Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
31/12/2024, 01:01
General
-
Target
2024-12-31_b6a8ae177931fdc6ea33991d2bd5598d_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.2MB
-
MD5
b6a8ae177931fdc6ea33991d2bd5598d
-
SHA1
71d71480e944d804ded1cf3b2a8fd4801b6397e3
-
SHA256
0e7345cbffdfb15be556d90d965035c8f41a0121abfb43b096027ebb6a9d19c8
-
SHA512
db1275989fb6aff2fb6aa9133dd347f477fac2a4afe71794760ba2c9b5c2a74bf96c7bd1d76e8b0eb8adae2a4120492b408ba398cd3e2014867a4f5b6157b01e
-
SSDEEP
49152:ROdWCCi7/ras56uL3pgrCEdMKPFotsgEBr6GjvzW+UBA3Gd7po52xWKQY2v2V6lq:RWWBibf56utgpPFotBER/mQ32lUu
Malware Config
Extracted
cobaltstrike
0
http://ns7.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns8.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
http://ns9.softline.top:443/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
access_type
512
-
beacon_type
256
-
create_remote_thread
768
-
crypto_scheme
256
-
host
ns7.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns8.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,ns9.softline.top,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books
-
http_header1
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAUSG9zdDogd3d3LmFtYXpvbi5jb20AAAAHAAAAAAAAAAMAAAACAAAADnNlc3Npb24tdG9rZW49AAAAAgAAAAxza2luPW5vc2tpbjsAAAABAAAALGNzbS1oaXQ9cy0yNEtVMTFCQjgyUlpTWUdKM0JES3wxNDE5ODk5MDEyOTk2AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
http_header2
AAAACgAAAAtBY2NlcHQ6ICovKgAAAAoAAAAWQ29udGVudC1UeXBlOiB0ZXh0L3htbAAAAAoAAAAgWC1SZXF1ZXN0ZWQtV2l0aDogWE1MSHR0cFJlcXVlc3QAAAAKAAAAFEhvc3Q6IHd3dy5hbWF6b24uY29tAAAACQAAAApzej0xNjB4NjAwAAAACQAAABFvZT1vZT1JU08tODg1OS0xOwAAAAcAAAAAAAAABQAAAAJzbgAAAAkAAAAGcz0zNzE3AAAACQAAACJkY19yZWY9aHR0cCUzQSUyRiUyRnd3dy5hbWF6b24uY29tAAAABwAAAAEAAAADAAAABAAAAAAAAA==
-
http_method1
GET
-
http_method2
POST
-
maxdns
255
-
pipe_name
\\%s\pipe\msagent_%x
-
polling_time
5000
-
port_number
443
-
sc_process32
%windir%\syswow64\rundll32.exe
-
sc_process64
%windir%\sysnative\rundll32.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI579oVVII0cYncGonU6vTWyFhqmq8w5QwvI8qsoWeV68Ngy+MjNPX2crcSVVWKQ3j09FII28KTmoE1XFVjEXF3WytRSlDe1OKfOAHX3XYkS9LcUAy0eRl2h4a73hrg1ir/rpisNT6hHtYaK3tmH8DgW/n1XfTfbWk1MZ7cXQHWQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4096
-
unknown2
AAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/N4215/adj/amzn.us.sr.aps
-
user_agent
Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
-
watermark
0
Signatures
-
Cobalt Strike reflective loader 21 IoCs
Detects the reflective loader used by Cobalt Strike.
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Cobaltstrike family
-
Xmrig family
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
XMRig Miner payload 40 IoCs
-
Executes dropped EXE 21 IoCs
-
Loads dropped DLL 21 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 63 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-31_b6a8ae177931fdc6ea33991d2bd5598d_cobalt-strike_cobaltstrike_poet-rat.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-31_b6a8ae177931fdc6ea33991d2bd5598d_cobalt-strike_cobaltstrike_poet-rat.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System\nqBUPfG.exeC:\Windows\System\nqBUPfG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pUUatRg.exeC:\Windows\System\pUUatRg.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\HZvhvbc.exeC:\Windows\System\HZvhvbc.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\LZSmUXU.exeC:\Windows\System\LZSmUXU.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ZNGTvpD.exeC:\Windows\System\ZNGTvpD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\JFhsdYW.exeC:\Windows\System\JFhsdYW.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\jbRoUAL.exeC:\Windows\System\jbRoUAL.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ghwBnKN.exeC:\Windows\System\ghwBnKN.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\IRdXYKs.exeC:\Windows\System\IRdXYKs.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ssvcxPz.exeC:\Windows\System\ssvcxPz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\aBDhqDw.exeC:\Windows\System\aBDhqDw.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\YvAMKDC.exeC:\Windows\System\YvAMKDC.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\EBGqAwG.exeC:\Windows\System\EBGqAwG.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\RaBwsOV.exeC:\Windows\System\RaBwsOV.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\ApafpkD.exeC:\Windows\System\ApafpkD.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\skqnbfr.exeC:\Windows\System\skqnbfr.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\fvpHGCt.exeC:\Windows\System\fvpHGCt.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\pxWpxwp.exeC:\Windows\System\pxWpxwp.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\lBNhwfz.exeC:\Windows\System\lBNhwfz.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\uiZOzJk.exeC:\Windows\System\uiZOzJk.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System\afreBYy.exeC:\Windows\System\afreBYy.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.2MB
MD558fc908ab322de98e33ba4efee399694
SHA1850944e593050515bfa7f00f860cf9fdb944f329
SHA256cfee734f165f68da4d502337688e91653808b79e917265e0e9fd3b65ad274423
SHA512ef4980ff59eed2a6cac8ad41645d4e32f3e089906926709707a8ac98de1fe6a30f6252ec9580294d0f59e562ab0b6187ba3c990bb3970de9ed6fb65f8a700b44
-
Filesize
5.2MB
MD541b1e8ea111b02a5751140d9ed13dcba
SHA124ddd4925598eea51b4219b2841dac3223342522
SHA256490123291a368e9ed9db5916d4480f992abc3e6ea4f4b907c2fa9b5e3da57c6a
SHA51255eb7ac53b25856a99f86b318621b262041a2e0d264a47dc184c2e7685d892c10ce78fad8367dc5659cbec79f09372ffec2251fa823a955b54ba09c475b570bd
-
Filesize
5.2MB
MD5de417697e2729f462683358246db2a20
SHA1d38d09ab85d3bde96899badd12962557ddf83553
SHA25611ca04e4107c54c07da0a5a923435dbec9f261a001ad2f2be88a15ff75d06ff8
SHA512d7c43d9cb43576aa3903548bc3911aa9f69238cd3296193fe1f1a36991b5e13b77a60d391ebdfbb62f3c2b13ae9831f8ab4b3172bd13df4c25b0cfeb72c928b0
-
Filesize
5.2MB
MD5006690da5cd6c6b99c734dc160404fcd
SHA198cb76bf5749d75528752ca731e550c777b9807d
SHA25694de9ee454027f9522731eaadee9b559aff78f1e4d2d2a8e9d1c8ea34c305bba
SHA512ded224193b2fbaf4b90df7dc2735241b456db0ab00257e543553470b140406f57c03fc8221d22ed06bee491dd42c1513cc8b72a754821ac0b92d072d525cb9af
-
Filesize
5.2MB
MD51e9c400510166734b0eda18f1425a366
SHA1fb714b05a18750f908734aa68622d8d4a583c81c
SHA256c69c3eee070e71b8e643a2d00768b52bd7baef00467120b4392b3c067d3c3cde
SHA5122db1bc5824d0635abc2de85799106dec4465db90e3bf5cce110d20471161a5e3a9558ad4e5e33bf392eccdc8e485513bac6a2d4ca47024e52ec0a67701a5ea7d
-
Filesize
5.2MB
MD59d01036fda44fa638f91f376b10b505c
SHA18b43d67db9459a15ac2d7dc0cd520a73972a0a1d
SHA25629601364a22cb800ea184f0c0f81cf959126e37c38aa3a8c8e1d2e1e5558088c
SHA512e48566cc0de02bd3f8d11b50c49fcb0bef22c08e33e1bd1d5cfca9d47e065f3d2dc69c0f68c0eb71a7bf09f218253ef3fc76b84471f069df30e6d8d4ac9bb085
-
Filesize
5.2MB
MD5dc234263296e5f062d9a08f5cea0613f
SHA1361a8626b797a33c0491a143d9621d58f37c1b72
SHA2566dc2cf9dd01f39e14009edea58167587a8c05e45d0e3d2855828fc8fdb833d31
SHA512f240c7ff120dc14d27a65bc42153aa96339fc2f555fbfdb72f732d911743c8d2086f2aad4bdeca95d59039cf6e249dfde82911b47165562c876167b056bf28b9
-
Filesize
5.2MB
MD5675a5b7c2830d2016ff3aa1764e8c11c
SHA1c10611ec494f6ff3120795c12815f6a2dd8a08f7
SHA256c68ab74228e48ab3bf1ecdbaae2a57e41e62592774fc123f542ba6ea471de26e
SHA512c3413665cf77a70786eb5bafe3e71080faafb21a39cde0c449fbaa7dcbea4fda2237d4c3154dce8ce2f687f4382e727b9d43c1523bbeba49cf5b8bbfb996cdf0
-
Filesize
5.2MB
MD52eddc8a0904ceb2b111e53334cd5fef7
SHA1be6ad2ce79e4f7bc3484d707f28c010aadd8cfaf
SHA25666a84af466d021e1fc60209c77c0f0743624b445c2d091322d19e448539461c8
SHA5125b64d2cfae558d5a38219988d37593d920275579bca564832ef7ac2c9b42a171865a078e356defc7db5712cc9a3069d35bbf0dad4e51916f3a051f3c4e2b80a6
-
Filesize
5.2MB
MD59e4d4c0fed5c9c1779fff7b989901ea4
SHA19d15616158a2c28300be8b95ce48f9797d09dbc3
SHA2567b8ef42840ceddb0024556afdc824a8d3ca20dc7a3f569d6b7533375c40fc6db
SHA512db27cc0c2a85e7f9175b7ac83f4d5f09d5c316215bec36b54940817eb93f22f65fded72442685f33071b2a20a6f167bf72748c9c07d5445f95a828c6d16a9a89
-
Filesize
5.2MB
MD5c47ca28c516e820af07614f695ceb0b4
SHA13cea5cbc48588c8fb89ae8554dd342917a4e4ea2
SHA25658f5463e2d72934f0a26b79a6d6770eea8f20db8b754b1321d3d38cc04b6e37f
SHA512b49d33e28d4d896f41d24acfb23ebdf6a1d33d1a84fc4ef1a52d742ba35c4004dbd03a23d91c34aff542d3908e8770449398793c520f06f36c044fb537e0c0dc
-
Filesize
5.2MB
MD5103e3acdc0710c0bfd2af6cb2df5bfe8
SHA12b726f100c4166a9845ffc53f456b23e80886746
SHA2566ea0e48ad5c60282b48e15079e90b168a8a7c25f9876397d736d9a6fe5f4ccb3
SHA51239902061043bb33ae524547bda6ce154ae80a79e4ed72a3d87481af95a33fd8078c400e6d6ea03db26fc3db41994b1a9976206af44ce176c83ecf319ac79a989
-
Filesize
5.2MB
MD5472a8f2d3a475ca6592fc2b549816ade
SHA1b980fc016a06d03e3a604b91bc01d046f3860a3e
SHA256bab2c862f7c6ba55d838124ff32983ad10b0dc4d5bb7547af58eecf4cc9638c7
SHA51224eb498cc6ee5aab629608ec0ec71117f786778dfe9410ceb9e9978e134fe66859adbc0adaffd87a55a83c4082a6688a97c8dfff18d5ef4273072046f4a7549d
-
Filesize
5.2MB
MD518d906592e992258e08e7a2b7f4c8be7
SHA1b0da766d526f3658adcb24835317adaa49655dbf
SHA256736418a8afec1afcc74d4f76320d3e01c179e2e4e645be13886434b7300ece35
SHA512c23357e61c53f69ddb82f1eaf8f90e21a191f89e89e9daa8a1031ed025684f2163495ace89b0b61c99ddfea54c4a0c80171852c472e4db7c8bfa5759fe3b74ea
-
Filesize
5.2MB
MD563e316444773dfb1a6ff8b49957a025d
SHA133a68f08880888d8351152bbf592582d85773b0b
SHA256dc8fa22252be0d19d25ea481007bdb341441f00c605242e518037509986455c6
SHA5123c944e01f4ff26d3b89066567b104d7557b9a281ca30abea3a6e5e598ccfad4e94ca7865ef88189766441e1588fef63f67540f9ae5ccd6bfcb89dc8c07c32818
-
Filesize
5.2MB
MD508c72236bed460ac8cd09709434fafe5
SHA1674904e7e554d30707958d6e9338953d449dde91
SHA256f3ea8dcca94348762d09850efced6e72a8b45f8ec5561d7236edceb4ed29084b
SHA512498312428088b1c82c50a0b92e5b0332ca02ffe2d705bbe2318b7caa4f727af568369b2202335fe80d26de721b3e74801ab0fde779743439852cf1cd8471e0c5
-
Filesize
5.2MB
MD5d9dfb5bb41b69226774a7a3fef4c4d2e
SHA1eb6afe6f32611439fcc6c5cff7a02789921b6a6d
SHA2565e9b2e4f785379571283ceb20d51b8f2220299487bbbf4f3111ef56c49b04478
SHA5125539dda3bfc0ff9108bc7ca16ad0780f8960f09c5b6104147035f444d06dab92802c633e6f0129710e70ff960cc8408cbe790fe0861f2eea6ab1735aa14b6f93
-
Filesize
5.2MB
MD5331d810ec74e166603b7a77731ea8041
SHA1c275bded47d8a1ecfe7a5ffd987d540875d191b7
SHA256e33203f4390f3adf1162bdedb6c95b5397a4cb400ca45562b2d203ac9102fadf
SHA5121d84f2bc90fd6768caf315d1433017f8430e4ca5031e6b02f7be83e4fec8636dae2aeb342fde0d59017bda8843eef255cd91d46eb34de754b11bc129e031e717
-
Filesize
5.2MB
MD51e2fcb05e25cac2e4665dd642dd68917
SHA1db949eaaa7992b6c950c15eccfb28d660f95a857
SHA256cc59411462db1a7c6b1b96507008cc0d30705daa6853cc7450c8c9be06313c2a
SHA5128d6ca939420e7229a5c7a6460a72ed1a68ad2bd37663a37d2e61ed01a02152b8caea0f7616f0e5f09fba198ec0f1c7009d5a85c8a6548d94b80d65c355774412
-
Filesize
5.2MB
MD5abc3356e56390a8269fdca5f5c3fd711
SHA1849ff778a6da6d7d3c484eae3de147633d2e8b1f
SHA256a74b9981e6cc217e02dee0e8515849f7db96f89ebbffb7553b14bbbbd5aa6321
SHA5124a6ea22cb053a911f54bbf270e3d7ddbf4cb48bd9a44046ef11ff7a0e86614fe90000016524524185d75a7ffc4a67cfd2dd7896b70c115404d19770117a3281d
-
Filesize
5.2MB
MD52bf10ed246d3a29b7d07abeab5d34aab
SHA195bdc94e1dfde4f2167f34921f53da5ab450f0ce
SHA256fe34d913193c08cd0355f83043916c2aaed32f0645e651549fc6a3e16147ef6b
SHA512f555d5a86c05cee72d0ac8447c58bcffa01368ee5fbacfcdc2aaba465bc34afd9b1885468ff0768c326803d75282aaab3c48da64eb8dc2a8f87dc87dbfd02f34
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB