Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12/12/2024, 11:48
General
-
Target
2024-12-12_4e31a219500575b3eb13cd199f5bd857_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
4e31a219500575b3eb13cd199f5bd857
-
SHA1
45c578aaeb4ffeef21bc01228676ea32c08bec6c
-
SHA256
6b50805582da8255bf717a4b80f8925ae632376ea9d407cc072d3c2309e8daf7
-
SHA512
4d172f0e2b1a42aa8bf5e9a5b80381f5cd435b52e8950cb0724127569162960bbe30562f85ffdbeed6323d7b207b27cc658df5fe7f2c421027d8ee5427f793fb
-
SSDEEP
49152:ROdWCCi7/rai56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lZ:RWWBibd56utgpPFotBER/mQ32lU1
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 38 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-12_4e31a219500575b3eb13cd199f5bd857_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-12_4e31a219500575b3eb13cd199f5bd857_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\wNKMKuK.exeC:\Windows\System\wNKMKuK.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\CiGQwgJ.exeC:\Windows\System\CiGQwgJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\wJEgPtC.exeC:\Windows\System\wJEgPtC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\AOAoRiv.exeC:\Windows\System\AOAoRiv.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jwhpVfw.exeC:\Windows\System\jwhpVfw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\QXEtLyV.exeC:\Windows\System\QXEtLyV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PMUMDEA.exeC:\Windows\System\PMUMDEA.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JcVnSze.exeC:\Windows\System\JcVnSze.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JTfCUfC.exeC:\Windows\System\JTfCUfC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\SYZqAgu.exeC:\Windows\System\SYZqAgu.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\hQAFDCE.exeC:\Windows\System\hQAFDCE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jtyelZM.exeC:\Windows\System\jtyelZM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\nFASPco.exeC:\Windows\System\nFASPco.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jrqUWNy.exeC:\Windows\System\jrqUWNy.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\MqbvNxe.exeC:\Windows\System\MqbvNxe.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\TbtczPw.exeC:\Windows\System\TbtczPw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\OoJwYFR.exeC:\Windows\System\OoJwYFR.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ovJkORJ.exeC:\Windows\System\ovJkORJ.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\WqFwBZT.exeC:\Windows\System\WqFwBZT.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\PyWcbQM.exeC:\Windows\System\PyWcbQM.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\yVRUMId.exeC:\Windows\System\yVRUMId.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD5c3a65d37e34fb51f65f1f0cbdd6f8297
SHA1761f30e560ed6b52d6d8aa6e6f76b528853b0025
SHA25686fe313869b89e75515381a36942bfefef61912a32d2b982d3874620594d2a76
SHA512bf69f3d0cbfd26a6f55a184839484abe76ee7eb85aec4480cec50ccc7ec2748a9743f4c611573a99a86d24e8c3ac351d010a542d65bb2c5b0f8cb50ec46c425e
-
Filesize
5.2MB
MD549150a576ef1da71e99a38ef84e475a0
SHA1d652544b1a8005e4eb6d746b39dc78b684a7837b
SHA2563bccd08f4f5e87785b96404a3d713df051c5b288d210b743c844094ee18a31e1
SHA5120b9519097314435e7a7961b85ee1df18e8c58458bab451434f08108ca0b257a0b640807f79fcf2b07b642fb78e4dc0535aa3daf73bed1101a197be8cc8193f09
-
Filesize
5.2MB
MD576d3e7a86dfcafcf2e62d32ed071fdaf
SHA17c9e11a53f6d7fe47e6b54cfee71c2e0329e8b9b
SHA256a75b2f6e478ae5a16e95e1901f68cef5083ccafe6492d239cc8df10b36941519
SHA51239cd7a196731f8dd2b70695c1bf0c3085c0e7e4c8ee74dea2c9d324256085d8efa7746d51ab7618f5bcde0d79ef996c051a91a99f928f48390a5881e1b176b2a
-
Filesize
5.2MB
MD5f6e2c10d0c7a26b5da74b6c892f37f12
SHA1c866e30c652b52656aac8dbd260211830f95176d
SHA25639f9cd760f841d142a64c68dc5ee0d99ebe0cbb2a85990293f9f53f79cabbee9
SHA5127ffaffe340f79021b7d51205eab28246c963ce6d00ae3b7f4866ebc458ea3abfc806aefaff831311b9ff55d6175abedc2a3bf418d2f3ebadf456d33c5fb8f515
-
Filesize
5.2MB
MD55da3dc5287ddf9543ca27e83920c1b14
SHA140d9fdeefbc18503033df72f699381f36cdc44f6
SHA2560ceed5866a00fe31cf0eecb017875da4346cb2533f77358eaf311065b7b9b2e0
SHA512a4a7783f660c3e87e9b63c26830ff388b780571669cec53f1559a125b935c34c21af3f1f7eeb26b744c530daf13780471c87e505b5cdbaf0df87d8a018f05961
-
Filesize
5.2MB
MD51541d10621da092204e81007f895f4f8
SHA149216025ac6219437136fbd412acd5a8964e1bbb
SHA2569e255391bcebefda5defdd74e8450f49a8120970b8a2de3724ff653174451d04
SHA512e1cea2cde167bf8e69937a774acfa9731aeb7230a441f5d02c50aad75ae28321163eeac93cdee6a5b4cdf52239fb1d14715a8b2cc1097b13bba3b9848fea5c5f
-
Filesize
5.2MB
MD504f22208569cd28a4e94d0171979d554
SHA13565ead4d78d1c41de30f3067ff1bca2066b1758
SHA256bc7e8aedef8569123cc8dbc1a16d5fd654b37ea22465cc8b4188ec21f36675d1
SHA512510671bb2c64649e21471ae3f08774d2258fd83143a2823556557f2b4fce53b5fa9dcc00a0f1c7e673ef20076146417287602a3885c2f6c12ec2c1543224dacf
-
Filesize
5.2MB
MD55671e8240bd5cac207a813fd65ff61a1
SHA139892e26bd5541c2892e8274a5eed5d43de94a90
SHA256bea5ec995de710a16e9acf17bf2910a0341f6717394cfdc49e965c9d44729a28
SHA5121e22605ab9800f2c3c8df3f3302788c5749c6b13441d7fb005e45de0e54e57662a3776470d0335e2b6d1c5bcfcfa01959bc99b91a5d5bfbfdb7dc07bd5ee7fb8
-
Filesize
5.2MB
MD5d0fe64fe44c2d11ba19c8a923a459e1f
SHA17b9d07139d97502faf81e1469b68668adac9fe91
SHA256b269aff4dc40e019eb6c366e9df589836ddb29dc07b768d681e337fd1f82f709
SHA51255d38c788300821dbe2db11307569e98e929f9442ef67c5d9cd678481da8a90e0b152749a769d75ae139e5cb5875d7353f7bf301c69f6edb823aa3eb30d38b40
-
Filesize
5.2MB
MD509dc0a2cba8abd963328b50ad32c67ba
SHA154277a995cb282af6c344cd7b95dc05db939b52a
SHA25633e3bd9d6fef9f7edb1912c11492734119f836f77f65b1bf43c8ac74918e2c94
SHA512c8ec29cea260fa79f9c6b7d01e12225786f5c36c415e2ea0b9bed928df5bcbe6c7954bebcb91f2794a527115c3b385e2b3dd2c4d6ce58da4046203bee6e7e03d
-
Filesize
5.2MB
MD513c95672deb0eb37c1160dbcd29571c6
SHA13c9f3c78e56a2e8bcabb7122c74309c2d95b91c6
SHA256a93b6b89c3e47e30380f76853b0584f5f937e75794c79c6191edb761add790b3
SHA5122c724aef6e7d0ca617347b9fc2a46fb37121524b916bc5cf8470e0c5a145ee0d55f640fde8bde9fcda4cb6826c8e4907f8e1d3171553340ee0bc264830b48c61
-
Filesize
5.2MB
MD56feaabeaf6601ff1df243e5d3ca1dbcd
SHA18d82455972810b3690936cabfdf17e89afe3586e
SHA256f26ef8722a520a05bbaa5e5b6203b2ccedf5475a250f87ddefdc761c06b69616
SHA5126e5cacb637fa2de99309e91d1c1dd2fa29cd29f172acf15833c95bee3fd8ae99b2f6e67488c4c269e13ffc3fd3635b09a3f1e862e90ca3a690f5434977416b6b
-
Filesize
5.2MB
MD5cb7d9e3be7043c01ec301f1d3e3a19d6
SHA197587aee9fcc255439bfabc33079db7c1ea5d989
SHA256da46b1cbc3a2d7456ef32b4d70973167e220063d2af5b1f6053d4e7108aac3e0
SHA512412f6af846ac3bd8a5620b16876a38cd64a438e45c3107e1e6c09129bd3a42d2c98541675e546943ffa97907bee287f846cd3c502929a07aa60b8484bfe7c75a
-
Filesize
5.2MB
MD5ec8246dd3668826d8ff1d19b13514bb5
SHA1e5d6b2d99cd94c6017fa026f842f865adce2fdc0
SHA256639b03926ed3772830d1a61f016c0d3a8477824115440333d7c792d49f1791bc
SHA5122039c5e8c804973eb4c633180e914c226c9f9119f81803ea414943d2293e38d903312b40a3b969582e822f71d60639fac220aafde6bd596b1585407d86cc3a95
-
Filesize
5.2MB
MD5d77665fd2d13a5ee9240c0f74e092484
SHA18e147fe75f1f3fefe344e260859863c8fe3d57bc
SHA25671c5cc7f2576aeba5c87c25640986d83bf9c494a0d5f2d26c47c4d73d1957d78
SHA512762b0f7f585cb654f77e3c1f419ac3076b8a8233d7471ba1dd7bc7b0c6629b64973f3c1ca3f73e2bd16cef741c38f3288a526ae1bdb67b1f5fa0e38b3752cc5d
-
Filesize
5.2MB
MD54a26c56a62462c8367458931c202f227
SHA1f0bb7f31ab508779be334067eb54e05398afa6c9
SHA2564d6d067cb699a20b7b373f78d535258e8f81ce9637d2d0649128fda48f7f8007
SHA51251c1f30b55616b87bd8714216d6ca8956a26173a718d022606cd7419efac137ff5b68db7843568a46c76188e6a538f10bea9b3b3d7168936ef409f5329afe5be
-
Filesize
5.2MB
MD506f75a33c27ccb72dcfd3dbf771968f2
SHA1b210315ccd15661d88a2e02aa4d03a062245c408
SHA256dc1fdd6638ea77e84a16137bb8da9ec39921d4fa31479fc9b0a90c7a0087d087
SHA512f389e3646363987f36cec9fbcaa788806b4e8d3486d0f4e3a0d19e10eab2175ec5449764eb22387746d13eeb81e58b65d4cb20eda1f474f11ee7dc361e9cc0f3
-
Filesize
5.2MB
MD5ec35033bd978f415fbbc36ab67d06b83
SHA1ff1e9b438a3a80479a58859cfc68ef8456044c02
SHA25659c9ab5017c622d199010b275bfa15c7f70d2d0b4de7898864fb6dcced181791
SHA5124ba80b10b9892b3f834b9bba53ee30fee9fcebcc73b9a476189414adf16513a785db7c201f7bfa2816f08a0cf86a06f392a5c8b633822232d0a8378c657b17c1
-
Filesize
5.2MB
MD567fdc711443d0a02c00b4283fe46d6e0
SHA19b6a790fff9f0c42b8fec6c103c89347b8146de5
SHA2566fc2f455791073e7e9a5773d92fbf641f12b1b2ac3cbab722fae633e66d8dde6
SHA512f3cad55f4311c14a416f71423086bde70d43305d48a7ec677cb5f4bb11bfc77d0ffdfbe04df005f801500f5cee2f6b7a2d5ff0e70db78feefbc579f96cddd4cd
-
Filesize
5.2MB
MD5f161968e6c5e6eddb21ea6b9da500d37
SHA14aa86d80137e06ba9123e4a36828edf83b57b0b4
SHA2562d5be535a738bb4f9654fb9be11f2a0257acb482a28cc4dcd097189a01568b70
SHA5125975fc4db7f3daedfc188f405e6e168343e6b689524a222a9a9bfc959a531eccdc60d40d1d45c9d67bdc191b6cdd3f587cfeb4b2a2c6e3e9cb174a39097386dc
-
Filesize
5.2MB
MD5ca75d40ccc8ef159d3b95f5946680e64
SHA1966a78e516482e73546de1f9f538ecd523600754
SHA2560c79e113e5fcbb47835f41b05e489e50d98b2e53827c081b917e9f26417647da
SHA512bca79b171478f221c435a80629c4b088a1365a790bd552fc29d29c299d6b6b75aa7accb282c7b1f56e78fd0e0f342238bce6ab90811233e7cfdd67ac380828a1
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB