Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 17:58
Behavioral task
behavioral1
Sample
77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe
Resource
win10v2004-20240802-en
General
-
Target
77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe
-
Size
12.6MB
-
MD5
6f12b563903c18eb157ce9c2d3e9dbd3
-
SHA1
1faf2fb04b21ce8ce738cd54ac562111b5ccd874
-
SHA256
77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028
-
SHA512
3506585b7164904abafba01bca1a4690327cdceef3dded37d45e253ee72a29d4e8ab83a51990ef467df16c70e5d8b9d07851505966f8c41cb1aa160dee1ee2aa
-
SSDEEP
196608:2VEk31F89onJ5hrZERm0sKYu/PaQoRz0mpjNcWl7GofBlib7u5lxDDNP3C:0Ek3r89c5hlER8Q2leW1Bl87u5lxD8
Malware Config
Extracted
cobaltstrike
http://172.20.212.107:8080/l8Gr
-
user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MALC)
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Loads dropped DLL 36 IoCs
pid Process 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 4420 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4888 wrote to memory of 4420 4888 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 82 PID 4888 wrote to memory of 4420 4888 77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe"C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe"C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe"2⤵
- Loads dropped DLL
PID:4420
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5371776a7e26baeb3f75c93a8364c9ae0
SHA1bf60b2177171ba1c6b4351e6178529d4b082bda9
SHA25615257e96d1ca8480b8cb98f4c79b6e365fe38a1ba9638fc8c9ab7ffea79c4762
SHA512c23548fbcd1713c4d8348917ff2ab623c404fb0e9566ab93d147c62e06f51e63bdaa347f2d203fe4f046ce49943b38e3e9fa1433f6455c97379f2bc641ae7ce9
-
Filesize
12KB
MD520708935fdd89b3eddeea27d4d0ea52a
SHA185a9fe2c7c5d97fd02b47327e431d88a1dc865f7
SHA25611dd1b49f70db23617e84e08e709d4a9c86759d911a24ebddfb91c414cc7f375
SHA512f28c31b425dc38b5e9ad87b95e8071997e4a6f444608e57867016178cd0ca3e9f73a4b7f2a0a704e45f75b7dcff54490510c6bf8461f3261f676e9294506d09b
-
Filesize
13KB
MD543bbe5d04460bd5847000804234321a6
SHA13cae8c4982bbd73af26eb8c6413671425828dbb7
SHA256faa41385d0db8d4ee2ee74ee540bc879cf2e884bee87655ff3c89c8c517eed45
SHA512dbc60f1d11d63bebbab3c742fb827efbde6dff3c563ae1703892d5643d5906751db3815b97cbfb7da5fcd306017e4a1cdcc0cdd0e61adf20e0816f9c88fe2c9b
-
Filesize
14KB
MD5c6b20332b4814799e643badffd8df2cd
SHA1e7da1c1f09f6ec9a84af0ab0616afea55a58e984
SHA25661c7a532e108f67874ef2e17244358df19158f6142680f5b21032ba4889ac5d8
SHA512d50c7f67d2dfb268ad4cf18e16159604b6e8a50ea4f0c9137e26619fd7835faad323b5f6a2b8e3ec1c023e0678bcbe5d0f867cd711c5cd405bd207212228b2b4
-
Filesize
10KB
MD5fee13d4fb947835dbb62aca7eaff44ef
SHA17cc088ab68f90c563d1fe22d5e3c3f9e414efc04
SHA2563e0d07bbf93e0748b42b1c2550f48f0d81597486038c22548224584ae178a543
SHA512dea92f935bc710df6866e89cc6eb5b53fc7adf0f14f3d381b89d7869590a1b0b1f98f347664f7a19c6078e7aa3eb0f773ffcb711cc4275d0ecd54030d6cf5cb2
-
Filesize
17KB
MD5d48bffa1af800f6969cfb356d3f75aa6
SHA12a0d8968d74ebc879a17045efe86c7fb5c54aee6
SHA2564aa5e9ce7a76b301766d3ecbb06d2e42c2f09d0743605a91bf83069fefe3a4de
SHA51230d14ad8c68b043cc49eafb460b69e83a15900cb68b4e0cbb379ff5ba260194965ef300eb715308e7211a743ff07fa7f8779e174368dcaa7f704e43068cc4858
-
Filesize
12KB
MD54d9182783ef19411ebd9f1f864a2ef2f
SHA1ddc9f878b88e7b51b5f68a3f99a0857e362b0361
SHA256c9f4c5ffcdd4f8814f8c07ce532a164ab699ae8cde737df02d6ecd7b5dd52dbd
SHA5128f983984f0594c2cac447e9d75b86d6ec08ed1c789958afa835b0d1239fd4d7ebe16408d080e7fce17c379954609a93fc730b11be6f4a024e7d13d042b27f185
-
Filesize
14KB
MD59d28433ea8ffbfe0c2870feda025f519
SHA14cc5cf74114d67934d346bb39ca76f01f7acc3e2
SHA256fc296145ae46a11c472f99c5be317e77c840c2430fbb955ce3f913408a046284
SHA51266b4d00100d4143ea72a3f603fb193afa6fd4efb5a74d0d17a206b5ef825e4cc5af175f5fb5c40c022bde676ba7a83087cb95c9f57e701ca4e7f0a2fce76e599
-
Filesize
15KB
MD534ebb5d4a90b5a39c5e1d87f61ae96cb
SHA125ee80cc1e647209f658aeba5841f11f86f23c4e
SHA2564fc70cb9280e414855da2c7e0573096404031987c24cf60822854eaa3757c593
SHA51282e27044fd53a7309abaeca06c077a43eb075adf1ef0898609f3d9f42396e0a1fa4ffd5a64d944705bbc1b1ebb8c2055d8a420807693cc5b70e88ab292df81b7
-
Filesize
19KB
MD5ab0bcb36419ea87d827e770a080364f6
SHA16d398f48338fb017aacd00ae188606eb9e99e830
SHA256a927548abea335e6bcb4a9ee0a949749c9e4aa8f8aad481cf63e3ac99b25a725
SHA5123580fb949acee709836c36688457908c43860e68a36d3410f3fa9e17c6a66c1cdd7c081102468e4e92e5f42a0a802470e8f4d376daa4ed7126818538e0bd0bc4
-
Filesize
21KB
MD5a442ea85e6f9627501d947be3c48a9dd
SHA1d2dec6e1be3b221e8d4910546ad84fe7c88a524d
SHA2563dbcb4d0070be355e0406e6b6c3e4ce58647f06e8650e1ab056e1d538b52b3d3
SHA512850a00c7069ffdba1efe1324405da747d7bd3ba5d4e724d08a2450b5a5f15a69a0d3eaf67cef943f624d52a4e2159a9f7bdaeafdc6c689eacea9987414250f3b
-
Filesize
12KB
MD5c89becc2becd40934fe78fcc0d74d941
SHA1d04680df546e2d8a86f60f022544db181f409c50
SHA256e5b6e58d6da8db36b0673539f0c65c80b071a925d2246c42c54e9fcdd8ca08e3
SHA512715b3f69933841baadc1c30d616db34e6959fd9257d65e31c39cd08c53afa5653b0e87b41dcc3c5e73e57387a1e7e72c0a668578bd42d5561f4105055f02993c
-
Filesize
13KB
MD5c4cc05d3132fdfb05089f42364fc74d2
SHA1da7a1ae5d93839577bbd25952a1672c831bc4f29
SHA2568f3d92de840abb5a46015a8ff618ff411c73009cbaa448ac268a5c619cf84721
SHA512c597c70b7af8e77beeebf10c32b34c37f25c741991581d67cf22e0778f262e463c0f64aa37f92fbc4415fe675673f3f92544e109e5032e488f185f1cfbc839fe
-
Filesize
12KB
MD5ba46602b59fcf8b01abb135f1534d618
SHA1eff5608e05639a17b08dca5f9317e138bef347b5
SHA256b1bab0e04ac60d1e7917621b03a8c72d1ed1f0251334e9fa12a8a1ac1f516529
SHA512a5e2771623da697d8ea2e3212fbdde4e19b4a12982a689d42b351b244efba7efa158e2ed1a2b5bc426a6f143e7db810ba5542017ab09b5912b3ecc091f705c6e
-
Filesize
10KB
MD54d9c33ae53b38a9494b6fbfa3491149e
SHA11a069e277b7e90a3ab0dcdee1fe244632c9c3be4
SHA2560828cad4d742d97888d3dfce59e82369317847651bba0f166023cb8aca790b2b
SHA512bdfbf29198a0c7ed69204bf9e9b6174ebb9e3bee297dd1eb8eb9ea6d7caf1cc5e076f7b44893e58ccf3d0958f5e3bdee12bd090714beb5889836ee6f12f0f49e
-
Filesize
10KB
MD58f4313755f65509357e281744941bd36
SHA12aaf3f89e56ec6731b2a5fa40a2fe69b751eafc0
SHA25670d90ddf87a9608699be6bbedf89ad469632fd0adc20a69da07618596d443639
SHA512fed2b1007e31d73f18605fb164fee5b46034155ab5bb7fe9b255241cfa75ff0e39749200eb47a9ab1380d9f36f51afba45490979ab7d112f4d673a0c67899ef4
-
Filesize
91KB
MD57942be5474a095f673582997ae3054f1
SHA1e982f6ebc74d31153ba9738741a7eec03a9fa5e8
SHA2568ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
SHA51249fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039
-
Filesize
35KB
MD5ab03551e4ef279abed2d8c4b25f35bb8
SHA109bc7e4e1a8d79ee23c0c9c26b1ea39de12a550e
SHA256f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44
SHA5120e7533b8d7e5019ffd1e73937c1627213711725e88c6d7321588f7fffe9e1b4ef5c38311548adbd2c0ee9b407135646593bf1498cbee92275f4e0a22ace78909
-
Filesize
85KB
MD5d95a76f54aba4792e7adf58b860fb4be
SHA114763b2335785d2f1612c8bf25ca772747a0edd8
SHA25683a50baa8917cabb1d888ebcea8118c065f3975d4ae7e36c931febce181404b8
SHA5124bbabacb9e3ac299c755a0bfde6fe9ef0edea1dc1094d4c5ca1f57ca5aadd12c0a27b728501fff1c1b0d121b83569367f1abbb745893162437b57b13f28a4827
-
Filesize
177KB
MD577b5d28b725596b08d4393786d98bd27
SHA1e3f00478de1d28bc7d2e9f0b552778be3e32d43b
SHA256f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c
SHA512d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d
-
Filesize
124KB
MD5acd8267a24609adb4cfff9350d4885c5
SHA169322683f593816c79d54ff1ed8913d23d120d97
SHA256e390393f2538710fc2b3b8dc895fc4ffa3c9734aaf874e21a91e78709d398ee7
SHA5125d68ff3ef3a6b83dabf9dd300ad1eb61ac026fff17937a92474430577c2f79f3d6ee89bc7f58e7a10cf2384d475d0a40943f2634374661547f42557d9a324a6a
-
Filesize
159KB
MD53aee4255942c6ecdaa1526579d8cb573
SHA13e923dc7294e1c83c080b8840d8d561d0c5fdcd7
SHA2566e93e30977c8aa6a17a4860ea7affaf86768cc07f2c3659663268ef881e2e08b
SHA512093c96b0d8378b54501cd3babd4d4a475531d19bcf477b2b5df9e0f48233a3ddbbeda0fe267b64ba2784778488f0c7018361c0063203fbb857f0b931543e7108
-
Filesize
78KB
MD5b44d4e10812530294c3d4af560c83b42
SHA1431d009c61b78f6a93b82c1e3327d4946d8e9c36
SHA25677c0ab7b7d4ade5676f921e496c902ad5e5104da9da807ddc150bcf46073d905
SHA5122d2023bd8f268234764806e195a45ece795da08468a0e7b592c69e395053d825788491e3433796e1b2ecd00c7c29cb6f9f38e8e5c255400a562cd8a5791b2030
-
Filesize
1006KB
MD5c0f2af000be54d78c9562ad987b5a1e2
SHA115ac19568126db774569eb77ae38bb7d9bd6d1e3
SHA2560f94cf5ed851976700b1d2563ca6e1350f0eac5b91415b392448526ed266f709
SHA512aae36b56c42316898525629262790945e290b6ef8e5f5860d507235dfd7eeb58a3702858a798238b19eb847f4fbc768d460c6906ff535276471c0e51581813cb
-
Filesize
32KB
MD5eef7981412be8ea459064d3090f4b3aa
SHA1c60da4830ce27afc234b3c3014c583f7f0a5a925
SHA256f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
SHA512dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016
-
Filesize
185KB
MD5d5d109be7358e1bccbc5ae8224fb6293
SHA1cda28e119a2b50f4ed81de7a5097438a56e1f82e
SHA256a06442f65c6afdedb516e00f028d374afc0ac69cee6d51ae2e32665dc1a41b3b
SHA512971cdb148a2a54d0d98b3983150fe08a8e1876ae38b65a41332dc711bf2f61051bed1c8d187032fcd7c7d149737f533d6d0a0d3035b2fb284f9b2b095cb55356
-
Filesize
4.0MB
MD5c7896c1812daff82d322eeaa019cfb1f
SHA1dc7541016d2cfb60e0ecbeb22ec2355e552a9b85
SHA256c81320c6272737bd222be304d3cc5b7696980e32bd792235ea77c28130c181c0
SHA512bf4339b323cbba4706b5baa2cd853b17765801988e85e7bb06d9d736a35c7b0073951df7086108aa2cb8b1528d2ef7c49d1c6171c43c04349dd469069b0d642d
-
Filesize
691KB
MD5597955a07be4ae08f3b09adbf996fa83
SHA13817e541646fd3cdd7a8256a1260f6edfe7dd0c0
SHA256ddfc515aea27ec414cfc84bef385711c82f0618f482df9d262c490226d7fa9d7
SHA512485efaecb8ea5b2d4644d9ab0927b636f7ab6d660da04b088e26452a28b5b11bccee9724cb625a7d5bde3fa5909aa32f3568909965439a06d3dfc0b7e345c941
-
Filesize
139KB
MD5f60da44a33910eda70d838d7635d8fb1
SHA1c35b4cf47349888384729386c74c374edb6f6ff3
SHA25613934599ff931f97e8eac6106dc67d54609befd0b0e653b46f6c25b18830c572
SHA5123c57ed384c23c89f99708bdf688ebd28629e84df8756e7b64dfa8b6e0b52beefb0c62de820f2c72e5679b7632279dcb414a781cfd2c5c9654d09d9da24fa17b3
-
Filesize
27KB
MD55e8b908ea00524a954e304671de87534
SHA1765c89c8cd3691a4b15c5561e4edabca4e56d197
SHA256ad35e12344d898865fedffb217c03ebaff21988864a00d9844e638aadd0d09ae
SHA512d9c6dcad3e6e9bcee5739bfd0f54d8ccd7c874a330b780aefd8be1fb7b1a2c80462006bf2fefd7e2004b17366f4bd3e1026275015aa23aa5fa573e8086b24444
-
Filesize
55KB
MD52e053d6b5ed0c31a28feadfc5aba4cc8
SHA1e33d67cad5101def0905381354f2fb63518a767a
SHA256006236c16a634ab2de0c24748618fd55cfcf9d4aeed7da246f6cc5ea8825d18f
SHA5123c756ef68491dd865de63bca242b508f6dda72e4fe4c4508b557223626a7ac1d43f90cb4ed3cf06e557fa7061cadd35b6b2a86d820d4b744824432662b00be75
-
Filesize
1011KB
MD5849959a003fa63c5a42ae87929fcd18b
SHA1d1b80b3265e31a2b5d8d7da6183146bbd5fb791b
SHA2566238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232
SHA51264958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09
-
Filesize
138KB
MD557be78d0f2a66700600266ebc86c9b3c
SHA1a47987d476cb9c76698890405e0b65aa10e07169
SHA2569ab2b3a63bf2d0ef5ff3412c0b000756677810f3aa60a10bf62bb92c9f9b6ee2
SHA51298c2a2e48adfae6c7d3c7d6731e688a27fc1eb6675760ab44f78e4eedebf88b09e425d21baf5674d402f9cfc9d7ebc6d643f8c763c8db5f6b1f8bf83681c256c