Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 02:15
Static task
static1
Behavioral task
behavioral1
Sample
4c04bd1f1b7ee9c153b07a7328ba087d.exe
Resource
win7-20231215-en
General
-
Target
4c04bd1f1b7ee9c153b07a7328ba087d.exe
-
Size
1.6MB
-
MD5
4c04bd1f1b7ee9c153b07a7328ba087d
-
SHA1
fdf87dee3999d2c1472ac430890a1f71bf224606
-
SHA256
7019fee3f5f3839fac98792df9c74d396821746688eec23197eb92520f503446
-
SHA512
a4da4637935bc21abdfff1a0d5624ba39cb94b9d960c873081e03e849693a00cfe49f12fc8a6160a6f55e61eb1698553474bbe0cc12b3ab27dea0fa1d9be7737
-
SSDEEP
49152:x/fwUdoP8/QnXQLqs4CEgHhAWkf6tvk4TXbr7:xwUdd/0ALq+O6tc4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2568 cookieman.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4c04bd1f1b7ee9c153b07a7328ba087d.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4c04bd1f1b7ee9c153b07a7328ba087d.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main 4c04bd1f1b7ee9c153b07a7328ba087d.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2076 4c04bd1f1b7ee9c153b07a7328ba087d.exe 2076 4c04bd1f1b7ee9c153b07a7328ba087d.exe 3032 4c04bd1f1b7ee9c153b07a7328ba087d.exe 3032 4c04bd1f1b7ee9c153b07a7328ba087d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 4c04bd1f1b7ee9c153b07a7328ba087d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3032 4c04bd1f1b7ee9c153b07a7328ba087d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3032 4c04bd1f1b7ee9c153b07a7328ba087d.exe 3032 4c04bd1f1b7ee9c153b07a7328ba087d.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2076 wrote to memory of 3032 2076 4c04bd1f1b7ee9c153b07a7328ba087d.exe 28 PID 2076 wrote to memory of 3032 2076 4c04bd1f1b7ee9c153b07a7328ba087d.exe 28 PID 2076 wrote to memory of 3032 2076 4c04bd1f1b7ee9c153b07a7328ba087d.exe 28 PID 2076 wrote to memory of 3032 2076 4c04bd1f1b7ee9c153b07a7328ba087d.exe 28 PID 2076 wrote to memory of 3032 2076 4c04bd1f1b7ee9c153b07a7328ba087d.exe 28 PID 2076 wrote to memory of 3032 2076 4c04bd1f1b7ee9c153b07a7328ba087d.exe 28 PID 2076 wrote to memory of 3032 2076 4c04bd1f1b7ee9c153b07a7328ba087d.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c04bd1f1b7ee9c153b07a7328ba087d.exe"C:\Users\Admin\AppData\Local\Temp\4c04bd1f1b7ee9c153b07a7328ba087d.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\4c04bd1f1b7ee9c153b07a7328ba087d.exe"C:\Users\Admin\AppData\Local\Temp\4c04bd1f1b7ee9c153b07a7328ba087d.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_4a27b70"2⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3032 -
C:\Users\Admin\AppData\LocalLow\cookieman.exe"C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com3⤵
- Executes dropped EXE
PID:2568
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34B
MD53f4519b56cb1e006dfe4341e72112913
SHA10ff5675d359c898b6a6bdc1dff10f71097bc9927
SHA256125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2
SHA51278c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40
-
Filesize
45KB
MD5e7abfa4ef85624e68a312ac0f8c7ab80
SHA1a6e5d5ce0e18f105b47f3fd3233ca7fc0617cef3
SHA2562a847efb0b92366bc794198254e3fe62ba2da42ff93bec5154879d89385bff4d
SHA5124dfc5e95f88d0241a2a3c3d42b6dc487c78cb185bed0ca559761721fa02e0fec83a5196df36dc5e95d0bc95ffc845a202d05acf5ff26d0a581eff5afe6b5d4e3
-
Filesize
126B
MD5c9bcb14f4c82daaa740854bf474568f7
SHA11c874613c2a378366cd904242ae50deed1349189
SHA256f3fe6e4b0bbf3bfa81f6cf456f8939dddbc69d9db0b369c6cd35eb3be042e17a
SHA5122a89b72007028d8574dc6fd4872e0f1d5e011fd068e7844783af28a8aea2ae148d80cf0a0242e56e2daa74f1267e20bbcb5b1bb408c68cf96dcfa5741b3dbd92
-
Filesize
798B
MD51d45a29e3511b982a1f91b33c70e964f
SHA1176a47b489be3f27dc354a2b9dd0b580bb2f3904
SHA2560a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc
SHA512c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69