Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
23/09/2024, 00:58
General
-
Target
2024-09-23_c2995e5e00acd026c8e39af1770d7f58_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
c2995e5e00acd026c8e39af1770d7f58
-
SHA1
fd6ca1fb6430050ab7a5184aceb8bd5d3a680d94
-
SHA256
e26942aee186587a1aeed9257a91dc8f5d3f7a6f908cc8008794661d426bc889
-
SHA512
edf80d1bb95ff36e90aee4dee0cb9ec96e7d1dd4cb45e679b551e9680faa56838a8f965287e6e4bf6bb797692e6f3787a359054972dbf7394e77a28dabe28e9f
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lb:RWWBibf56utgpPFotBER/mQ32lUX
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 42 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-23_c2995e5e00acd026c8e39af1770d7f58_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-23_c2995e5e00acd026c8e39af1770d7f58_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\bRJSyOI.exeC:\Windows\System\bRJSyOI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\myzhfLQ.exeC:\Windows\System\myzhfLQ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\StNbJcJ.exeC:\Windows\System\StNbJcJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SoxfcYK.exeC:\Windows\System\SoxfcYK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JXfcNnh.exeC:\Windows\System\JXfcNnh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WwAnXwW.exeC:\Windows\System\WwAnXwW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PNPdCvb.exeC:\Windows\System\PNPdCvb.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aYbuwIj.exeC:\Windows\System\aYbuwIj.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MzolDUa.exeC:\Windows\System\MzolDUa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BMjliPO.exeC:\Windows\System\BMjliPO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cIpTtNL.exeC:\Windows\System\cIpTtNL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uJrBpbD.exeC:\Windows\System\uJrBpbD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DMgUkvm.exeC:\Windows\System\DMgUkvm.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LGerVqf.exeC:\Windows\System\LGerVqf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mDgAqJu.exeC:\Windows\System\mDgAqJu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EOOHgit.exeC:\Windows\System\EOOHgit.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PlIAXOO.exeC:\Windows\System\PlIAXOO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IqYqRLJ.exeC:\Windows\System\IqYqRLJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DWJbBdq.exeC:\Windows\System\DWJbBdq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TMIPdYJ.exeC:\Windows\System\TMIPdYJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ICTGcyF.exeC:\Windows\System\ICTGcyF.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5cee22cac8dc684de91635051ee08309a
SHA1fec1c21ca0ac776bed36e1a40ea4b17bb4b85588
SHA2569be5e7e4fc9a4dc68a41e5956b23dfd8d2777e1bbb8d2d6382685a0c19a7964f
SHA512b5ffa842a15d7bfca29a7d3fa51166fcf6e636be67c46f7e5cc276a9b15abf1d28eae54bd3b95e243a50b825bf31d45cbf1887da769eed3ab63a82a4ced0a9fa
-
Filesize
5.2MB
MD5dd0dbe06504865f47d960e3694d6f2b3
SHA1f51681f21c7205fc8e04b4fe43498477b2aa96fd
SHA2568fc6a461e2834629e161228ebe6d62cbf8a807b87533c4c615ce75e42dc466a6
SHA512d512bdb42bd8a21ed56ab230911ef1bee6c6c73c0d7b24f885462b3d1a43f76082642ccba00f250bc77d206fc2d6885c0223a05bc94e0b53f263273dc9e63b5b
-
Filesize
5.2MB
MD556cc90f0fef458dd3dd634b5c1bb30ac
SHA1a75b2a07ebe4d6c305fda75a45d8dd0e328b8f5e
SHA25615d3cb2b814f25de4fdbe5797355a1cdd136a028739d4fb119c867dce0cf8286
SHA5128f5acab2374a664dc8240453d5da885e211a60e8415caeb87150a401534a1a8d7633d9bc0a1006f467022e168d50e2160440300d683a4a58e19033ee890c87df
-
Filesize
5.2MB
MD5071280cdbde488d79ef0a27a2d1753c0
SHA1a59bfcccfc2d1c9654f686c9cd7f2881ad9be84a
SHA256e0422052d8aca8f403f2f967eb2b8a8054076dbd3f0edaabfe7f9049ed764be3
SHA5122689f6cf43fd0cd3ed0c761021e2a4ec96643383596b3fe0a20c7748be3b7c2532ac8b9f113b3ccdf8b08abe90e20cf1c1947de30283579170b166deb061fb2b
-
Filesize
5.2MB
MD53b3a9dc44925979d12688c642529ba12
SHA18dadd66ce538e610287f46d6e487dc6825b86dcd
SHA256d9487af082750a0c37424d7c4d0ecd12ec0b17fca9991104ccda91f978ec4a71
SHA5129c7ea6460152e16a6004aace83d5b71206887e352a1955394d809f1e38969fbb8a0925694aaa8411825dda9ccc0e3b2ae1a491047c2c4f95d777408f6078bbe8
-
Filesize
5.2MB
MD5ee708d6df81b2421d858cbe3187d2b7b
SHA13ba7ecd7854e4ee1629bd7313165abe89449c9b4
SHA256b1b1bbacd24d661c5a8a23a622592e8858cfd6804eaa93ae1c73ae19d66805cd
SHA5121f503a21fc3c947879fbb59f2e923b678c663e2fc003b974c915c236c0c79f100253b36d89ccac7a3c8dcfc63e37114343a6c6e78e5ab451c70cd992aa1a376d
-
Filesize
5.2MB
MD512d21b2d9647e74fa34174b5e640031b
SHA18dc73a0741e3b7b71e2725a109d8a589cc16e276
SHA25661e7824dd03cbfd552643d77ddf5e84351e249a20a7e70bc33b74c2c4911140b
SHA5120a52a087aee3b3c58f079836ec6dcdf766c17e148fb622a339e56f5d6fd04d25bd0f48db7e68af6b7143821c4261c1ed70fd24f2340cfc5892615682cdf7d22c
-
Filesize
5.2MB
MD59510f5a76d0d77ed9327e0a678e648f4
SHA19fa5da89c4961c42fe453c5af24b1cc2ef13cd1c
SHA2563e8e670ce151bf9a3d6374728f1be4102ec8fb6a35150c99af63cf9a9593268c
SHA512017e86a5e9df826fe4f7d023a4b1b722ab67de12cdcbe48d09c862bfc70292405f74ad8927867570d4aee00d6468f3473763780cb0f4073e1459041ddc1dfe84
-
Filesize
5.2MB
MD5eb0d8144634ad0d310dec4461f4a932f
SHA19ac3ca76640331a206a17ee953dfe5b7bb9f3d61
SHA25643e945bc13c64958d01500c18962ce697fbbda8f191d2510eceb837cb8361f15
SHA512202e831c8fdbd0347de4010b44db0921950e816fcc5a87dce9cb2cbbc58970126ba7c78c5d4ad13ef2504127c113b091daca9db5cb0c1ce91697e725fb29ba95
-
Filesize
5.2MB
MD50fe9c7d6ff3d3d544b0f0bc1c69b69c4
SHA131e8d3954529447df896e2cec32ca38ecd984a21
SHA256cf75179abbcd2bb98139508c3ae0841421e4bfeaa3de84441e0ea250f212b76c
SHA512066dd235ad67fd64c187735d3ce70ec4420cca6fadde9bec4e4c8efe7628ff096c764980dbdecd2e50586373d5ded9d052e821ebd6e18f2fb8ca595c400a1d27
-
Filesize
5.2MB
MD5b2fcef6e0b65bfd0d8980caf60f02889
SHA12bf82a34028bdf4a666f0aaeb61f7313bc5b737d
SHA256b686b0d729611898c51a528123449f7206052cabf39f46fd25557cf08401dea6
SHA512f87967c6707bd36aa4890e195ea7d53a912154de350ac46cf0de18acb0e630eeecb3c6a72875592301e37ee97246d051dcbeee0ce6e755f67c4aa60f29030ad7
-
Filesize
5.2MB
MD560aaa0e47f9c324cebd95245aa74172e
SHA1609d79eb74b6cb382b8b499b29c102029aa47068
SHA2569dcb4bd7daa30b4fd1c213d15ed0737bfd4543fb8e8973b62febf55deb9f37d0
SHA512f3eee11119ce8f1829293ea5863d02bb92a45103167ef354e958a3bd65120fd63e45fea2a14145c5dd21a3077bb7007efe391e2145a85d0a3b9ade04ab896137
-
Filesize
5.2MB
MD51d8d4a4cdfb819d88b592b7ffc671412
SHA1a2d96bf76b6bd55e24cd3f6a87e9dac0ee312581
SHA2565b1f52e84e0d579fb0641dd063b2b73b461a0d9b8fe496f3aad5ce85e2d6e361
SHA512ce74c6ba4ba169eb1433fa02d844e3f50ab41dfe8ffc22a4be3355ae31beff1d68391b44dbbe76c72cdc08c5f1b9e2c307931e280a1f67fb2996e04b0f5247bf
-
Filesize
5.2MB
MD50a56269f066f5a70af445b2493e93ea9
SHA1b83a9c975a6059baa654d09017b1707d6ece8582
SHA256a878acc7504ba02e3ccf44865c36c1838a20e7cd3a2b062eff9609e27c91e0cf
SHA5122f138958f2ffbd33f3cfdb21298cb21bf262893cbe2934115bccd895ff91cbc2fb697573e49a7429f4f0cd726e9b38ad5e698d39a16e69557659425829b51ca4
-
Filesize
5.2MB
MD5a1b766494dc3a0cae5d339a65e84da9c
SHA154f7930a7c9b494389e40eab300bd5dc5161134e
SHA25638a909ee01bb0b8c064ec14613647bf0888f3a86a78b7cdebb56d9f759f3e3bb
SHA512ab0cb88015066fc7c85ba4e14851cab0133b425b929fab509c78ec1db4ff1d0d00bca5551058973b147359f6f2f2bf88ae73597328e509a7f29c0682278e551e
-
Filesize
5.2MB
MD54d36f1b05b26380ec6589cc79f3420d7
SHA19c9ac4cbc57f89f126bc0c399fea928ab95749f4
SHA25666a5fe8ee3c62a6913a14ff82e29572ed7ae3efbe3e33ea9654b935c1167023a
SHA5128512fb27700e5047482e0ec8d37a9098ca671ef8197e20968550b39f41c3f85725d610960889fb5890e27dfaea96ec0146cdb302bfa2e423f09bc689af3cdcf2
-
Filesize
5.2MB
MD57c2496449968641e6bb416ffd9a65914
SHA127dd2111f236ca1ec4293352b6836aea68d7d9c6
SHA25627fa731735d57ed7dba858e9582f33e833bb2a1f4f6407608d4bc3b6f25665f8
SHA5125c49ecab8f4f32d90e127c10bf317708eafbf24242dd6ce3ef335b1fb2ad79553d18b9657a30383ab0b45278d669293e31e74f48ef3730ff8ec88f74523769bc
-
Filesize
5.2MB
MD5c94478b8dad97011c71fa61c4f5c9198
SHA1d4be2bc0d532f281e496fb6b0876db4b3dfd5efd
SHA2567bd732779e48c7bdb93b098c7d7d222f659a6b861ccc7e6d9a254961f494a81d
SHA51281ab6fa10314b2440670fb0e62331d386d3ae6c1fb90e11cd21befb5494b9fe1db5315370cb19c491df9218029c2a624074af2491811c4df02b75a775be5d3b9
-
Filesize
5.2MB
MD5491f833d9e7f179ccd2ec57a3e27afda
SHA1a4d03adc03d2300262d17b13d48269d37c37398c
SHA2560d6bd51254782988d1b450dbf5f548c9547b78277298be632d04dc8d67c4714a
SHA5122976c6ef2ccf39f146efe9c5b05de41913831878e1293e0539078fa10624442095314d9d2c8b5f6831f1ebf5e0c9bc2179d23a7584069260b31cfceedad21aaf
-
Filesize
5.2MB
MD503fd02aff1e74ada551ccf04c37dfd7f
SHA1e4945d0cf6a3ca44e83bec834badabfe32f02c99
SHA25632c5f25a2ad4a8a8928e4dcaef4a8e63f24011e22eb4137b2b88c6df72e75c01
SHA512a1bf892e89e0c8f9f2dccc86a106f749eaa673d8fc200f5ea04a581c89c1201fc01cfd2e4d67fdaeabb34b58d85964388614376fb198230403a9ec8edc12d8f3
-
Filesize
5.2MB
MD5e835d937f30def66b0241989a746a63a
SHA1a69551bedd7a1da2795829c3772e0a9d5d75c872
SHA256e9fa4bd8569acf6139b8a188e6259e16c747e03cf61c4d656d4ed502a3863571
SHA51293d6d496165286811016519d8c10b61b1a7571d57d9902a0e7f4364620b8c78136d9f8b42dde56f1cbf658604db0bd06798f9b09e8c818e2e825e3c80f4aeb0d
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB