Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04/10/2024, 13:44
General
-
Target
2024-10-04_f7abce7e19b841350e4fc57f8bc85e9d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
f7abce7e19b841350e4fc57f8bc85e9d
-
SHA1
049d33aced3977775fe2ee3ce445e9d7e1056bac
-
SHA256
8b557eab81e908ecc90a0ff27ac6cd4b346ba72cd3591f9ffde5c19479f172d2
-
SHA512
bc2aded90793ab838b37191cb2d88be5c6ebcabf82533c7ceedcbd6d050500d5b0dec11cb7635d363bb8d483cb37c0807e9a2fe81df3548a2ea215448ef969e5
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lB:RWWBibf56utgpPFotBER/mQ32lUt
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-04_f7abce7e19b841350e4fc57f8bc85e9d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-04_f7abce7e19b841350e4fc57f8bc85e9d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\BJwNnVC.exeC:\Windows\System\BJwNnVC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pBPEDff.exeC:\Windows\System\pBPEDff.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ztTEHgl.exeC:\Windows\System\ztTEHgl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZkdtzJq.exeC:\Windows\System\ZkdtzJq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UIFMZDw.exeC:\Windows\System\UIFMZDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ohqvJMO.exeC:\Windows\System\ohqvJMO.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QofBmfM.exeC:\Windows\System\QofBmfM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OrEUMSM.exeC:\Windows\System\OrEUMSM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CgBMtxu.exeC:\Windows\System\CgBMtxu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iNzpXBC.exeC:\Windows\System\iNzpXBC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rlEFccp.exeC:\Windows\System\rlEFccp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hJKXLNw.exeC:\Windows\System\hJKXLNw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\UMlWoyV.exeC:\Windows\System\UMlWoyV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jTLqert.exeC:\Windows\System\jTLqert.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\GdFnSjq.exeC:\Windows\System\GdFnSjq.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\mzZSZVK.exeC:\Windows\System\mzZSZVK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DiDmyqD.exeC:\Windows\System\DiDmyqD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YVtLHcy.exeC:\Windows\System\YVtLHcy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EFzSOXR.exeC:\Windows\System\EFzSOXR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\xqKxDxn.exeC:\Windows\System\xqKxDxn.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yiErNUb.exeC:\Windows\System\yiErNUb.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD57889bec762a2a0675282a109e11614d0
SHA1cb819fda975f42de8886f700d9a202ac42633498
SHA2569142e24085d97381dd7408d97022a4e8179656f8611807b821622946bae03d60
SHA512c2b6d5d5dce50ab996f23fccb8a377d3819f2466f9fb6e3a9907101f77fc1c83ecb4c30437bed4b6cb963349c019d2f50859c58b2cb6a0e6039d2c84b8191f26
-
Filesize
5.2MB
MD529c10571a3eee1bbc6e5917f11c8710f
SHA1e0644d9ab5caab7fb19f5a6674283ec7b7dd3b34
SHA2560a512a5109aadcf93efd60a69adda9cfb63f8c8faa1385de2b54e85153a2de7f
SHA512ff8dcd558c6a17c9d4212378325221ef89dfe88c0d8c27e220dd9339069d6cffe620a87703feb2b78b8190375c90ae1c19c0c057fa4a30e1bda64996688c98e5
-
Filesize
5.2MB
MD5ea092b91cb0e464223edfe89245e0d25
SHA1be6cdd028da2418b1e74aa273a6696f1aae05635
SHA25606ce4ad3fa9fde0e993d69998b39dc221151dd0af33a18f4de4b7c47072a6e9b
SHA5120f148075eb9f238e4b298b28eeea071e51b9a1c2bbafaeecd6b7bccf14671ca10b2e4697b57389f45f371ce95d2ad080e2b01d1a5e7af9571ef90466c70bac64
-
Filesize
5.2MB
MD526bbf5481ba239f99926459e51f0679a
SHA12948a21c988a6b95d848b3e9c375fb0a34bebceb
SHA2562aae82fdb5f14ef2e0fee439c1200a7cc1720294d7a95478bff41f1b162d84b2
SHA512e75c718a75a6b7d9b3c118488bd42662811a7946d96838c6fe2973dfc82314fcd6eeb315344032b813b44d557712e1e3bf79e48a2ceacd0d9b2c3612174b81de
-
Filesize
5.2MB
MD578211a89020aa99610ee79bdc8d4268a
SHA154fd35f90465a420a096feb37eb512fe61023b30
SHA256c01d7e9a47ebf5f0bae16cd0b4cad0cf6dc814113bf2445c67a14c51ea22abf3
SHA5120cc8ea3ab771b25f1fae711d5adac593ac660cf91c7d69293f3faf6f93978d553c426250efb00775f5870bc0219a340c8f9030f06dc0bd0629f0d94082033bb7
-
Filesize
5.2MB
MD5bcf13f37cc6480e807f3782111c357d4
SHA1ca3c18b7c77ea14c6f4940529c62e3d4b7e5ca35
SHA256266f2047f260b7893bd3b071ffe6e7b6a2aeda84d4521b40d40a4f1a7cfdfaee
SHA512e984fdd5443a5d46e1a77daa35bb94fdd3b334ae7f6ca679108589b2fd474f90cdb854093d3093f9cfc6e799c80e2db4e740bf410dfaa233d8454be4f2c97a1c
-
Filesize
5.2MB
MD528a53d82b617fc2157b3a5cb14655e38
SHA122ec12e156e7e8cb016c897854649f743f691621
SHA2566c5f2ffdfbf9f52201443e6699b2334786f51119fd493369202fc53b538f0521
SHA5129209cd3c3f819da760b22a339b148bd5620835aca068da83620270b114a4676de8fea6b1033021d230db42d6325704cd57dd51256a6701baf7eea1f525d1e7bf
-
Filesize
5.2MB
MD574515b8a622ae091bc1c097273d57c02
SHA1f5767c49681edbec04a4dd144c0851f0af3f1b81
SHA256ab49bf78cdc65d38b64216111288443a387c3cc456efd966cb235036bafab5bb
SHA512ee2eec1dd618ee0957f4547b9369322c6db2c57c9a4f99c5dde735a4f05831cc974da056857a93510d69c5f923b8e7ae0359c1b23bdaf2f20cbb2135aaa7af70
-
Filesize
5.2MB
MD5862e92eb3c3ec6b7bcedbf0adfee6410
SHA12aa5ef2f74db3e53f733d46f1ef10169c631a693
SHA256912e455a8797a8213811d01bca1cf932358401a51c7bbfc9289efb3b0d3aac06
SHA512640990a01b6fc4f32518e475b87b6b24a827d79f73e3c919a896d1c024a5f481a2bedf2124d66612bcf100aee44444bdec7f1985bc9b9a68560d271475fa7700
-
Filesize
5.2MB
MD50716374b73ea4e50ac06a77111b6cd3e
SHA1ada856b5179f1e627870b10e2392b6c615c7fced
SHA256ae2e2134e2008af15bb12f16695908736a2aa99480b8a8198eced9709db5a17f
SHA5120e7e285c9230372f98d2799de271dbf052ee0429ca069a805edeb7a543bbc8026dc2d97d8575470ab2d4ee0035e001a83634f9a17e00e6a49bd8786f7206b5b0
-
Filesize
5.2MB
MD5bd60169473c9353ad4e8e963478eda40
SHA181b98a044882dca6c9a0fe1c0354eeffe946bb96
SHA256ceaf9351f9ce9c02f9bd8a3dc14463c403bc42900d769cab5c1963326df55769
SHA512a2d84f59706b8755bcc78c23027845af12a0a72701a30f571d4f3480be80022917dddff0e0f1f54014557fa209336010696c61535cd9f13099b54b7761d82803
-
Filesize
5.2MB
MD5b21871f49d5c858e8247b7381335acad
SHA19538264e4bc31202a2dc4b656733522c14d83350
SHA2567b85e431cd681f5b09cc8a9af5a9c423a2ba09b4828015b8e60b30de93abe36a
SHA512b6b507479d169aa999f6fa8f1db341ac456e9fd11e0fb102f66eb0e6fc1b2681e10f27f0f2e0072a238e74f9a1b48e67606a57403223525fc28372f9bd114a41
-
Filesize
5.2MB
MD5bc73155770d758a6ab7d7fdb45ef7b7b
SHA1d37f196d109b541506bb5dd1c79ad2b66297c232
SHA256708cc475c34614901aaac56dfcf6cfdc14b598ff17ea6eeb6d1d7048d2973285
SHA5123b35c0bc89bbab3648de85ef39fc0ab87f327a5424de971aa26f64e7765fdc9d09d52febe8c0f6fc75a0ae39c9d6ec3978eb2baa88f70b6d62a51fa56450c190
-
Filesize
5.2MB
MD57cd8b85bc068aa0a85243d75a09e9961
SHA1532bd27a0dbb330f58b8287ccab60807312ce952
SHA2564be575919386e856d4da514038a873e3eda02f02b18e32c5b369f3c9a286ed4d
SHA512346f31d528e09d162015a001ed22bd0d6c9b17a8c1559fd4b5cd39ec7ab2534ab3737837f8a675182d27d5f815c976c466e8975b555325ca735df50669fdcb4a
-
Filesize
5.2MB
MD5dcd3fb7755d9e6a392c20e8d0f1279f3
SHA1352220e1f24fbb73b58f48e2844be52f132d0d3d
SHA256f81be2f027fd4355f7add20d446a3330548044f09244a19ef485b5c60be4d3c5
SHA5120cd2e1e4218b007c7c5012d0ab7073795ed58d6ca9b0536422e909bdc9dec63c8c3ac2e560a24514904371c944c36b1895f43e25c75424abc65cae2eb7b6fe40
-
Filesize
5.2MB
MD581d7c400c90696af2e85326978ff2acd
SHA1cb51c3df9013a17d965a01691a5a87a1b651655b
SHA256a08921f8675c337d999ccc8b6d0ddd326e2e58b9db64081e0001106dff493a5c
SHA5126e1f3aac0b692946b7169c948dea83b2e3f1adda893b7d017301fd6d79319c2a3d6eed63acf6c8cca201989fa3aa77cef8046d2701421167d8f90ed4999b553c
-
Filesize
5.2MB
MD53e2257c7b7d5afabe2084c8dbeec450e
SHA1c5b276895a3a862dd48f3a4f837d9e2e9a6b3087
SHA25688a29cae0a834506b583ff7442151c937f0edd06ed2ff8c47abe3e2174332558
SHA51263e2d3b001f6886e4bffd3e54bebe6615b724ac8b238a790ba1a568f0aed0c78921020b498199e650fba5a20c4c6afd6a5848a08cb5ef79a565819dca8ad079e
-
Filesize
5.2MB
MD56c11293f466235795622dbaf8a5b9c68
SHA10775c86653b416a102c13d465b3bb43b9bf113c0
SHA25620da736718f205b61e39208f2400a09140b45958c4087319c2b93cf42de18e7a
SHA512095c8f7dba40228da1896021e5d68be3750428bbafa178ce355fc70e93718ce8b71879293644cbecc9d9ffefa5dcc038e008cdda28bac8f9875e733a31b13fcc
-
Filesize
5.2MB
MD50da999b6a354972caf5c0e9b5f46499e
SHA11aacda5bfb23a06058f651815a258ea7684fad11
SHA2563f4ca919a807c55b4d532c874c203cc426c26969d185a67e58fccc04b583bdc9
SHA51267f39b368d507395ad0124f74dadf05d933ef70f1adfce13becd3c0e1cc36eb3017e898518142743ee55240737d3f2b1335e9a7553c97707a2bd7c8ca6039015
-
Filesize
5.2MB
MD524f842e0840502881e11eaf13ef0598b
SHA118479ff96de861c7d55dc065cd7d5fcce17ffc03
SHA256eed1e755e569ae378a9e9fef7b1878745cb9459525d1f0a20bb5c44561b17ed6
SHA51242bed0995d8b365c2f87db26c7e5f2ea0b7f7fdc168be540c10dba734290be627184fa642a00ccb6d7fa2b474587d7c9e384b367ac1c7da3c2ed706b46159457
-
Filesize
5.2MB
MD573c0c0fb8e5c9fba99bcd8cdbde81993
SHA12061ae82f2c738c3d749d995aa99f17d5d373f26
SHA25631dfa76ab965862407c280910b3f72d2702423d2296776c375af84897e109fda
SHA51263b55131c467ed30d67d6bd06bd0237bc05285e610491c123751da1920eac022e403e804ef772050499c32a63ff2076c10871bb9a6283e8a084a663240a1737f
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB