba5d906
SHA10ab1766e6ca73883d8d3481a86ed5f4b70d3ccda
SHA256ddb97c14f55fd0bdcb59d2f6d2ceabf0d8197bd4dca6c23f3e24b22742fbea74
SHA51217fec0a57f49a318f227189d9e89cc4bad09995df4cff6ca756a0866da6868a1b7c8b04a80c7a3e1beaa9d4bfed154e4d4926c514c5170114408034b390b93cd
-
Filesize
5.2MB
MD577b30d20517aef95f59a8ff1a728b8a3
SHA1e6332bb05c46684277f7a3d6ece586c470382f5e
SHA2560417950c1e98393c75c793221714fac089433805d5ac020871f823fc7ac17e6a
SHA512d9fd0a748f439a60db459c96098e5e416dd77f5b212b33962065743f957b6f8329051137264ac8470a0aab322fd3e6c7efda0ba0f12f888df4ec1e332d26f0e9
-
Filesize
5.2MB
MD5c5762181c938d138a417e73d99acfae4
SHA155b3e19232235835346d47235779446e3fcf25ce
SHA256075be1f95da98e98c9a1faca943c531d39ec644d3a9fd0df5bc9d62fd33ad589
SHA512b5d6dcbb62e09029e2427fc5036160911450f5e85e81559b5b10422134216172d0e128a0502564162165d75b978b0849b3e1d9daa02197ba928b9dad1811b001
-
Filesize
5.2MB
MD5dd96d7c20480146bc6b49160ce549aea
SHA14cf54b34cba143af21810a40979c9b47b7440bff
SHA2569bc1321773f57da23c53db18d8655accfce6d86d34817784fb4ac2a770875e50
SHA51258675f50843199ad4ce73e9e688da1ce8d6b5e5704fba2ad69ebf1579c2fb366154a7df5424fee7108f684f88da06e0abf44a29b49f65908c4b99b8f337bba35
-
Filesize
5.2MB
MD57001a8b527490c66ffa3194dfcfb576c
SHA10a598f460f221382583c5b9b902d69429b93fecc
SHA2564f876a24e666fbb57c860a9831aad292bca05c880063deb759d1e689cd1a7e4c
SHA512361db854cae37d1012430f72087149adc8cd5eb200dbfe649ce7044dd6c6f85fc6533e49c036dec4646d60220ab54507db864425c42234e0533ded78486dc4be
-
Filesize
5.2MB
MD57c40275e9240577d553a9d540eba7ec1
SHA15c2223f4d60f9169d2ffeb4f8e1e40f93c512a01
SHA25693bb456c44df5180c585010f909daf2f2c028a7f368578f7e24b5848b59bd190
SHA5124a0027fd27b4c38754f34a6bb4898471089b5b76c66458f8c1bc0596b9b573af6da3b5f1a01da449341d59c2289542371814af5901aacda55824e203cae9b34e
-
Filesize
5.2MB
MD531f3c413c40ed0e6df724e66a51e8124
SHA182e720d27a16ff07887d72d07e37a6a4e940df78
SHA2562068ea25d4f35181e7e9578200c43d60db820751ad03f7279ee3e4c3bf2e3023
SHA5121edd51bcb37b186a2fba2f0ba425937b8b207fc8c312257272d7930eee496ddf4ecc960976763b754b2254db7ea0b6585c0f26cdaaf787e6df2586d845a28e30
-
Filesize
5.2MB
MD561e61a15f23e84b472d5a8d981a9a03c
SHA11bcf544c6f17a9ce8199fee9af33c592930dfe37
SHA256f573bfe25bce35ce12948fda13dc0c6639b306a25f1cc54816674a561a126397
SHA51249da5a37ec989faf2d6748c99ffb32fcc24e74107c0b8827e67295cc45080915adffe928f36e99ee441b338b4f8c837df625dc4398dbbfb9cce1c117ed4aece0
-
Filesize
5.2MB
MD5a54eb0022dd0e9d1ca51df879009d8db
SHA10913f73abe32e867671dd8a5f043c08cd53cbaef
SHA25699179b8bb59cf990f57d95091813a81da14914c939df745e1dc3d2104699c351
SHA5129b941dbf7e1fc4f0f3555f68e2789c891e532757a7e5ea463362524075f23b89546312a41860d24154c0c3ce0ccf7da938f102cee84247078bf18d0187ffbb37
-
Filesize
5.2MB
MD5350c84cdccd601f52fd231a81a57329e
SHA1650396029d4516c295aab65ccf66be440be256fd
SHA25646d0c156af3567043f2e882b1aa665ec496d2ead3800a11a5d508fa76edb2c85
SHA51202c73651d7d9cb6cebeb3cb4b99678cdd6ed8225f66e57615ef6a47d0c50038680dec3a94f3c9aea05a3050f5bbf78bb8b74e7283a24042a5e46e9cd68fc3e48
-
Filesize
5.2MB
MD56739d63a3f3f8f5074d8008ed3c4d1d5
SHA119ad3fb698e576575704d1ebdceb395973c20208
SHA256ad752768fb6991067bfdfb5569fff64494fdcc2993ac591eb8c43860437e5152
SHA5129c8cda24b073fbf93ceb6faa15d366ec17ef581bad429609a44d7b747acbaa46403e2e391decc133b938e1c6cb63eaaf87628233117ed1181eb4eb66e6b39808
-
Filesize
5.2MB
MD5ad2dec52fbba0499010b4a56149793df
SHA199a8d7bdaebd0f776d907045b84bd9a4f7e660f1
SHA256367f7684b7f2501572edc29ac8f1a8d300a1d84646a46a07eed9f9ef2f15f14a
SHA512c82f33995e66f9a1f3ee4275a111d4ef16d10f5b4042616c2a6493e7250906feef3f03dafe37267ae589656557430218c845ca5df14f2f5a2aa78b90fba5d365
-
Filesize
5.2MB
MD5388fda60c107aa1a29482784fcd25468
SHA1867e1aef9bdafd190d8b6f5190e53366a3de6c4f
SHA2561cf4d2c43d48d08e9ae4514ba128108e7b42e4c7efcc236b409d2abbb89d47ff
SHA5126c222920fbecbaa158ef5a012bb0be076816dc3d3c52b8e19891a1b3be0b35667efd70b24cd582c95c0da0e0fbf7ee791be219dc69527e202895f004d052fabb
-
Filesize
5.2MB
MD5b2d2b4dbf9851f412c1d3cc60f1376b3
SHA1e5319ed6df105945782def396b2d48b049572e00
SHA2566099afb3120d7b1ebfeda8c86d799ec8279a2e33f0f8ecbdd712728c9e3b3519
SHA5126d77a5ef29f0aec9c195079be9f66063b73ba0aa4c442f0991041e9818c4b1b27128072c767d764a5d950f92357d771ed07edf89b88f98afc283ed8347ee29b3
-
Filesize
5.2MB
MD5a48d9ba6d6d9ccdb3952c1dfd7454b85
SHA166d2450b51772af4ae3444f0eccda4156ab4eb05
SHA25636b43345b15b681e4a69dc3c27cd95c4063df81fe06e671f4c5229e3499779e4
SHA5124586d22927031504c172b21ca1b76700ad212609cc69fd735c26fd0676d722eaf0820217b896a5d43c5d2373615a66ce599e34c32be626d2bf2ded87956ebc69
-
Filesize
5.2MB
MD50c53e753c5433a9d1e2f5f5096645d68
SHA16dc338c5616ce8da3ec437128d7b3700f6522345
SHA256448f4710720e46011762ec45b9c4d4bdce0c15dc97971721dac2b93a81c28769
SHA512dc68194bf2598adec7d39931e4a034e7dd13fd566dd2a6a28c503a944c9513412d7c366857798f292a55a7308a61a50a50d969c6c33fd37329608a5bd22a8032
-
Filesize
5.2MB
MD54813ccac5c8a2fac55aa9efa83de8b63
SHA17a0b39877139628e5bbf95df7e7022d8c2208bc6
SHA2569c50dcebde5944f3b3893334cda2556c52905a0fc055b600a0f8f2d56fbcc6dc
SHA512561bfbf05a008dc3e702672a78d90d9c1417e2cca3a94a12b1f6a4b7027cf3258e9dc8596084969e0dee73d011ba3871a09d11de0e9f7e4137d26419739071c8
-
Filesize
5.2MB
MD5ea659d275a359a1373be4ce610f85a7a
SHA14743b7c11a20c3e93f840893a3833b60908d6fd3
SHA256f261ab987ab8132ebc8df688949ac902ad8487eb31dd20126bdf632dc222254c
SHA5120c66b3ac3d1db7e4b66d641f9d44dfa3bce17ab1f53b696b678ad8cacd87f0dc9a6d61917c7e4fed9b700bacd3b6aa5409bb5cc9ab6cd255dee17124e6cd04cc
-
Filesize
5.2MB
MD588a63249072240a20aedfa4bd62f84a2
SHA1c196e55392750dafca7240f13953e707f230ae2b
SHA25610ffd55add6813c1d161cea435d600b212ff0992b14c892c4f0a3a1c1e432a18
SHA5127b0320a0c33c2b7a9336582c9a15f25062bb50cfe24606596eeb4e83d7fd5f588a692b13c066740a56c1bf0b3f792c868115fa16a76a872faef05dcbdcbae5fc
-
Filesize
5.2MB
MD58fe151481a9427ee68499ccf9d0315c4
SHA1489a92bf7713397bb41bafc6f87f1a6e89f4e242
SHA256fbc8115718f7fbac12ebfb67e2d9aab6f96ad1779914c6807d6accd94104ec0b
SHA512307eca949fcb34e59e017fa8202c8a85364856ec5913c2e66d2eaad41adfd651b11b03f9bdd27dee0dbdf5a732ea47a7323d24bdbdddc025fea7c1db775d5131
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB