Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 10:10
Behavioral task
behavioral1
Sample
2025-01-22_6c6405ebe02109667f5d8349f13f68d0_cobalt-strike_cobaltstrike_poet-rat.exe
Resource
win7-20241010-en
4 signatures
150 seconds
General
-
Target
2025-01-22_6c6405ebe02109667f5d8349f13f68d0_cobalt-strike_cobaltstrike_poet-rat.exe
-
Size
5.7MB
-
MD5
6c6405ebe02109667f5d8349f13f68d0
-
SHA1
1ceacb478d7ba31c18e768f149cf53520d7c7cee
-
SHA256
558043f62baeaee3698091ffb616b67179a59d90e8c9a3292dae4adf62fb8f72
-
SHA512
9bbd83df5a6d9ab288b0a444c4392717581eede485adbb1e4479cb708455767049f683119dbd979090d342670cfdf7a9e3963c1c1c70b9a83a564b6a17621d64
-
SSDEEP
98304:4emTLkNdfE0pZaJ56utgpPFotBER/mQ32lUa:j+R56utgpPF8u/7a
Malware Config
Signatures
-
Xmrig family
-
XMRig Miner payload 1 IoCs
resource yara_rule behavioral1/memory/2760-0-0x000000013F530000-0x000000013F87D000-memory.dmp xmrig -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 2760 2025-01-22_6c6405ebe02109667f5d8349f13f68d0_cobalt-strike_cobaltstrike_poet-rat.exe Token: SeLockMemoryPrivilege 2760 2025-01-22_6c6405ebe02109667f5d8349f13f68d0_cobalt-strike_cobaltstrike_poet-rat.exe