Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 17:57
Static task
static1
Behavioral task
behavioral1
Sample
3ab010513c45199eb874a9daa5a22ebd.exe
Resource
win7-20231215-en
General
-
Target
3ab010513c45199eb874a9daa5a22ebd.exe
-
Size
1.6MB
-
MD5
3ab010513c45199eb874a9daa5a22ebd
-
SHA1
cc2f2376daad7149c928f8337dcada7c69ff279a
-
SHA256
e48755b7b59f5e3c2675d2de1c8b0333931cc8d642585aa4af06c18209538569
-
SHA512
fafcd8b6fbb2dcc7b114db19387234ebbc30a1b6c3bda9959371d113cb8960efec7a0dec14a0ff17ec43c1ae0a3f3b8d868cbd8a3341a8f5e880baf45717dcb7
-
SSDEEP
49152:f/fwUdoP8/QnXQLqs4CEgHhAWkf6tvk4TXXra:fwUdd/0ALq+O6tch
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2516 cookieman.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3ab010513c45199eb874a9daa5a22ebd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3ab010513c45199eb874a9daa5a22ebd.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main 3ab010513c45199eb874a9daa5a22ebd.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2328 3ab010513c45199eb874a9daa5a22ebd.exe 2328 3ab010513c45199eb874a9daa5a22ebd.exe 2592 3ab010513c45199eb874a9daa5a22ebd.exe 2592 3ab010513c45199eb874a9daa5a22ebd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2592 3ab010513c45199eb874a9daa5a22ebd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2592 3ab010513c45199eb874a9daa5a22ebd.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2592 3ab010513c45199eb874a9daa5a22ebd.exe 2592 3ab010513c45199eb874a9daa5a22ebd.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2592 2328 3ab010513c45199eb874a9daa5a22ebd.exe 28 PID 2328 wrote to memory of 2592 2328 3ab010513c45199eb874a9daa5a22ebd.exe 28 PID 2328 wrote to memory of 2592 2328 3ab010513c45199eb874a9daa5a22ebd.exe 28 PID 2328 wrote to memory of 2592 2328 3ab010513c45199eb874a9daa5a22ebd.exe 28 PID 2328 wrote to memory of 2592 2328 3ab010513c45199eb874a9daa5a22ebd.exe 28 PID 2328 wrote to memory of 2592 2328 3ab010513c45199eb874a9daa5a22ebd.exe 28 PID 2328 wrote to memory of 2592 2328 3ab010513c45199eb874a9daa5a22ebd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ab010513c45199eb874a9daa5a22ebd.exe"C:\Users\Admin\AppData\Local\Temp\3ab010513c45199eb874a9daa5a22ebd.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3ab010513c45199eb874a9daa5a22ebd.exe"C:\Users\Admin\AppData\Local\Temp\3ab010513c45199eb874a9daa5a22ebd.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_1630f1f10"2⤵
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2592 -
C:\Users\Admin\AppData\LocalLow\cookieman.exe"C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com3⤵
- Executes dropped EXE
PID:2516
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34B
MD53f4519b56cb1e006dfe4341e72112913
SHA10ff5675d359c898b6a6bdc1dff10f71097bc9927
SHA256125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2
SHA51278c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40
-
Filesize
45KB
MD5e7abfa4ef85624e68a312ac0f8c7ab80
SHA1a6e5d5ce0e18f105b47f3fd3233ca7fc0617cef3
SHA2562a847efb0b92366bc794198254e3fe62ba2da42ff93bec5154879d89385bff4d
SHA5124dfc5e95f88d0241a2a3c3d42b6dc487c78cb185bed0ca559761721fa02e0fec83a5196df36dc5e95d0bc95ffc845a202d05acf5ff26d0a581eff5afe6b5d4e3
-
Filesize
148B
MD5c94d1e011e86788feaa18f88eb9c3fd8
SHA1e33ef37626380637320af83b494edc4e0ea88e96
SHA256c2d1c09d239baa93fc5844ec7cf43613f83a112dacd1156daf79ae8a957161a4
SHA5126f23867cd78e219b10b340550b0d6687760d085548363911017be7c4ba1d0872d0f1128bb428889d420a5fb52e1533a2a287134604fdb25602bb04cb7afc6cf7
-
Filesize
798B
MD51d45a29e3511b982a1f91b33c70e964f
SHA1176a47b489be3f27dc354a2b9dd0b580bb2f3904
SHA2560a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc
SHA512c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69