6a807a257d3dc1235e0df5b60527f6a932f153139e6d29a702c0d52f9e0fe01d

Analysis

max time kernel
0s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cb8a3a239b2e45cee157c62b10a9176.exe
Size

1.6MB
MD5

3cb8a3a239b2e45cee157c62b10a9176
SHA1

676267996139dfd165a5cdb8522b86180c3d724c
SHA256

6a807a257d3dc1235e0df5b60527f6a932f153139e6d29a702c0d52f9e0fe01d
SHA512

7790814c988986c201680cc769eb26f7329de2ff0ae47ac1550d768a641ef5100d59e52f5c3fc6454b9aa870c3302c8140a55ef079cfb95e502507f5eb79c36d
SSDEEP

49152:6/fwUdLfGiPTStHxNtKgEAhK1kfqtOZ2TwqrB:6wUdCi7KHs19tc+

Score

7^/10

evasion trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2492	cookieman.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3cb8a3a239b2e45cee157c62b10a9176.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	3cb8a3a239b2e45cee157c62b10a9176.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3024	3cb8a3a239b2e45cee157c62b10a9176.exe
3024	3cb8a3a239b2e45cee157c62b10a9176.exe
2720	3cb8a3a239b2e45cee157c62b10a9176.exe
2720	3cb8a3a239b2e45cee157c62b10a9176.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2720	3cb8a3a239b2e45cee157c62b10a9176.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	3cb8a3a239b2e45cee157c62b10a9176.exe
2720	3cb8a3a239b2e45cee157c62b10a9176.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2720	3024	3cb8a3a239b2e45cee157c62b10a9176.exe	16
PID 3024 wrote to memory of 2720	3024	3cb8a3a239b2e45cee157c62b10a9176.exe	16
PID 3024 wrote to memory of 2720	3024	3cb8a3a239b2e45cee157c62b10a9176.exe	16
PID 3024 wrote to memory of 2720	3024	3cb8a3a239b2e45cee157c62b10a9176.exe	16
PID 3024 wrote to memory of 2720	3024	3cb8a3a239b2e45cee157c62b10a9176.exe	16
PID 3024 wrote to memory of 2720	3024	3cb8a3a239b2e45cee157c62b10a9176.exe	16
PID 3024 wrote to memory of 2720	3024	3cb8a3a239b2e45cee157c62b10a9176.exe	16

C:\Users\Admin\AppData\Local\Temp\3cb8a3a239b2e45cee157c62b10a9176.exe
"C:\Users\Admin\AppData\Local\Temp\3cb8a3a239b2e45cee157c62b10a9176.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_141a315b0"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2720
- C:\Users\Admin\AppData\LocalLow\cookieman.exe
  "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
  2⤵
  - Executes dropped EXE
  PID:2492

C:\Users\Admin\AppData\Local\Temp\3cb8a3a239b2e45cee157c62b10a9176.exe
"C:\Users\Admin\AppData\Local\Temp\3cb8a3a239b2e45cee157c62b10a9176.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
45KB

MD5
1955f02140bc0b5b3d2cc3e8a75c79d9

SHA1
63acbf7cfa395f19f2f4d15053886f2107f83d20

SHA256
314fdbdd91df43b2c9c6e94eaecad160e400c730c57e879d93dc0cc905cb2d90

SHA512
c2c32b0d2a3a4e46a26396c9cf3b4a2ba6de753a1bb5d1535a2b00f6eeba751dc4b8ec9568e23b28b8ac01b91ae3922844f7c44f875f90a9263962e1c988a3b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_141a315b0\autorun.txt

Filesize
116B

MD5
6c9c56848695ed674546599878fec162

SHA1
a2fde33dd5fc992091d48ef06329b86147f82123

SHA256
4c959f1236afeb4eee89d416ad133ee2c366b07caaa63eb1acaf8856fa11e37e

SHA512
f9958c3334047c97326c7023f334b4168751257da917deb4e587dae84088a20e1cb26137b3433a99c0325c1f78e838804042085878b111ce656a65cdbef0f5a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_141a315b0\wrapper.xml

Filesize
798B

MD5
1d45a29e3511b982a1f91b33c70e964f

SHA1
176a47b489be3f27dc354a2b9dd0b580bb2f3904

SHA256
0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

SHA512
c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

Download Submit