Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2024, 01:12

General

  • Target

    66829eff38c8ffccd321ddfdc8b33a1e.exe

  • Size

    1.5MB

  • MD5

    66829eff38c8ffccd321ddfdc8b33a1e

  • SHA1

    867ac5e250fc06a9f6964170e077ea40ed8f5f72

  • SHA256

    2fc9c826723fc0e847ab8cdad9686b48d8c291397264ac5ee9bef2805cca37a5

  • SHA512

    10d06c7336162b91df7cf67a0665ac35dfd993c4d4f4ec7871b93bbd9e3aa27dcbced328f29719222f75f125498e3e344132bf46ba50a99ce551ff83e0e984ab

  • SSDEEP

    24576:t2RtsxfT5Ecc6hwjZhWlkPzYiPnoIs9WoyZpGeWJkRUndufH5NTQ9ljnOAJI6g:0kfTNEfWlQzBPnoIs9WoynWaaAfXTYlK

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe
    "C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe
      "C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_223627f0"
      2⤵
      • Checks whether UAC is enabled
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2544
      • C:\Users\Admin\AppData\LocalLow\cookieman.exe
        "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
        3⤵
        • Executes dropped EXE
        PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\cookie.ini

    Filesize

    34B

    MD5

    3f4519b56cb1e006dfe4341e72112913

    SHA1

    0ff5675d359c898b6a6bdc1dff10f71097bc9927

    SHA256

    125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

    SHA512

    78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

  • C:\Users\Admin\AppData\LocalLow\cookieman.exe

    Filesize

    45KB

    MD5

    3e382f6385bf86f976aecc9c2c3c6552

    SHA1

    d8c658bc164cb8bce72e5cca0597406841105685

    SHA256

    f2327ccb290c23f00af6555afc7f1c2855ef599ae387022a7f785d6cb47fceae

    SHA512

    656ee17c403d6aef18faad8eff0e4c305cb0f18ac22fe55b5b6b3400a560f45445f5fe0f21140ee36fb0de6cbe9abb3185a3c2caf0cbafd4d0bcdbf9ae20396b

  • C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\66829eff38c8ffccd321ddfdc8b33a1e.log

    Filesize

    10KB

    MD5

    1f381c4c6affb0a6773c99718339372c

    SHA1

    58fb4138f6a09c8f22557260093fd49725b122da

    SHA256

    d2a1b80b6eb84e45e05a428b0e0468719515a75b3389c3fae5bfcf49e4bf8dc5

    SHA512

    58dd92bc40b2992a55a0079d65b3e2e486127d7bb4df9ce1b1bac587d42e6db481c8b2c1f5a20a7d5fdcb4a978a3e0bc1b592a11b375a39d5f4f0092c034c77d

  • C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\autorun.txt

    Filesize

    278B

    MD5

    9b6c004dfeefaed424318580a790a2bd

    SHA1

    07f2d026bf55d3c25902d570741b0c183b6df73d

    SHA256

    983389374c9d4e12c57f9fd96f12242c9ed0844f5dae0e547a7b2ec0b658e465

    SHA512

    8ccf4c0d83755899a8b13faa025b009d4f676dd15c899b1209e96cac238bbee33f6cc34fa4827f24080a9bbcd64b6352aa2b6fb4c9177a88bc7f9344bc81ef69

  • C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\detectionrules.dat

    Filesize

    1KB

    MD5

    c2afd72ff80f037691356ec69a5ccf3d

    SHA1

    4331802328684172600e2a4cdbf90b69973340b6

    SHA256

    9e883722d9fff021b9d47340d01efdd000406cc8e5e8fd07d8d716012aac1e74

    SHA512

    ad8e2d7fb6da88a44acba970debc63923f4ae159b94bcc70b99eb32a21fdd52eaa83ecf057b8fcd785175af881600876579a09c053bc71fdedd374aa3f5cb86b

  • C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\postbackresponse.dat

    Filesize

    1KB

    MD5

    7e316044e1eb5ec301520109944deff6

    SHA1

    74788b5df4a790a8540f19e21ce0f1c3d2b99776

    SHA256

    792656c39ed22c508a7372cd191a738afd6828ec6e2b4573ff83f93dc41e1720

    SHA512

    a10e2319e6801a43a3b8fdc43612cf4807eb43a670adb8eccb576a06cd85f58e66429915cc172c21b360b827c62362bd200e6c71a2d50f673380159174152fe5

  • C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\stubinfo.ini

    Filesize

    62B

    MD5

    534805b650fcccfb6c3429305f30581f

    SHA1

    b759da4ceb80c79ba1e50a28e1602714d10e9c23

    SHA256

    432b1417e125442aae2e867d54ab1fcf2f92ebd4f7a44ac99d2b22061145f6e4

    SHA512

    b9f760cdcf4d3df24c32f879473cb61068aa60d0078d68a8352212a3ee233baa0ab3bb86814f923078f279b73a1e5838c68f994fdf071635387c00db2782d876

  • C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\timings.txt

    Filesize

    386B

    MD5

    afc8de277154ce553a4f8cbdde2e8f7e

    SHA1

    c1a640662228ba967ce3d631a5bb54aa88bdf3fc

    SHA256

    d1911734243cd32ec2f5b38d9da17d7d120049d68db64fc6e93495063074497a

    SHA512

    178b919860d14669817c6404748e7a005f510962c464f6ded239d4526b8cb6b7926faf4e06f378c1a43990c1272be9f313cd2a262d682de7f937945f7c31814b

  • C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\wrapper.xml

    Filesize

    666B

    MD5

    11e86fc67f1a0c0b055debfa85d59412

    SHA1

    8fff11073fe0418bdb39a382fd2d0be92d5c426c

    SHA256

    cc8bf3bd83b3043c23f9ec7bf37215e65b6e48652441ff849ab50efe2923bec0

    SHA512

    f4d0becba3d00ba365651dfda6a1cd5556e47f8cfa683afc07da398aac6f36941bc2e9e3128f7f6c3827c3129b501de767fcd9da63bbd885591c1c1ef9827ed1