Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12/12/2024, 11:45
General
-
Target
2024-12-12_143b45c046f1042933d766b130f9acf1_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
143b45c046f1042933d766b130f9acf1
-
SHA1
fe175bc1b7ca5d12bc35d64e2170ed6c2ae79b72
-
SHA256
0966f905fcce9734bd957aa356aa9cfb639f9835524fbd501979d26a5bf47616
-
SHA512
a83668c58ca0b4f015a7be3cdbca1bb69d43d8a686a0a5dbdbde772cd2cdd2376dbe0f50a092b043d50475509725802e2c04c7f45596f8ec24a9787ac43fdc1b
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lu:RWWBibd56utgpPFotBER/mQ32lUi
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 43 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_143b45c046f1042933d766b130f9acf1_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_143b45c046f1042933d766b130f9acf1_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nzyDJkJ.exeC:\Windows\System\nzyDJkJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ndKebUB.exeC:\Windows\System\ndKebUB.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OSDPQOx.exeC:\Windows\System\OSDPQOx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\qWqWIPg.exeC:\Windows\System\qWqWIPg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\huNGuLL.exeC:\Windows\System\huNGuLL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IpJTGob.exeC:\Windows\System\IpJTGob.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hwwCFkK.exeC:\Windows\System\hwwCFkK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\iGWcNfz.exeC:\Windows\System\iGWcNfz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\vQOopfv.exeC:\Windows\System\vQOopfv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\icTitxp.exeC:\Windows\System\icTitxp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eaywojP.exeC:\Windows\System\eaywojP.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JSwcIxo.exeC:\Windows\System\JSwcIxo.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\axocnwc.exeC:\Windows\System\axocnwc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QUkCkUW.exeC:\Windows\System\QUkCkUW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hKUWNRL.exeC:\Windows\System\hKUWNRL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OhdalCF.exeC:\Windows\System\OhdalCF.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\DVQnCYf.exeC:\Windows\System\DVQnCYf.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MboSCVw.exeC:\Windows\System\MboSCVw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\eeVZUte.exeC:\Windows\System\eeVZUte.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CFVTsoZ.exeC:\Windows\System\CFVTsoZ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\cMmJMKV.exeC:\Windows\System\cMmJMKV.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD588470091ff81af49823fe5fec7e4b4e4
SHA1b0cb4f8bdde3d15952f6a952ab017fc53838c370
SHA256218f9d0e6c64d531b877a461a1348ea40d89fd7d71d1a540663669693dc0d2c9
SHA5124fc90d3da055269194f84d007ace6efd8515a58ed77f2190182fd629acb81af185008f79f4de86d5af7d6d4d4f076ac7a68d78e883309b3a860342160fc7d2df
-
Filesize
5.2MB
MD5616500c02888c77f791bd1300297fa60
SHA1f7345445d199c64cd0775e2ad0e86fed988008be
SHA2565180f67247ee3f4ee46418d5d24252d118be511a88d8d68da4ab8dd407c0f75f
SHA5124c5bd1c6190af2311d4743c633de437262fbda104bc69c99e442af4cfb4d124bdc17b460950fb6f8b69fe3d0a58ec8a22efe1048e3ff0595eb895d43e5ffb1be
-
Filesize
5.2MB
MD50aa64f89b76f2d786e664e2a4511b97a
SHA157f09bbb32c0f3564e33d23c1f90e22a3b2989c3
SHA2562a6fb791d73ff39695f818ab3a6e05fb0a532574f9b6d2466cf9ae7f0a85f25c
SHA512a2043a0a1bd8c298d740395ddd0c33ce269834adc9acc074549bea9eb935fdb43bbda48bc7f51020f70d84b131c0765c4489b02333a15d6e01ee8b8a0f220979
-
Filesize
5.2MB
MD5adb9122928b87e4fffff9166d44336f9
SHA1e8e7efb23d94f8a102354f967d670daedec5eebd
SHA256897e93ed25115102d12d5daa86c259773ec83758dfa69cf81774e64834db8be1
SHA5122b377a91f9d1c047175862fb1fc7c3324eda4d4007e1d5daddacb23db4198f3e2d5db8247a43868d49574f6b5a6a93eb87990594708fb303cb9e33a97a9d123d
-
Filesize
5.2MB
MD500689ad7a817e54625e6ef5df9588f3d
SHA1e25e19befe2383dce1093904d8a487a42925bc5b
SHA2564d56c709d6a1dc86f379628fbc1b12d76da7eb074bcb5d33e92caca3766b7787
SHA5126a227778ed62ce501be33fd3be026b44bd2bea64b0f1b69b65d8619513afa38e88b08f465243ca39c628af83e136408357b23c16e4725738d75ea455fa193404
-
Filesize
5.2MB
MD56d3e77d89cf3fe2c19cbc89a00f33381
SHA149c5a3a3028a265dbdc56e9beb58cc2aa74375d2
SHA256db2a793efbbb797d64baa8467adb70c5512eea9f740e71b8a1b89c10c0dee961
SHA512b03aebdfc05ee7f678501df12f3cab376e1ddea49861338411b0b68b9f21a79b0420f05a490394cac48c41dfedfcd2247d507738d8cabe08bf2803e3b4848843
-
Filesize
5.2MB
MD5cccacb6e8535830a0ba7895081594397
SHA1009a15a6fbe1eadc80908aad18a05a3eb32a9e7d
SHA256f6bc2abee9e0b52f3bfb35ed399721995660d282a560485f33f4bfe69bd033af
SHA512e71da061cc401506c3357510d24f14595159543389b03351e60361337f420adea3fc0fb26bd6c33c6a5e8680fa75ea198e35a3a28c2584d130f92736d756ac2f
-
Filesize
5.2MB
MD53f56cbfa5cc1e3c751127ea99c951351
SHA1fc33a03211daf83e115739ff83a7485e5ee21486
SHA256c6646fc7d5b5f8ab4da4f4c6c55e16f23f1567701f06c0ea00603af2c4022c2e
SHA512deb5c57e0bbdac7f3211dbe6df29fbc13271b2d155afd1b42dcc3a03294f82566beecc4ece00d7424d31449b4245cd104fc748bb9fbef5f220e48e8366debe85
-
Filesize
5.2MB
MD5327f3b707e30de8513cbabd0a1046eae
SHA1e6c01cd88f0fdc11728c8e1b9bd78cc4c0da1460
SHA25656dd91119d469f3b668e7654136ea4fdc497ed37911a2f38f2492d1186afcbf1
SHA512b8263c8e8e1b56e2f5a2557834fed01c2b79b55525a5acffb587fde61d8097c0707000ed08a65334e74e946282ce3e0a2e9fea194ff31b26439a942c63e81e6e
-
Filesize
5.2MB
MD5d3716152ad613e2c6afa35970fdd3c18
SHA1fad514405606d327cae735e74893b810848135da
SHA25687dc2d9acb7f387b3cd763806a9fea12982d791769776d5c8710f0b61a758a2a
SHA512743b19ffc54e4013e283d156a93a6503bf3faa1e99b55e9f38ac66a8d324e0ccbc2234e1762372ad9c7aa9dfad53f1ed6b9f8bea646c133dd6753436bbbb81bf
-
Filesize
5.2MB
MD52e9de99a40df6d9839e1bbb09138714b
SHA15f6bfccc18cc64f58f4253fa7099c351a141e6e3
SHA2560ffe3775c0ce66225237c89545654191ed68d110c986ada0d0aae185bdb80b66
SHA512de47999b99903938f80bd2c2f53d18f1a0d0b179c7d985d3ce729875f2126650995f8062b34ba186881fbd400c45d527f4f5dfc3af60f5fef5decf410ad3f0e8
-
Filesize
5.2MB
MD5caf40491f1058b128cc75fe98eca1858
SHA1c666b6cc54e04cf987436b40514dbf7065a7d024
SHA25638e9e707f58c35f067fdd5736f4c4fb773c31a9d73e99750900e50175643b570
SHA5123775b23a8f26251ff2b457baea658c2d68dedaa86076f7839ed4426ce718564fd73fae4cafafc0540434294f32678429291c900b440c78cc565f2f1c0fa6ce1a
-
Filesize
5.2MB
MD52625c72cd7399080e300d795917397f1
SHA151082e894286672fd77c58cb5854446ab787f922
SHA25689dda8239f778b66dcbc0f3b3d29902fd62fdf4047461b115d021d208e0c1512
SHA512f958c787ed7369b4765faebd5328f5cbfc60f1d4586378b86b8063bbb546937464f47888f36c0d11c1aefb3e93e62a7641d1c504e0b1c9adfc7533216fa6cf01
-
Filesize
5.2MB
MD549fc39a78d102a996f8a714140634798
SHA1361dcac3e56f99465c682e986f99faaa42fe9c89
SHA2569e9b26c8bc7e9b827d6b621566675bef7f98e38732381aeb3c2788dbf471f35b
SHA512c37c7a64871efc67c37e6ef3c64fd3089c83c1ffd4952599e900c75bc38bb84d31dbcebc71d3b600db31f20eff8bebb3a39ca573665bd252f6308051cd4515bf
-
Filesize
5.2MB
MD599f16d38a9ede10a5c8ceaacaa9d193d
SHA1274f558423db922369c961ddb92f2627c7be1754
SHA256026742c79f584c0a228da8b53b3f52aebff90242c13f13e285f68ece943c1bcd
SHA51297e24be520a47d3c6b234aeb40f8ac7e21adfd25c300da7819de02a9784ec957030f424590f32d95a1df8b10ffde36d3dedeceb4d26503569503cd6a87d6a0d5
-
Filesize
5.2MB
MD59dc55e728e475d1bb5d3df35f6ec62a7
SHA1e910939f213b8adde4c5eb427dbdcd236af613c7
SHA2562687c3bb38872fda9d300d7231b1f9ea29590c190220ca17ba9803f9ff8ff152
SHA512b5ac4a3d3cc883548414b1a37a4c1ad89ff17c7b2b0aafcb1f1080432593bc5cbc11a6b9cf471d39696a8e1ca7b5b25355db861afad7d2af16bc2d6e7fd60202
-
Filesize
5.2MB
MD509c76721ad1b24ba8406d1df9854badb
SHA1dc61b00afd5f3ce31147c704cecff081382718db
SHA256bac2ff8cafc320c8d340aef90acc204bdffc7c0063246be04176ac9da5dad96d
SHA5121ab9d320bf4d9f0c10a289d3f3a2fe6b4bf91d5ed121a9ae957a4e4b01f2f001f2d5443686c847a1e1184dfcac39cdd7dfb1d1beba08689bbb9634afe00fb194
-
Filesize
5.2MB
MD57bcaceb341991b4b2778492facc330db
SHA13dee9d11dd0837f0a191468acd1203bf4423d9b0
SHA25671129cd025b4f01f338d41e5551961fc35bd01e11d21732a99bfbc7531039c75
SHA512723f83bacec2b16a4a4c15fbdc258e514fe836ac5a2be4fc46201d8fae37e6e4aa1f4a57372ba5b808ebd7f5714d01080c0dc8aea89ad97facfde6eb360c9644
-
Filesize
5.2MB
MD5f91e1cf0a7e2a6f4bd407b6a30969fac
SHA18a9de2a866acc49c2c670c1d9ceadd7869907910
SHA2568c48f6f7fce51079e296108ac8717836dcc1aff338674fc53124a371634e78e9
SHA51287f8f2ee3b2ddc0891e6938a7790ff54e684549439cf8787ff01ed246a88b5fee167859fce833c513163a12d86a839d7e5cf297fcb44f4335d2757f9eebb92cb
-
Filesize
5.2MB
MD5f23541093a125b0b59a703c722d207ef
SHA15cd17dd06026277d98e1f857f8e77e87f2308da0
SHA25656f14dcf67bc03c7c004bc686fb65bc86876aaa4f120b8de6614979d906a72ee
SHA512dc2629baf3878311aa076071d357908b2a4e0c7015686b50c9a61f1a7213f01eb55262b45fa0f6f7ac62a97d222ed931465f901da7e3f4e2f76d1f6515a252c5
-
Filesize
5.2MB
MD5454d488d669b2d50398aa08b287b3441
SHA15aa4ba2c12bb90cf162707455226549c909b9159
SHA256b6a0766ef11c86c8bff47549b53d813553577508e31f1aecf7444a5a12984ddb
SHA5120f9921bec8b895df9a9dc1b67e8102d513ed7a07da81d893fde84d92c40574551e94ca3a8e172fc7fca8762decc96053804bce0bb96a5d2b8bc8a937ff80cf92
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB