Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 17:58
Behavioral task
behavioral1
Sample
77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe
Resource
win10v2004-20240802-en
General
-
Target
77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe
-
Size
12.6MB
-
MD5
6f12b563903c18eb157ce9c2d3e9dbd3
-
SHA1
1faf2fb04b21ce8ce738cd54ac562111b5ccd874
-
SHA256
77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028
-
SHA512
3506585b7164904abafba01bca1a4690327cdceef3dded37d45e253ee72a29d4e8ab83a51990ef467df16c70e5d8b9d07851505966f8c41cb1aa160dee1ee2aa
-
SSDEEP
196608:2VEk31F89onJ5hrZERm0sKYu/PaQoRz0mpjNcWl7GofBlib7u5lxDDNP3C:0Ek3r89c5hlER8Q2leW1Bl87u5lxD8
Malware Config
Extracted
cobaltstrike
http://172.20.212.107:8080/l8Gr
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MALC)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Loads dropped DLL 54 IoCs
pid Process 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 1644 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2080 wrote to memory of 1644 2080 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 30 PID 2080 wrote to memory of 1644 2080 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 30 PID 2080 wrote to memory of 1644 2080 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe"C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe"C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe"2⤵
- Loads dropped DLL
PID:1644
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD57942be5474a095f673582997ae3054f1
SHA1e982f6ebc74d31153ba9738741a7eec03a9fa5e8
SHA2568ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
SHA51249fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039
-
Filesize
35KB
MD5ab03551e4ef279abed2d8c4b25f35bb8
SHA109bc7e4e1a8d79ee23c0c9c26b1ea39de12a550e
SHA256f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44
SHA5120e7533b8d7e5019ffd1e73937c1627213711725e88c6d7321588f7fffe9e1b4ef5c38311548adbd2c0ee9b407135646593bf1498cbee92275f4e0a22ace78909
-
Filesize
85KB
MD5d95a76f54aba4792e7adf58b860fb4be
SHA114763b2335785d2f1612c8bf25ca772747a0edd8
SHA25683a50baa8917cabb1d888ebcea8118c065f3975d4ae7e36c931febce181404b8
SHA5124bbabacb9e3ac299c755a0bfde6fe9ef0edea1dc1094d4c5ca1f57ca5aadd12c0a27b728501fff1c1b0d121b83569367f1abbb745893162437b57b13f28a4827
-
Filesize
124KB
MD5acd8267a24609adb4cfff9350d4885c5
SHA169322683f593816c79d54ff1ed8913d23d120d97
SHA256e390393f2538710fc2b3b8dc895fc4ffa3c9734aaf874e21a91e78709d398ee7
SHA5125d68ff3ef3a6b83dabf9dd300ad1eb61ac026fff17937a92474430577c2f79f3d6ee89bc7f58e7a10cf2384d475d0a40943f2634374661547f42557d9a324a6a
-
Filesize
159KB
MD53aee4255942c6ecdaa1526579d8cb573
SHA13e923dc7294e1c83c080b8840d8d561d0c5fdcd7
SHA2566e93e30977c8aa6a17a4860ea7affaf86768cc07f2c3659663268ef881e2e08b
SHA512093c96b0d8378b54501cd3babd4d4a475531d19bcf477b2b5df9e0f48233a3ddbbeda0fe267b64ba2784778488f0c7018361c0063203fbb857f0b931543e7108
-
Filesize
78KB
MD5b44d4e10812530294c3d4af560c83b42
SHA1431d009c61b78f6a93b82c1e3327d4946d8e9c36
SHA25677c0ab7b7d4ade5676f921e496c902ad5e5104da9da807ddc150bcf46073d905
SHA5122d2023bd8f268234764806e195a45ece795da08468a0e7b592c69e395053d825788491e3433796e1b2ecd00c7c29cb6f9f38e8e5c255400a562cd8a5791b2030
-
Filesize
11KB
MD55a72a803df2b425d5aaff21f0f064011
SHA14b31963d981c07a7ab2a0d1a706067c539c55ec5
SHA256629e52ba4e2dca91b10ef7729a1722888e01284eed7dda6030d0a1ec46c94086
SHA512bf44997c405c2ba80100eb0f2ff7304938fc69e4d7ae3eac52b3c236c3188e80c9f18bda226b5f4fde0112320e74c198ad985f9ffd7cea99aca22980c39c7f69
-
Filesize
11KB
MD5721b60b85094851c06d572f0bd5d88cd
SHA14d0ee4d717aeb9c35da8621a545d3e2b9f19b4e7
SHA256dac867476caa42ff8df8f5dfe869ffd56a18dadee17d47889afb69ed6519afbf
SHA512430a91fcecde4c8cc4ac7eb9b4c6619243ab244ee88c34c9e93ca918e54bd42b08aca8ea4475d4c0f5fa95241e4aacb3206cbae863e92d15528c8e7c9f45601b
-
Filesize
14KB
MD51ed0b196ab58edb58fcf84e1739c63ce
SHA1ac7d6c77629bdee1df7e380cc9559e09d51d75b7
SHA2568664222823e122fca724620fd8b72187fc5336c737d891d3cef85f4f533b8de2
SHA512e1fa7f14f39c97aaa3104f3e13098626b5f7cfd665ba52dcb2312a329639aaf5083a9177e4686d11c4213e28acc40e2c027988074b6cc13c5016d5c5e9ef897b
-
Filesize
11KB
MD57e8b61d27a9d04e28d4dae0bfa0902ed
SHA1861a7b31022915f26fb49c79ac357c65782c9f4b
SHA2561ef06c600c451e66e744b2ca356b7f4b7b88ba2f52ec7795858d21525848ac8c
SHA5121c5b35026937b45beb76cb8d79334a306342c57a8e36cc15d633458582fc8f7d9ab70ace7a92144288c6c017f33ecfc20477a04432619b40a21c9cda8d249f6d
-
Filesize
11KB
MD591a2ae3c4eb79cf748e15a58108409ad
SHA1d402b9df99723ea26a141bfc640d78eaf0b0111b
SHA256b0eda99eabd32fefecc478fd9fe7439a3f646a864fdab4ec3c1f18574b5f8b34
SHA5128527af610c1e2101b6f336a142b1a85ac9c19bb3af4ad4a245cfb6fd602dc185da0f7803358067099475102f3a8f10a834dc75b56d3e6ded2ed833c00ad217ed
-
Filesize
12KB
MD5fa770bcd70208a479bde8086d02c22da
SHA128ee5f3ce3732a55ca60aee781212f117c6f3b26
SHA256e677497c1baefffb33a17d22a99b76b7fa7ae7a0c84e12fda27d9be5c3d104cf
SHA512f8d81e350cebdba5afb579a072bad7986691e9f3d4c9febca8756b807301782ee6eb5ba16b045cfa29b6e4f4696e0554c718d36d4e64431f46d1e4b1f42dc2b8
-
Filesize
15KB
MD54ec4790281017e616af632da1dc624e1
SHA1342b15c5d3e34ab4ac0b9904b95d0d5b074447b7
SHA2565cf5bbb861608131b5f560cbf34a3292c80886b7c75357acc779e0bf98e16639
SHA51280c4e20d37eff29c7577b2d0ed67539a9c2c228edb48ab05d72648a6ed38f5ff537715c130342beb0e3ef16eb11179b9b484303354a026bda3a86d5414d24e69
-
Filesize
11KB
MD57a859e91fdcf78a584ac93aa85371bc9
SHA11fa9d9cad7cc26808e697373c1f5f32aaf59d6b7
SHA256b7ee468f5b6c650dada7db3ad9e115a0e97135b3df095c3220dfd22ba277b607
SHA512a368f21eca765afca86e03d59cf953500770f4a5bff8b86b2ac53f1b5174c627e061ce9a1f781dc56506774e0d0b09725e9698d4dc2d3a59e93da7ef3d900887
-
Filesize
13KB
MD5972544ade7e32bfdeb28b39bc734cdee
SHA187816f4afabbdec0ec2cfeb417748398505c5aa9
SHA2567102f8d9d0f3f689129d7fe071b234077fba4dd3687071d1e2aeaa137b123f86
SHA5125e1131b405e0c7a255b1c51073aff99e2d5c0d28fd3e55cabc04d463758a575a954008ea1ba5b4e2b345b49af448b93ad21dfc4a01573b3cb6e7256d9ecceef1
-
Filesize
12KB
MD58906279245f7385b189a6b0b67df2d7c
SHA1fcf03d9043a2daafe8e28dee0b130513677227e4
SHA256f5183b8d7462c01031992267fe85680ab9c5b279bedc0b25ab219f7c2184766f
SHA51267cac89ae58cc715976107f3bdf279b1e78945afd07e6f657e076d78e92ee1a98e3e7b8feae295af5ce35e00c804f3f53a890895badb1eed32377d85c21672b9
-
Filesize
11KB
MD5dd8176e132eedea3322443046ac35ca2
SHA1d13587c7cc52b2c6fbcaa548c8ed2c771a260769
SHA2562eb96422375f1a7b687115b132a4005d2e7d3d5dc091fb0eb22a6471e712848e
SHA51277cb8c44c8cc8dd29997fba4424407579ac91176482db3cf7bc37e1f9f6aa4c4f5ba14862d2f3a9c05d1fdd7ca5a043b5f566bd0e9a9e1ed837da9c11803b253
-
Filesize
20KB
MD5a6a3d6d11d623e16866f38185853facd
SHA1fbeadd1e9016908ecce5753de1d435d6fcf3d0b5
SHA256a768339f0b03674735404248a039ec8591fcba6ff61a3c6812414537badd23b0
SHA512abbf32ceb35e5ec6c1562f9f3b2652b96b7dbd97bfc08d918f987c0ec0503e8390dd697476b2a2389f0172cd8cf16029fd2ec5f32a9ba3688bf2ebeefb081b2c
-
Filesize
12KB
MD5074b81a625fb68159431bb556d28fab5
SHA120f8ead66d548cfa861bc366bb1250ced165be24
SHA2563af38920e767bd9ebc08f88eaf2d08c748a267c7ec60eab41c49b3f282a4cf65
SHA51236388c3effa0d94cf626decaa1da427801cc5607a2106abdadf92252c6f6fd2ce5bf0802f5d0a4245a1ffdb4481464c99d60510cf95e83ebaf17bd3d6acbc3dc
-
Filesize
15KB
MD5f1a23c251fcbb7041496352ec9bcffbe
SHA1be4a00642ec82465bc7b3d0cc07d4e8df72094e8
SHA256d899c2f061952b3b97ab9cdbca2450290b0f005909ddd243ed0f4c511d32c198
SHA51231f8c5cd3b6e153073e2e2edf0ca8072d0f787784f1611a57219349c1d57d6798a3adbd6942b0f16cef781634dd8691a5ec0b506df21b24cb70aee5523a03fd9
-
Filesize
17KB
MD555b2eb7f17f82b2096e94bca9d2db901
SHA144d85f1b1134ee7a609165e9c142188c0f0b17e0
SHA256f9d3f380023a4c45e74170fe69b32bca506ee1e1fbe670d965d5b50c616da0cb
SHA5120cf0770f5965a83f546253decfa967d8f85c340b5f6ea220d3caa14245f3cdb37c53bf8d3da6c35297b22a3fa88e7621202634f6b3649d7d9c166a221d3456a5
-
Filesize
17KB
MD59b79965f06fd756a5efde11e8d373108
SHA13b9de8bf6b912f19f7742ad34a875cbe2b5ffa50
SHA2561a916c0db285deb02c0b9df4d08dad5ea95700a6a812ea067bd637a91101a9f6
SHA5127d4155c00d65c3554e90575178a80d20dc7c80d543c4b5c4c3f508f0811482515638fe513e291b82f958b4d7a63c9876be4e368557b07ff062961197ed4286fb
-
Filesize
13KB
MD51d48a3189a55b632798f0e859628b0fb
SHA161569a8e4f37adc353986d83efc90dc043cdc673
SHA256b56bc94e8539603dd2f0fea2f25efd17966315067442507db4bffafcbc2955b0
SHA51247f329102b703bfbb1ebaeb5203d1c8404a0c912019193c93d150a95bb0c5ba8dc101ac56d3283285f9f91239fc64a66a5357afe428a919b0be7194bada1f64f
-
Filesize
11KB
MD5dbc27d384679916ba76316fb5e972ea6
SHA1fb9f021f2220c852f6ff4ea94e8577368f0616a4
SHA256dd14133adf5c534539298422f6c4b52739f80aca8c5a85ca8c966dea9964ceb1
SHA512cc0d8c56749ccb9d007b6d3f5c4a8f1d4e368bb81446ebcd7cc7b40399bbd56d0acaba588ca172ecb7472a8cbddbd4c366ffa38094a832f6d7e343b813ba565e
-
Filesize
1006KB
MD5c0f2af000be54d78c9562ad987b5a1e2
SHA115ac19568126db774569eb77ae38bb7d9bd6d1e3
SHA2560f94cf5ed851976700b1d2563ca6e1350f0eac5b91415b392448526ed266f709
SHA512aae36b56c42316898525629262790945e290b6ef8e5f5860d507235dfd7eeb58a3702858a798238b19eb847f4fbc768d460c6906ff535276471c0e51581813cb
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
185KB
MD5d5d109be7358e1bccbc5ae8224fb6293
SHA1cda28e119a2b50f4ed81de7a5097438a56e1f82e
SHA256a06442f65c6afdedb516e00f028d374afc0ac69cee6d51ae2e32665dc1a41b3b
SHA512971cdb148a2a54d0d98b3983150fe08a8e1876ae38b65a41332dc711bf2f61051bed1c8d187032fcd7c7d149737f533d6d0a0d3035b2fb284f9b2b095cb55356
-
Filesize
4.0MB
MD5c7896c1812daff82d322eeaa019cfb1f
SHA1dc7541016d2cfb60e0ecbeb22ec2355e552a9b85
SHA256c81320c6272737bd222be304d3cc5b7696980e32bd792235ea77c28130c181c0
SHA512bf4339b323cbba4706b5baa2cd853b17765801988e85e7bb06d9d736a35c7b0073951df7086108aa2cb8b1528d2ef7c49d1c6171c43c04349dd469069b0d642d
-
Filesize
691KB
MD5597955a07be4ae08f3b09adbf996fa83
SHA13817e541646fd3cdd7a8256a1260f6edfe7dd0c0
SHA256ddfc515aea27ec414cfc84bef385711c82f0618f482df9d262c490226d7fa9d7
SHA512485efaecb8ea5b2d4644d9ab0927b636f7ab6d660da04b088e26452a28b5b11bccee9724cb625a7d5bde3fa5909aa32f3568909965439a06d3dfc0b7e345c941
-
Filesize
139KB
MD5f60da44a33910eda70d838d7635d8fb1
SHA1c35b4cf47349888384729386c74c374edb6f6ff3
SHA25613934599ff931f97e8eac6106dc67d54609befd0b0e653b46f6c25b18830c572
SHA5123c57ed384c23c89f99708bdf688ebd28629e84df8756e7b64dfa8b6e0b52beefb0c62de820f2c72e5679b7632279dcb414a781cfd2c5c9654d09d9da24fa17b3
-
Filesize
27KB
MD55e8b908ea00524a954e304671de87534
SHA1765c89c8cd3691a4b15c5561e4edabca4e56d197
SHA256ad35e12344d898865fedffb217c03ebaff21988864a00d9844e638aadd0d09ae
SHA512d9c6dcad3e6e9bcee5739bfd0f54d8ccd7c874a330b780aefd8be1fb7b1a2c80462006bf2fefd7e2004b17366f4bd3e1026275015aa23aa5fa573e8086b24444
-
Filesize
55KB
MD52e053d6b5ed0c31a28feadfc5aba4cc8
SHA1e33d67cad5101def0905381354f2fb63518a767a
SHA256006236c16a634ab2de0c24748618fd55cfcf9d4aeed7da246f6cc5ea8825d18f
SHA5123c756ef68491dd865de63bca242b508f6dda72e4fe4c4508b557223626a7ac1d43f90cb4ed3cf06e557fa7061cadd35b6b2a86d820d4b744824432662b00be75
-
Filesize
1011KB
MD5849959a003fa63c5a42ae87929fcd18b
SHA1d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA2566238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
SHA51264958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09