Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2024, 17:58

General

  • Target

    77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe

  • Size

    12.6MB

  • MD5

    6f12b563903c18eb157ce9c2d3e9dbd3

  • SHA1

    1faf2fb04b21ce8ce738cd54ac562111b5ccd874

  • SHA256

    77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028

  • SHA512

    3506585b7164904abafba01bca1a4690327cdceef3dded37d45e253ee72a29d4e8ab83a51990ef467df16c70e5d8b9d07851505966f8c41cb1aa160dee1ee2aa

  • SSDEEP

    196608:2VEk31F89onJ5hrZERm0sKYu/PaQoRz0mpjNcWl7GofBlib7u5lxDDNP3C:0Ek3r89c5hlER8Q2leW1Bl87u5lxD8

Malware Config

Extracted

Family

cobaltstrike

C2

http://172.20.212.107:8080/l8Gr

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MALC)

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

  • Loads dropped DLL 36 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe
    "C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe
      "C:\Users\Admin\AppData\Local\Temp\77b42a34d23f8012b41286c9abfb369de52e6864c1263780613380660a168028.exe"
      2⤵
      • Loads dropped DLL
      PID:4420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Cipher\_Salsa20.pyd

    Filesize

    13KB

    MD5

    371776a7e26baeb3f75c93a8364c9ae0

    SHA1

    bf60b2177171ba1c6b4351e6178529d4b082bda9

    SHA256

    15257e96d1ca8480b8cb98f4c79b6e365fe38a1ba9638fc8c9ab7ffea79c4762

    SHA512

    c23548fbcd1713c4d8348917ff2ab623c404fb0e9566ab93d147c62e06f51e63bdaa347f2d203fe4f046ce49943b38e3e9fa1433f6455c97379f2bc641ae7ce9

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Cipher\_raw_cbc.pyd

    Filesize

    12KB

    MD5

    20708935fdd89b3eddeea27d4d0ea52a

    SHA1

    85a9fe2c7c5d97fd02b47327e431d88a1dc865f7

    SHA256

    11dd1b49f70db23617e84e08e709d4a9c86759d911a24ebddfb91c414cc7f375

    SHA512

    f28c31b425dc38b5e9ad87b95e8071997e4a6f444608e57867016178cd0ca3e9f73a4b7f2a0a704e45f75b7dcff54490510c6bf8461f3261f676e9294506d09b

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Cipher\_raw_cfb.pyd

    Filesize

    13KB

    MD5

    43bbe5d04460bd5847000804234321a6

    SHA1

    3cae8c4982bbd73af26eb8c6413671425828dbb7

    SHA256

    faa41385d0db8d4ee2ee74ee540bc879cf2e884bee87655ff3c89c8c517eed45

    SHA512

    dbc60f1d11d63bebbab3c742fb827efbde6dff3c563ae1703892d5643d5906751db3815b97cbfb7da5fcd306017e4a1cdcc0cdd0e61adf20e0816f9c88fe2c9b

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Cipher\_raw_ctr.pyd

    Filesize

    14KB

    MD5

    c6b20332b4814799e643badffd8df2cd

    SHA1

    e7da1c1f09f6ec9a84af0ab0616afea55a58e984

    SHA256

    61c7a532e108f67874ef2e17244358df19158f6142680f5b21032ba4889ac5d8

    SHA512

    d50c7f67d2dfb268ad4cf18e16159604b6e8a50ea4f0c9137e26619fd7835faad323b5f6a2b8e3ec1c023e0678bcbe5d0f867cd711c5cd405bd207212228b2b4

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Cipher\_raw_ecb.pyd

    Filesize

    10KB

    MD5

    fee13d4fb947835dbb62aca7eaff44ef

    SHA1

    7cc088ab68f90c563d1fe22d5e3c3f9e414efc04

    SHA256

    3e0d07bbf93e0748b42b1c2550f48f0d81597486038c22548224584ae178a543

    SHA512

    dea92f935bc710df6866e89cc6eb5b53fc7adf0f14f3d381b89d7869590a1b0b1f98f347664f7a19c6078e7aa3eb0f773ffcb711cc4275d0ecd54030d6cf5cb2

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Cipher\_raw_ocb.pyd

    Filesize

    17KB

    MD5

    d48bffa1af800f6969cfb356d3f75aa6

    SHA1

    2a0d8968d74ebc879a17045efe86c7fb5c54aee6

    SHA256

    4aa5e9ce7a76b301766d3ecbb06d2e42c2f09d0743605a91bf83069fefe3a4de

    SHA512

    30d14ad8c68b043cc49eafb460b69e83a15900cb68b4e0cbb379ff5ba260194965ef300eb715308e7211a743ff07fa7f8779e174368dcaa7f704e43068cc4858

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Cipher\_raw_ofb.pyd

    Filesize

    12KB

    MD5

    4d9182783ef19411ebd9f1f864a2ef2f

    SHA1

    ddc9f878b88e7b51b5f68a3f99a0857e362b0361

    SHA256

    c9f4c5ffcdd4f8814f8c07ce532a164ab699ae8cde737df02d6ecd7b5dd52dbd

    SHA512

    8f983984f0594c2cac447e9d75b86d6ec08ed1c789958afa835b0d1239fd4d7ebe16408d080e7fce17c379954609a93fc730b11be6f4a024e7d13d042b27f185

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Hash\_BLAKE2s.pyd

    Filesize

    14KB

    MD5

    9d28433ea8ffbfe0c2870feda025f519

    SHA1

    4cc5cf74114d67934d346bb39ca76f01f7acc3e2

    SHA256

    fc296145ae46a11c472f99c5be317e77c840c2430fbb955ce3f913408a046284

    SHA512

    66b4d00100d4143ea72a3f603fb193afa6fd4efb5a74d0d17a206b5ef825e4cc5af175f5fb5c40c022bde676ba7a83087cb95c9f57e701ca4e7f0a2fce76e599

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Hash\_MD5.pyd

    Filesize

    15KB

    MD5

    34ebb5d4a90b5a39c5e1d87f61ae96cb

    SHA1

    25ee80cc1e647209f658aeba5841f11f86f23c4e

    SHA256

    4fc70cb9280e414855da2c7e0573096404031987c24cf60822854eaa3757c593

    SHA512

    82e27044fd53a7309abaeca06c077a43eb075adf1ef0898609f3d9f42396e0a1fa4ffd5a64d944705bbc1b1ebb8c2055d8a420807693cc5b70e88ab292df81b7

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Hash\_SHA1.pyd

    Filesize

    19KB

    MD5

    ab0bcb36419ea87d827e770a080364f6

    SHA1

    6d398f48338fb017aacd00ae188606eb9e99e830

    SHA256

    a927548abea335e6bcb4a9ee0a949749c9e4aa8f8aad481cf63e3ac99b25a725

    SHA512

    3580fb949acee709836c36688457908c43860e68a36d3410f3fa9e17c6a66c1cdd7c081102468e4e92e5f42a0a802470e8f4d376daa4ed7126818538e0bd0bc4

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Hash\_SHA256.pyd

    Filesize

    21KB

    MD5

    a442ea85e6f9627501d947be3c48a9dd

    SHA1

    d2dec6e1be3b221e8d4910546ad84fe7c88a524d

    SHA256

    3dbcb4d0070be355e0406e6b6c3e4ce58647f06e8650e1ab056e1d538b52b3d3

    SHA512

    850a00c7069ffdba1efe1324405da747d7bd3ba5d4e724d08a2450b5a5f15a69a0d3eaf67cef943f624d52a4e2159a9f7bdaeafdc6c689eacea9987414250f3b

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Hash\_ghash_clmul.pyd

    Filesize

    12KB

    MD5

    c89becc2becd40934fe78fcc0d74d941

    SHA1

    d04680df546e2d8a86f60f022544db181f409c50

    SHA256

    e5b6e58d6da8db36b0673539f0c65c80b071a925d2246c42c54e9fcdd8ca08e3

    SHA512

    715b3f69933841baadc1c30d616db34e6959fd9257d65e31c39cd08c53afa5653b0e87b41dcc3c5e73e57387a1e7e72c0a668578bd42d5561f4105055f02993c

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Hash\_ghash_portable.pyd

    Filesize

    13KB

    MD5

    c4cc05d3132fdfb05089f42364fc74d2

    SHA1

    da7a1ae5d93839577bbd25952a1672c831bc4f29

    SHA256

    8f3d92de840abb5a46015a8ff618ff411c73009cbaa448ac268a5c619cf84721

    SHA512

    c597c70b7af8e77beeebf10c32b34c37f25c741991581d67cf22e0778f262e463c0f64aa37f92fbc4415fe675673f3f92544e109e5032e488f185f1cfbc839fe

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Protocol\_scrypt.pyd

    Filesize

    12KB

    MD5

    ba46602b59fcf8b01abb135f1534d618

    SHA1

    eff5608e05639a17b08dca5f9317e138bef347b5

    SHA256

    b1bab0e04ac60d1e7917621b03a8c72d1ed1f0251334e9fa12a8a1ac1f516529

    SHA512

    a5e2771623da697d8ea2e3212fbdde4e19b4a12982a689d42b351b244efba7efa158e2ed1a2b5bc426a6f143e7db810ba5542017ab09b5912b3ecc091f705c6e

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Util\_cpuid_c.pyd

    Filesize

    10KB

    MD5

    4d9c33ae53b38a9494b6fbfa3491149e

    SHA1

    1a069e277b7e90a3ab0dcdee1fe244632c9c3be4

    SHA256

    0828cad4d742d97888d3dfce59e82369317847651bba0f166023cb8aca790b2b

    SHA512

    bdfbf29198a0c7ed69204bf9e9b6174ebb9e3bee297dd1eb8eb9ea6d7caf1cc5e076f7b44893e58ccf3d0958f5e3bdee12bd090714beb5889836ee6f12f0f49e

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\Crypto\Util\_strxor.pyd

    Filesize

    10KB

    MD5

    8f4313755f65509357e281744941bd36

    SHA1

    2aaf3f89e56ec6731b2a5fa40a2fe69b751eafc0

    SHA256

    70d90ddf87a9608699be6bbedf89ad469632fd0adc20a69da07618596d443639

    SHA512

    fed2b1007e31d73f18605fb164fee5b46034155ab5bb7fe9b255241cfa75ff0e39749200eb47a9ab1380d9f36f51afba45490979ab7d112f4d673a0c67899ef4

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\VCRUNTIME140.dll

    Filesize

    91KB

    MD5

    7942be5474a095f673582997ae3054f1

    SHA1

    e982f6ebc74d31153ba9738741a7eec03a9fa5e8

    SHA256

    8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c

    SHA512

    49fbc9d441362b65a8d78b73d4fdcf988f22d38a35a36a233fcd54e99e95e29b804be7eabe2b174188c7860ebb34f701e13ed216f954886a285bed7127619039

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\VCRUNTIME140_1.dll

    Filesize

    35KB

    MD5

    ab03551e4ef279abed2d8c4b25f35bb8

    SHA1

    09bc7e4e1a8d79ee23c0c9c26b1ea39de12a550e

    SHA256

    f8bc270449ca6bb6345e88be3632d465c0a7595197c7954357dc5066ed50ae44

    SHA512

    0e7533b8d7e5019ffd1e73937c1627213711725e88c6d7321588f7fffe9e1b4ef5c38311548adbd2c0ee9b407135646593bf1498cbee92275f4e0a22ace78909

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\_bz2.pyd

    Filesize

    85KB

    MD5

    d95a76f54aba4792e7adf58b860fb4be

    SHA1

    14763b2335785d2f1612c8bf25ca772747a0edd8

    SHA256

    83a50baa8917cabb1d888ebcea8118c065f3975d4ae7e36c931febce181404b8

    SHA512

    4bbabacb9e3ac299c755a0bfde6fe9ef0edea1dc1094d4c5ca1f57ca5aadd12c0a27b728501fff1c1b0d121b83569367f1abbb745893162437b57b13f28a4827

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\_cffi_backend.cp38-win_amd64.pyd

    Filesize

    177KB

    MD5

    77b5d28b725596b08d4393786d98bd27

    SHA1

    e3f00478de1d28bc7d2e9f0b552778be3e32d43b

    SHA256

    f7a00ba343d6f1ea8997d95b242fbbd70856ec2b98677d5f8b52921b8658369c

    SHA512

    d44415d425f7423c3d68df22b72687a2d0da52966952e20d215553aa83de1e7a5192ec918a3d570d6c2362eb5500b56b87e3ffbc0b768bfa064585aea2a30e9d

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\_ctypes.pyd

    Filesize

    124KB

    MD5

    acd8267a24609adb4cfff9350d4885c5

    SHA1

    69322683f593816c79d54ff1ed8913d23d120d97

    SHA256

    e390393f2538710fc2b3b8dc895fc4ffa3c9734aaf874e21a91e78709d398ee7

    SHA512

    5d68ff3ef3a6b83dabf9dd300ad1eb61ac026fff17937a92474430577c2f79f3d6ee89bc7f58e7a10cf2384d475d0a40943f2634374661547f42557d9a324a6a

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\_lzma.pyd

    Filesize

    159KB

    MD5

    3aee4255942c6ecdaa1526579d8cb573

    SHA1

    3e923dc7294e1c83c080b8840d8d561d0c5fdcd7

    SHA256

    6e93e30977c8aa6a17a4860ea7affaf86768cc07f2c3659663268ef881e2e08b

    SHA512

    093c96b0d8378b54501cd3babd4d4a475531d19bcf477b2b5df9e0f48233a3ddbbeda0fe267b64ba2784778488f0c7018361c0063203fbb857f0b931543e7108

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\_socket.pyd

    Filesize

    78KB

    MD5

    b44d4e10812530294c3d4af560c83b42

    SHA1

    431d009c61b78f6a93b82c1e3327d4946d8e9c36

    SHA256

    77c0ab7b7d4ade5676f921e496c902ad5e5104da9da807ddc150bcf46073d905

    SHA512

    2d2023bd8f268234764806e195a45ece795da08468a0e7b592c69e395053d825788491e3433796e1b2ecd00c7c29cb6f9f38e8e5c255400a562cd8a5791b2030

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\base_library.zip

    Filesize

    1006KB

    MD5

    c0f2af000be54d78c9562ad987b5a1e2

    SHA1

    15ac19568126db774569eb77ae38bb7d9bd6d1e3

    SHA256

    0f94cf5ed851976700b1d2563ca6e1350f0eac5b91415b392448526ed266f709

    SHA512

    aae36b56c42316898525629262790945e290b6ef8e5f5860d507235dfd7eeb58a3702858a798238b19eb847f4fbc768d460c6906ff535276471c0e51581813cb

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\libffi-7.dll

    Filesize

    32KB

    MD5

    eef7981412be8ea459064d3090f4b3aa

    SHA1

    c60da4830ce27afc234b3c3014c583f7f0a5a925

    SHA256

    f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

    SHA512

    dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\pyexpat.pyd

    Filesize

    185KB

    MD5

    d5d109be7358e1bccbc5ae8224fb6293

    SHA1

    cda28e119a2b50f4ed81de7a5097438a56e1f82e

    SHA256

    a06442f65c6afdedb516e00f028d374afc0ac69cee6d51ae2e32665dc1a41b3b

    SHA512

    971cdb148a2a54d0d98b3983150fe08a8e1876ae38b65a41332dc711bf2f61051bed1c8d187032fcd7c7d149737f533d6d0a0d3035b2fb284f9b2b095cb55356

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\python38.dll

    Filesize

    4.0MB

    MD5

    c7896c1812daff82d322eeaa019cfb1f

    SHA1

    dc7541016d2cfb60e0ecbeb22ec2355e552a9b85

    SHA256

    c81320c6272737bd222be304d3cc5b7696980e32bd792235ea77c28130c181c0

    SHA512

    bf4339b323cbba4706b5baa2cd853b17765801988e85e7bb06d9d736a35c7b0073951df7086108aa2cb8b1528d2ef7c49d1c6171c43c04349dd469069b0d642d

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\pywin32_system32\pythoncom38.dll

    Filesize

    691KB

    MD5

    597955a07be4ae08f3b09adbf996fa83

    SHA1

    3817e541646fd3cdd7a8256a1260f6edfe7dd0c0

    SHA256

    ddfc515aea27ec414cfc84bef385711c82f0618f482df9d262c490226d7fa9d7

    SHA512

    485efaecb8ea5b2d4644d9ab0927b636f7ab6d660da04b088e26452a28b5b11bccee9724cb625a7d5bde3fa5909aa32f3568909965439a06d3dfc0b7e345c941

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\pywin32_system32\pywintypes38.dll

    Filesize

    139KB

    MD5

    f60da44a33910eda70d838d7635d8fb1

    SHA1

    c35b4cf47349888384729386c74c374edb6f6ff3

    SHA256

    13934599ff931f97e8eac6106dc67d54609befd0b0e653b46f6c25b18830c572

    SHA512

    3c57ed384c23c89f99708bdf688ebd28629e84df8756e7b64dfa8b6e0b52beefb0c62de820f2c72e5679b7632279dcb414a781cfd2c5c9654d09d9da24fa17b3

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\select.pyd

    Filesize

    27KB

    MD5

    5e8b908ea00524a954e304671de87534

    SHA1

    765c89c8cd3691a4b15c5561e4edabca4e56d197

    SHA256

    ad35e12344d898865fedffb217c03ebaff21988864a00d9844e638aadd0d09ae

    SHA512

    d9c6dcad3e6e9bcee5739bfd0f54d8ccd7c874a330b780aefd8be1fb7b1a2c80462006bf2fefd7e2004b17366f4bd3e1026275015aa23aa5fa573e8086b24444

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\tinyaes.cp38-win_amd64.pyd

    Filesize

    55KB

    MD5

    2e053d6b5ed0c31a28feadfc5aba4cc8

    SHA1

    e33d67cad5101def0905381354f2fb63518a767a

    SHA256

    006236c16a634ab2de0c24748618fd55cfcf9d4aeed7da246f6cc5ea8825d18f

    SHA512

    3c756ef68491dd865de63bca242b508f6dda72e4fe4c4508b557223626a7ac1d43f90cb4ed3cf06e557fa7061cadd35b6b2a86d820d4b744824432662b00be75

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\ucrtbase.dll

    Filesize

    1011KB

    MD5

    849959a003fa63c5a42ae87929fcd18b

    SHA1

    d1b80b3265e31a2b5d8d7da6183146bbd5fb791b

    SHA256

    6238cbfe9f57c142b75e153c399c478d492252fda8cb40ee539c2dcb0f2eb232

    SHA512

    64958dabdb94d21b59254c2f074db5d51e914ddbc8437452115dff369b0c134e50462c3fdbbc14b6fa809a6ee19ab2fb83d654061601cc175cddcb7d74778e09

  • C:\Users\Admin\AppData\Local\Temp\_MEI48882\win32api.pyd

    Filesize

    138KB

    MD5

    57be78d0f2a66700600266ebc86c9b3c

    SHA1

    a47987d476cb9c76698890405e0b65aa10e07169

    SHA256

    9ab2b3a63bf2d0ef5ff3412c0b000756677810f3aa60a10bf62bb92c9f9b6ee2

    SHA512

    98c2a2e48adfae6c7d3c7d6731e688a27fc1eb6675760ab44f78e4eedebf88b09e425d21baf5674d402f9cfc9d7ebc6d643f8c763c8db5f6b1f8bf83681c256c

  • memory/4420-194-0x0000025ABA930000-0x0000025ABA931000-memory.dmp

    Filesize

    4KB