79decf032c1467047c31d4d876180a6e54112751fe25fc503cbd11eed6fa248e

General

Target

657c76db82bd813d34b849253ced80ad.exe
Size

1.6MB
MD5

657c76db82bd813d34b849253ced80ad
SHA1

51bb0ea8bd01e7ba06b4284ab63d9cea4b4fee31
SHA256

79decf032c1467047c31d4d876180a6e54112751fe25fc503cbd11eed6fa248e
SHA512

d4e5af80f40db5e0318066c6eb248ca47af6191e98b5aee4d69be53fe0db7c6ff049f78f22dc7742eefe31ad3199c169e2b1847d3199ccd49232071ebe29f065
SSDEEP

49152:5Hf9VQRRqvelYDVPddMgGuL83/YfTqIrY:5lVSgdDJM3wW

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2556	cookieman.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	657c76db82bd813d34b849253ced80ad.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	657c76db82bd813d34b849253ced80ad.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main	657c76db82bd813d34b849253ced80ad.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2156	657c76db82bd813d34b849253ced80ad.exe
2156	657c76db82bd813d34b849253ced80ad.exe
2672	657c76db82bd813d34b849253ced80ad.exe
2672	657c76db82bd813d34b849253ced80ad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2672	657c76db82bd813d34b849253ced80ad.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2672	657c76db82bd813d34b849253ced80ad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2672	657c76db82bd813d34b849253ced80ad.exe
2672	657c76db82bd813d34b849253ced80ad.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2672	2156	657c76db82bd813d34b849253ced80ad.exe	28
PID 2156 wrote to memory of 2672	2156	657c76db82bd813d34b849253ced80ad.exe	28
PID 2156 wrote to memory of 2672	2156	657c76db82bd813d34b849253ced80ad.exe	28
PID 2156 wrote to memory of 2672	2156	657c76db82bd813d34b849253ced80ad.exe	28
PID 2156 wrote to memory of 2672	2156	657c76db82bd813d34b849253ced80ad.exe	28
PID 2156 wrote to memory of 2672	2156	657c76db82bd813d34b849253ced80ad.exe	28
PID 2156 wrote to memory of 2672	2156	657c76db82bd813d34b849253ced80ad.exe	28

C:\Users\Admin\AppData\Local\Temp\657c76db82bd813d34b849253ced80ad.exe
"C:\Users\Admin\AppData\Local\Temp\657c76db82bd813d34b849253ced80ad.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\657c76db82bd813d34b849253ced80ad.exe
  "C:\Users\Admin\AppData\Local\Temp\657c76db82bd813d34b849253ced80ad.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_10171c480"
  2⤵
  - Checks whether UAC is enabled
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2672
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
45KB

MD5
28c165cda14cf5ec5234fc69000a970e

SHA1
0677b2812b3713ca2f19b69001012e0c2a6edfec

SHA256
d07547c1bc6fe15dfe850e28225b84f3b8f83bd6d7d89ed1d1718b0df979926b

SHA512
ef06fc9c8b160f8a13f550e55eb0a536465c0ca03573257fdd3b168a607ed52b946e770b441da76f4f7a5063c23e6ba7d0bdede513c0a6dcbabfd7f604d1f7a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_10171c480\autorun.txt

Filesize
107B

MD5
eb7c181b277d2b4297b731527466956d

SHA1
7ee9ecaf0f4a1c9f06047048283ff767cad486bc

SHA256
d220c3065fb7f0162e725b54807c0f7e68103c2b759e4ef607c285527be21dc8

SHA512
cbd1c1e8a1c2d21b671a9f5e861d499ef75997e205c406d506cfab07f2b08522d37ef751e265690ab6a4c31c8808a70cea8b97d5c1cdacca07c6f2d3f232b32c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_10171c480\wrapper.xml

Filesize
798B

MD5
1d45a29e3511b982a1f91b33c70e964f

SHA1
176a47b489be3f27dc354a2b9dd0b580bb2f3904

SHA256
0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc

SHA512
c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69

Download Submit

Analysis

Sharing