Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
21/09/2024, 09:32
General
-
Target
2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.9MB
-
MD5
7afe1a0d6dd1daf9ed8813fea7f617c1
-
SHA1
59c09d8e2c1e6cfe7776a9fab3fc78e9d56ac7c7
-
SHA256
f63662c02c281cf3702245c163c3d0855a4bb8151d7225d42949eabd53b70a0d
-
SHA512
052c581669cbb34c7861745be6cfa0acf131c92bb5b7205b25908ccecd582851d6c2a01824df31704242c7df10a825d7f37c8832f9de74770c6ba981c51d440a
-
SSDEEP
98304:oemTLkNdfE0pZrx56utgpPFotBER/mQ32lUB:T+o56utgpPF8u/7B
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 64 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 61 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_7afe1a0d6dd1daf9ed8813fea7f617c1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\yxpZCba.exeC:\Windows\System\yxpZCba.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TjZeHbe.exeC:\Windows\System\TjZeHbe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YwmDZyE.exeC:\Windows\System\YwmDZyE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\sRkEFGY.exeC:\Windows\System\sRkEFGY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CXYxmwu.exeC:\Windows\System\CXYxmwu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LHtkjPw.exeC:\Windows\System\LHtkjPw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\bdqZFDY.exeC:\Windows\System\bdqZFDY.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\FbaNUOe.exeC:\Windows\System\FbaNUOe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VHXVUKQ.exeC:\Windows\System\VHXVUKQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\Jdwlrty.exeC:\Windows\System\Jdwlrty.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pkaBMsI.exeC:\Windows\System\pkaBMsI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\slORaVI.exeC:\Windows\System\slORaVI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EuMBOIx.exeC:\Windows\System\EuMBOIx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PhjpjLM.exeC:\Windows\System\PhjpjLM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\zTOwMqg.exeC:\Windows\System\zTOwMqg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cUxkGPn.exeC:\Windows\System\cUxkGPn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dIUcgHI.exeC:\Windows\System\dIUcgHI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CWcAnSD.exeC:\Windows\System\CWcAnSD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fkOqAOp.exeC:\Windows\System\fkOqAOp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qOeVVYK.exeC:\Windows\System\qOeVVYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eJkmAyq.exeC:\Windows\System\eJkmAyq.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.9MB
MD5d36380548b5821250a30d1d8b6a2e6cd
SHA18b86004c8ff6f7487fc15ef6db230af58a5b5678
SHA256ca3228d5dfbb5a1305734c67f9745ef50ae475b653ad75751e101a9c57683ae1
SHA512f56801021a96d90f21c2fcc0c347e67d67c5fce80f99f8d95c88b021f8b873109ec3b93093aec53b4e53747038d02e26b6ce9d495fd3db4de1de133adf1473db
-
Filesize
5.9MB
MD55c72b1bdfcea3eba3960937bebdaba25
SHA11121c40ca00cef1dea19d2f0b1e2db618972fe0b
SHA256ab847e6d9c27538c7663249581deb2d801441b97ee03ff96eb7a4b1cdff39476
SHA512cac72b00dea8416984ed6300d87af1ff84f885a59608ae0aa7fc970926e26a07dfe09600f57630307d75c2f3228669b6b804262a415166dd2fa494abb7f911c1
-
Filesize
5.9MB
MD5c7288b0fd64873eb9f5263f5fb7ed125
SHA1aae7a2e770699dab034b5f2df4febf6f81ec06ed
SHA256f87fdefc03bb1bc06ae03ec5472a80b964a9b01a2bd66c8fa3b55acb1a06cb99
SHA5127aee00fac605e4724f5403c0804766ace0623a4e684caa21f156b377f47322bafa1cf43cbb430300025b91f6fa2ec5dc5599c272050e5287c63c116dafffc0d6
-
Filesize
5.9MB
MD563cc84e41f26b636a50014f28a08dcb6
SHA105ba9a617412421021ce4dc0010c10a7cdec3b20
SHA2561a50b88bfb128bf89c4692d28f67bcb7d146d071a58dc6411474890d1c773692
SHA51201ae9dd1421c2835705e885be54421ffdfefcb6604c153239fd5872368f6e64c432727962a83780f888d66e72e81927a6c9866f4349935e0fb75cac2274fc30e
-
Filesize
5.9MB
MD5060c1df4dd8a4108aed29e3f04ef077b
SHA10849bdfd1a0b223098f0c5863bf45387dbde9f08
SHA256a990724cd3cbfc83d69cfe9751b91f47eb8b6e83afa95094b2af8fe8a3079fce
SHA5120b3e0869735b0f4a0fee9f2211dc9123e63f5d5457949831ab3eab19c0d0cd359c22ca24e5debc682c1c524973d0dc6e3e47f5f2aafcefbceff6645b1e7dd111
-
Filesize
5.9MB
MD5c2d25d5384140a0fc806485f22fbf612
SHA17b8dcac2c54d7523be4d13570ecd21a74667c0a9
SHA25670ce517ce00895d0b5607a421ae4bdd81639c4121478183c5e1819d2e6ba1206
SHA5121986e44a052d08c400745c2b567fc92fc2c5f44adf2c19bea7151ab767775987f8e01f54651a039f148d6427e12a953984874c35abefc91048c4836ec254fb27
-
Filesize
5.9MB
MD5339eb3ab023669019b309e02a78d1268
SHA1c3e1ef2a23100dd085473cf823e394dfe9251bae
SHA2562013195bc75b87fd5803b48d6af5d41dd921e87259c53fa7a2d6f82763ff6e32
SHA51211642857ba6ec1890b0a602fc60bdb7f62a3bdfab044751d77f88fc2d7c442c2713eda526e74e994d4e051d43a68417b01059a3b600fdb775e7f80bf031ae55c
-
Filesize
5.9MB
MD5f065d6587ab38e50ff723c39f90045b7
SHA1d6c63a5b59c69fe589e84fe40f3c6f696d92af86
SHA2563b3265836b07b6119449c84654b2ef263525860065145b6057b9336f10cf0792
SHA5129a6b3b42ba0a431e6f07a54b7b5650a5290d9fb3951734cd9acaa2d7848215818c28a1ac045db23f7b34d1581fbfaa7f0f81ff67820779cdb17554d6e95145fb
-
Filesize
5.9MB
MD589b469651858ed3e87e5f007bb5569d7
SHA1edd6798171912b11ae6b11bc5bd6cb34d062bf56
SHA2569eafd03ca812f1fcf521f5941cac873804baa59ae33e2422996b02d00ede5891
SHA5121030c6528e82cd7c167412296fb2ead0b4bcf5cb9ba800d32bfc0ca3f958c292f31184dd3cadee9d618628a5067af8791c2c85e88b13f2698f696abb8d4c5219
-
Filesize
5.9MB
MD57de58abb3c591becce572a04e4a16bd0
SHA15d7f56d544e88adc6af360bd79a24c1ebc0cecc7
SHA256306f68001484d7596c8b1ec5fe0e19017bb18bd2f6d0f0447b1ce3c3ed248844
SHA51259567a6a92b1b7b2c23806efbc03c2ea884e9d3665eed9f2ee64209f6280e067996287bfb142a84c783c3b7878b8f29e69fad41140b8a4efc4a890cd2daa1c5b
-
Filesize
5.9MB
MD53f9819e79e8dc19f618f12dd7078711c
SHA1f7dde0b3d0659ec9144d4e7a58ec45020286dbc6
SHA25676e1016500949df5bd23630d1a81fbbcfb28722c3ee3b3139a5a296996b2ee5b
SHA512f2aaccbbf1bbf0df97c375cfe297cf05a499cb01a4176e2f15750d847b1f50ef49974a473d7602b670780f2046bd598aca28447d5dac8f0369a14f31d0c5974d
-
Filesize
5.9MB
MD578101cf4ab4fe657bc64b9b09da552fd
SHA10a86b28942261576b0dd5f4713c23bf14438bca5
SHA256c2e73407407cf9564a4d72e99e4080b07af1b96d0d204810325f81cac0ac19a7
SHA512ad5cc1c615d7c8f908a386a0c9796a4932972045e639599f9258c9ac4ebb7587437e898295e6c403e731fabe5bc0843087f7fe9ed678983c99df17cbd79aa2e3
-
Filesize
5.9MB
MD58676a8f700e43a2df3265672852f9038
SHA127cea101ed46e79757d190412186854c1e1bfd7d
SHA2569db316bf079793c3afa3f9629d068aa938d2d572ba4ec7d6b72f2b7ed2fc3f8b
SHA5127bcae0fd85d272f20e79373696efd741c5d446891ea7ddacbe317bc4c3bf1ce4bb2b1e42f7f0141d8e1c0519efb64edf06dd37494775ad8f8da580dcd12cb05c
-
Filesize
5.9MB
MD5c40b085d5a01b79d58791b369f3d0025
SHA1f57c98ad7f67168c2459ca5d69bdf5a59272dd9c
SHA25674bcf49455ee52cb69f6582daba831207d45f03cabc551b6fb4515b179402bb7
SHA5125c18e0e37d6311d5de381b4432b2086e062eddff4053ff3b8eb8db7cbcbad72149cba8a5ae4c6759537378f8f032305a95c066ff415874ec495fe43cc487502c
-
Filesize
5.9MB
MD5cc251a39e2cf7216651879483503f984
SHA15558cc821d5ecd2fb47c36666110cdf96d80abea
SHA25683f5f234f12aaca39be67bf29fd1c2c2a5e5ff925f3a9b8740b7e302bb911f23
SHA512de714a8fd0b841d0a0fde9499b7bf70faa9a008eb356510cb20893a433ba277a5c6281ac56d1d6ffbf1797224fd5e123d8d5384fb6c27fd36947916aa9e97233
-
Filesize
5.9MB
MD5d5a6abff16f110fff3b81d320961c2df
SHA16a4dfed9cb105492294eb946ff683b1e704f486f
SHA25651429e5bc23e86aa293d6ef9d99a7d7a2d44da769f00513d09886444d9e813bb
SHA51229890e20bd2fafc5ae43bbe8075db3c83b2eaa97c1d8ece1ca00dff00e41db42e312c62a449c3e62d5552f6aecb2cf206a4330a95df37bfb6cb1bd9baa3d2f8a
-
Filesize
5.9MB
MD5280179da45c883e01785affb481461ea
SHA10bcfada78ba382808d6e5a0dc4e00a06c4844d40
SHA25622edb912afbb0d79bca901eb037f5cbb316513ec8e9d34c314f47cfb1d2fef6e
SHA51277d894ecf31e4b5877ddcd789f053612aeceb9c1f7ff4277ad547438309f2863a7f225a298f4088687e70b65e32c3b567843d08731cf3d684e3fe052aad27fc7
-
Filesize
5.9MB
MD5ebb4032ed499fd0eb73394e1020fb341
SHA13d477a91a7784f444fe44194ae09b38a3854d3e8
SHA2565f15c9b46252f52885336b56ab95c6de56afd886a230b979f2f81d8abb4e802d
SHA512038b2187febef29e9cd97f40dc9865cfd5454fe2ce1fd3678d8a50ef19145d24a287da116716c212b2572246084c78057bc5c387c23598be3f684d80a691eb88
-
Filesize
5.9MB
MD546ab3619e0787d4c7cf85b3f061cfb94
SHA130f3ba16cd219faa5bf604ad7a9696efca7c36ea
SHA2565e209e39cc0663c9099e01df2fd091e1ae062a48026d20962a586ca893e01a76
SHA512125771b2044af7402952dc0c1da45831d0481a4967571598a54e270acdf511cd6e8a9913f69d78ffe20c8776644fc0d8a8e9e7e639b2d8d9ee9f6184cd07aa41
-
Filesize
5.9MB
MD574b6b737853c3b0052ba44f1dee10cb0
SHA1e8b968a506874d0334eb18b177237c74d6170964
SHA256a7f0cb6a8d1c484678dfc73506a76edd193698f9c1f84c9ca3493f1510dcb779
SHA512ead33e6344f5ede79385c254087d45f081478ab344edb6d9f3ad3df3921d9c2d5442d8ebee1809457de50e178fc2d0b47c7c0fdba47ee760a1f2a142f83b2257
-
Filesize
5.9MB
MD57e1434bdb589cc9829c06b5773cac4fc
SHA1007f308d2464a0855ff00715a7dd64132e86dddd
SHA256f495af8259ec1817c3c4693a09f89451811a5b131d86d7cf5b59c628cf92136d
SHA5125c6811fbc31ca35f8f6042aa27798b6a5d788b27a5e05d18fd321da31e0fc6815ddea2a294cb52ea6092282b417e692271edf090d1ebbf2323edf59a95d2dee8
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB