7019fee3f5f3839fac98792df9c74d396821746688eec23197eb92520f503446

General

Target

4c04bd1f1b7ee9c153b07a7328ba087d.exe
Size

1.6MB
MD5

4c04bd1f1b7ee9c153b07a7328ba087d
SHA1

fdf87dee3999d2c1472ac430890a1f71bf224606
SHA256

7019fee3f5f3839fac98792df9c74d396821746688eec23197eb92520f503446
SHA512

a4da4637935bc21abdfff1a0d5624ba39cb94b9d960c873081e03e849693a00cfe49f12fc8a6160a6f55e61eb1698553474bbe0cc12b3ab27dea0fa1d9be7737
SSDEEP

49152:x/fwUdoP8/QnXQLqs4CEgHhAWkf6tvk4TXbr7:xwUdd/0ALq+O6tc4

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2568	cookieman.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4c04bd1f1b7ee9c153b07a7328ba087d.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	4c04bd1f1b7ee9c153b07a7328ba087d.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main	4c04bd1f1b7ee9c153b07a7328ba087d.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2076	4c04bd1f1b7ee9c153b07a7328ba087d.exe
2076	4c04bd1f1b7ee9c153b07a7328ba087d.exe
3032	4c04bd1f1b7ee9c153b07a7328ba087d.exe
3032	4c04bd1f1b7ee9c153b07a7328ba087d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3032	4c04bd1f1b7ee9c153b07a7328ba087d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3032	4c04bd1f1b7ee9c153b07a7328ba087d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3032	4c04bd1f1b7ee9c153b07a7328ba087d.exe
3032	4c04bd1f1b7ee9c153b07a7328ba087d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 3032	2076	4c04bd1f1b7ee9c153b07a7328ba087d.exe	28
PID 2076 wrote to memory of 3032	2076	4c04bd1f1b7ee9c153b07a7328ba087d.exe	28
PID 2076 wrote to memory of 3032	2076	4c04bd1f1b7ee9c153b07a7328ba087d.exe	28
PID 2076 wrote to memory of 3032	2076	4c04bd1f1b7ee9c153b07a7328ba087d.exe	28
PID 2076 wrote to memory of 3032	2076	4c04bd1f1b7ee9c153b07a7328ba087d.exe	28
PID 2076 wrote to memory of 3032	2076	4c04bd1f1b7ee9c153b07a7328ba087d.exe	28
PID 2076 wrote to memory of 3032	2076	4c04bd1f1b7ee9c153b07a7328ba087d.exe	28

C:\Users\Admin\AppData\Local\Temp\4c04bd1f1b7ee9c153b07a7328ba087d.exe
"C:\Users\Admin\AppData\Local\Temp\4c04bd1f1b7ee9c153b07a7328ba087d.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Users\Admin\AppData\Local\Temp\4c04bd1f1b7ee9c153b07a7328ba087d.exe
  "C:\Users\Admin\AppData\Local\Temp\4c04bd1f1b7ee9c153b07a7328ba087d.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_4a27b70"
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3032
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
45KB

MD5
e7abfa4ef85624e68a312ac0f8c7ab80

SHA1
a6e5d5ce0e18f105b47f3fd3233ca7fc0617cef3

SHA256
2a847efb0b92366bc794198254e3fe62ba2da42ff93bec5154879d89385bff4d

SHA512
4dfc5e95f88d0241a2a3c3d42b6dc487c78cb185bed0ca559761721fa02e0fec83a5196df36dc5e95d0bc95ffc845a202d05acf5ff26d0a581eff5afe6b5d4e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_4a27b70\autorun.txt

Filesize
126B

MD5
c9bcb14f4c82daaa740854bf474568f7

SHA1
1c874613c2a378366cd904242ae50deed1349189

SHA256
f3fe6e4b0bbf3bfa81f6cf456f8939dddbc69d9db0b369c6cd35eb3be042e17a

SHA512
2a89b72007028d8574dc6fd4872e0f1d5e011fd068e7844783af28a8aea2ae148d80cf0a0242e56e2daa74f1267e20bbcb5b1bb408c68cf96dcfa5741b3dbd92

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_4a27b70\wrapper.xml

Filesize
798B

MD5
1d45a29e3511b982a1f91b33c70e964f

SHA1
176a47b489be3f27dc354a2b9dd0b580bb2f3904

SHA256
0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

SHA512
c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

Download Submit

Analysis

Sharing