Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17/11/2024, 10:05
General
-
Target
2024-11-17_2c4b4325e07c2ab13d03cff761c0627b_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
2c4b4325e07c2ab13d03cff761c0627b
-
SHA1
33184daecafc9b412fb8480553ea75f8b6cf4339
-
SHA256
36eabd85d5a6bbe25b42d06d6fe7ff011479d7925b032a3b5b3c6bae8804fc7f
-
SHA512
885637f3dafec9bf2e1415d9b1113400e80474228b9e45e74cd2195aae2778a00576863abfbbce15cc6c6808bc4d8cd5eae82277851a3f2ff9b96a8c14fbc917
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lh:RWWBibf56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 39 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-17_2c4b4325e07c2ab13d03cff761c0627b_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-17_2c4b4325e07c2ab13d03cff761c0627b_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\jxMGKwt.exeC:\Windows\System\jxMGKwt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\kZuOjmw.exeC:\Windows\System\kZuOjmw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\rvzTgWB.exeC:\Windows\System\rvzTgWB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YZxQNTI.exeC:\Windows\System\YZxQNTI.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\piiaKnx.exeC:\Windows\System\piiaKnx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hbHVUrP.exeC:\Windows\System\hbHVUrP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\VInTNMd.exeC:\Windows\System\VInTNMd.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ffdGuZW.exeC:\Windows\System\ffdGuZW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\KjYrqjl.exeC:\Windows\System\KjYrqjl.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hHlrruE.exeC:\Windows\System\hHlrruE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cHfGuLh.exeC:\Windows\System\cHfGuLh.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\BiHqgNX.exeC:\Windows\System\BiHqgNX.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wQBrOXD.exeC:\Windows\System\wQBrOXD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\dbShTpv.exeC:\Windows\System\dbShTpv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\icgGvJa.exeC:\Windows\System\icgGvJa.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WsnMrEZ.exeC:\Windows\System\WsnMrEZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JEmwpJc.exeC:\Windows\System\JEmwpJc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ufssTcS.exeC:\Windows\System\ufssTcS.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WgWbRkp.exeC:\Windows\System\WgWbRkp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CRMayxF.exeC:\Windows\System\CRMayxF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fGrMRBs.exeC:\Windows\System\fGrMRBs.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5f3c8141673670b79a8cbeb1ec4158dd3
SHA1342d5a0cb8844bcfbe9e30fc99c8a1774148f039
SHA256aa8a76d395a34708a2647a1b01364107bfbb8a7aed5224093a288927b1893fdf
SHA512971242264397fbf4936eb28910b0907f8d0fbcfe8eea50cb9280eed68eab6f04a44fc4f1216822e7affd94527c690c8dbccc0edccc1eca78c0d362c6e674f897
-
Filesize
5.2MB
MD54e2699c44c2d8c9ec62cc5cf6a06355e
SHA112376ac64ede6ef9b0174fceeeb102f9add4cfd2
SHA256a0522ea298c90cdd221d7e3484b2c268c273dee4f91205ef6da729710e1cefb1
SHA512d05435dcedbd6efb82890b61bd625c4057c408a3e2677c2317efd424c3d605ca1a4542b5536266a4a353667e328f977db5d672ffc9dbd23095f6f9d06ea41891
-
Filesize
5.2MB
MD5c214414f8006341b70e0878191678870
SHA13db5d3885f5e401ffda4a7f30bce4ecddc46fbaf
SHA256d4725823bf73ee355ef571f1018cecbebc1bd4d0af64d9a113e5bf0112663bf9
SHA512fabfee9461b191b76cedd6ce8f5248fb9f8b19328b512ae98010cfcd1e8c4499d6c242d89902328cef8cf212ff80bd4d8c2148d7c748238e49d98828fb68e78a
-
Filesize
5.2MB
MD5e1d55aef457332cea3c61492dfcbacce
SHA13420f477bf9d7beef0ed8f18fda76966cf3954c6
SHA256808146c10aa707ba41c596c74228022b314d493e0605d0806b9edbd67f830832
SHA51228717d18658b48131e4592ee6c464862ae0fdfdde8a291f7a93efa80e89d214e0772977bbefdbcc074824715f667809e49b0fed24323d881685eeb6418b49c52
-
Filesize
5.2MB
MD559d6805443c90087e90b8dc39a578321
SHA1b996d0133b1c3aa1a66158e24e31116ff5b1561c
SHA256f74e865d6fd9cddd6ea159e2166fb83000850bdb21441430e3d26a8b666dc8b4
SHA512dca895be45fdf0df9915372ecda64bc8d0a129fff713b6ed77715198fde484529d2e7e4b6183adab1452476280bdbff983f2bd4b3c0693e6c6de7fa3b178390d
-
Filesize
5.2MB
MD51f7cc4eb40620b50e12c1ba54885df2b
SHA1e109b47f746545cb51ced55b0983eb8ec2490bb1
SHA256313621623eca54e4660f980d6133443dc6b10902786a6f9bad119b1ea2ef7308
SHA5123c0e41450136cd53c6f9aa41069928be370d5c556e12e4d2d350afb90175258d6c9d9c4786f97a96241fe6a77e6818431c555f6de357e31229d225130f13520e
-
Filesize
5.2MB
MD5762bb4ab8edaff65141469f4e57d0ed2
SHA13f65c56b55db1a715b13592d87a87cf4a4c5b47b
SHA2564f9a61fb1faea119b4a64e376a8b8458936255b261b7b871553caa4c2297b74c
SHA5124d12a1f60f6b744174a5b67c1a5d9bd6bb7c959f8f3a3442eb4bc0931451b6bcb4a7b75b83a2049f93edca844a48b508d23559c4f22d7f136f2bc369471ec110
-
Filesize
5.2MB
MD58c9d5208535dccf03d2044bbc28db57f
SHA1c6f93e7fe28772d9ffe5c971b8733142c184e682
SHA2566d3985991d8e0aa920837abefa016ad7edd63505700290aa92535fbbdb60c093
SHA51268b35ae9b474534fde9c060e36460f92051c5d7643634462180684a19f45afdec3f6d8fd6a041fc7893d814709ce6609083ef2700afc70884fd0d52d5d9290a7
-
Filesize
5.2MB
MD5cace3c88e6cd6717ead24808e1b75fd0
SHA15345a2c7b3bbd8beaa3fbbf1d38699d2612868a5
SHA256dd1e8d5de16e0fdc9feb8296960786b434421ca2185c50fbbef33539c8caca9f
SHA512d7245386cb335cd8b093649f85154d090f1e7d1913be0035c89c7b27ec8acfc80d1c3d2abb53b41ec32daadfd596789f6e3a25f7b26101b24504c18eaa2cf028
-
Filesize
5.2MB
MD59cfc6874c4cc3fa2fbbb10c51500bc57
SHA1f3cc38aaa13a369120021f7636e2f24e68a55de2
SHA25636798ea7c81e1cfa547468ad94346f33f15f4a2585b4a787ebb827dc9e6d571b
SHA512ceb852782c7390075b0563af976318574bc3d3fd15b2370f9b374f1975da3d2190d365c82eda3337a93b7badd5dbf30eb4f6c344a0b011f0cfa030be452c06e6
-
Filesize
5.2MB
MD5250e4e4bab90ce8ae435b7c8e682d23d
SHA145abc178904630b319912618412aecaf873a68f8
SHA2565fe8e857660d6b2cc99ac36a6f8c2e05844caa25046ee49abe7ec20c99106bf6
SHA512df63aae70dfa0c94887407052370827f23a4169bbcfe55454f000ee8b2692396d2f058b0a801f6e55751d59a8e290dff2efc4ca8fd812d865b5f84b1dffca03c
-
Filesize
5.2MB
MD522415f05ac8bc3d8003bbee5f2635fe9
SHA19b64471a19f9405cbaa2958dcc82efe559e584c1
SHA25601384c79741d11be7470ff1ba2b11ab63a8e4dee0dbf450562508ad1d7734010
SHA5124afe5926fb64b503be6dff1cbf11da9d813e05b5309d7ef84c44a4a87281c114b2a1a71682f3341daaaebdf09ed67b7ded1e1fb64cd9795c8938b3c71eb0d078
-
Filesize
5.2MB
MD5f0ecb34a600794d4948da1bd74a12906
SHA1306d38545d41cef2c4593701f1654cca4e4aebdd
SHA2560c5656a09bd12cdc285f7eb16925aaff6b9f325775b5616fdc42a4b2e753faab
SHA5126319171ace0ff9b3789e64588d52b069b3a512fbd277e312752215dc2bc91c2120a95316ccf9fcc76dd689b8f1c7a2563f2ff02f95cbb5968c2a64c4df5041e5
-
Filesize
5.2MB
MD587c9fd7189ab950eb2c5eb40b3a71fec
SHA1aa2aa0a045c10012b1a79d0d6630ec4094a28b38
SHA256ccc3e9e2be04dd8e7f770f7cdd393107aa52a4b959a8fd1ae78b79298ba0a408
SHA51214aaca0696e6d96cffaf7bd4b2525d051853168375d4da6c38e26e8c9cf3ead1f1dbe0866e4ac395e0629008f7eb38027f6b1c16cad518dd5dd8b240c3101548
-
Filesize
5.2MB
MD5e990d80a8cf22c34f06ec74706e8cb95
SHA1815b54cea5426a43bf3545df427ce56ba228ee37
SHA2564f4536e4cf32460c24d081b8e041ddf45b9a978254398c140615a14bc7f7bf25
SHA51237a45b45658af3e1546d6fe33717f2c97ba87c015c99377fc7df0cd4f0d56abd3f397e7f70facac1867040135f1413ed00e5adab362be5144c2168d345a4c6fe
-
Filesize
5.2MB
MD5275b04ba36c869381ac73be3b200315d
SHA1346731b927c6dcd301635ca1396ae1438f30432f
SHA256e5b27216894c9c6003e6799c9afd222b55d867a46f8f87c3d81e19f6204c8085
SHA512a6470afb2b20c5a6c88d4c07980537ef3c45acb038855482d205a3424422ec72b6797963272bdf4b9df74a55adb74945845d4094ea4525fe79f6e3eea24ecd3d
-
Filesize
5.2MB
MD5839acd39c6ed737a3f94aaf98f6274ed
SHA16a679cdee2d5c69d87f756e7a627c837de5de874
SHA256f49401c1b79a2123b86200e1a55eec9a02a1869bb50f2a1caaf3017fdf726a2f
SHA51254e72efb3a35a9d789b85bb9683ff9ef40bd899f1370abdab696538d9b1dffdcc8e2bac1435946e541468397280f492257e0c65eba387f7e776eb562aeaab878
-
Filesize
5.2MB
MD5b22cec0eab290be1b3744ccd14f79cab
SHA14d61c621033e508cdf041110c21cfe43f1d4a8d6
SHA25684640503ccae7d9f5e6b057aaf1384b20f8d96e8c4c926496ec60d6f6a622b40
SHA512bd7bbc8d7120701cb6a826c2a5dacfd435183a4f131e6d48b5557ff37f7c8c250d4d6731b6a40b80863a3d80cb563dca38976b3e46cef9de8f78763e4bdf6b82
-
Filesize
5.2MB
MD505baa4a9b98c95d4c1d36d476923fd6f
SHA16846661493c7d8dde0bb3eec96af0bf3211a6d8b
SHA25663f24f936486184e1d1f9786fed13c3c5f36c34495ee63b60d82a53efca5e2eb
SHA512467c06fe05c1d3bbd531f8872eaad809fa6fe9937b179d6897d5c7110f91b6a6986e0e9dc64c81589ba31649770b6f44f2f0baa3d472fa7ee3d0987918f3a15a
-
Filesize
5.2MB
MD5eb8381a4c085061f6330b529aa2b9cb9
SHA19c3ecd349340f731c8538b7d75baa96976b19f67
SHA2563f1218caa0862689417fcf81eae1e434d2d3ef851858387701faae6ae536ded5
SHA512f3b8084caabd6b08517074523c52469826021cca4436345664a74719292a7a5358ad2d887928c72760ef6b125b920e6726a4f96dc20b4a0fe4e79f5a1b44af31
-
Filesize
5.2MB
MD51e96465885c271509e1aaf80c3324bff
SHA105d3cc981d44f8bf33b57f397bd08044798c128b
SHA256509e551a6810c9cf19baad9719af7d6bc2cc35f8558ed9ea49dff3232dbed33d
SHA512236943e3f1300ebbae8692f770a24c905b8fd839acf01409fe38278920ceee0dddae4e842cb1ae8199e3d4f11a4a41353aadf158ec3b1546be8c4a11f6af2b74
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB