Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 01:12
Static task
static1
Behavioral task
behavioral1
Sample
66829eff38c8ffccd321ddfdc8b33a1e.exe
Resource
win7-20231215-en
General
-
Target
66829eff38c8ffccd321ddfdc8b33a1e.exe
-
Size
1.5MB
-
MD5
66829eff38c8ffccd321ddfdc8b33a1e
-
SHA1
867ac5e250fc06a9f6964170e077ea40ed8f5f72
-
SHA256
2fc9c826723fc0e847ab8cdad9686b48d8c291397264ac5ee9bef2805cca37a5
-
SHA512
10d06c7336162b91df7cf67a0665ac35dfd993c4d4f4ec7871b93bbd9e3aa27dcbced328f29719222f75f125498e3e344132bf46ba50a99ce551ff83e0e984ab
-
SSDEEP
24576:t2RtsxfT5Ecc6hwjZhWlkPzYiPnoIs9WoyZpGeWJkRUndufH5NTQ9ljnOAJI6g:0kfTNEfWlQzBPnoIs9WoynWaaAfXTYlK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2572 cookieman.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 66829eff38c8ffccd321ddfdc8b33a1e.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 66829eff38c8ffccd321ddfdc8b33a1e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2440 66829eff38c8ffccd321ddfdc8b33a1e.exe 2440 66829eff38c8ffccd321ddfdc8b33a1e.exe 2544 66829eff38c8ffccd321ddfdc8b33a1e.exe 2544 66829eff38c8ffccd321ddfdc8b33a1e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2544 66829eff38c8ffccd321ddfdc8b33a1e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2544 2440 66829eff38c8ffccd321ddfdc8b33a1e.exe 27 PID 2440 wrote to memory of 2544 2440 66829eff38c8ffccd321ddfdc8b33a1e.exe 27 PID 2440 wrote to memory of 2544 2440 66829eff38c8ffccd321ddfdc8b33a1e.exe 27 PID 2440 wrote to memory of 2544 2440 66829eff38c8ffccd321ddfdc8b33a1e.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe"C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe"C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_223627f0"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2544 -
C:\Users\Admin\AppData\LocalLow\cookieman.exe"C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com3⤵
- Executes dropped EXE
PID:2572
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34B
MD53f4519b56cb1e006dfe4341e72112913
SHA10ff5675d359c898b6a6bdc1dff10f71097bc9927
SHA256125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2
SHA51278c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40
-
Filesize
45KB
MD53e382f6385bf86f976aecc9c2c3c6552
SHA1d8c658bc164cb8bce72e5cca0597406841105685
SHA256f2327ccb290c23f00af6555afc7f1c2855ef599ae387022a7f785d6cb47fceae
SHA512656ee17c403d6aef18faad8eff0e4c305cb0f18ac22fe55b5b6b3400a560f45445f5fe0f21140ee36fb0de6cbe9abb3185a3c2caf0cbafd4d0bcdbf9ae20396b
-
Filesize
10KB
MD51f381c4c6affb0a6773c99718339372c
SHA158fb4138f6a09c8f22557260093fd49725b122da
SHA256d2a1b80b6eb84e45e05a428b0e0468719515a75b3389c3fae5bfcf49e4bf8dc5
SHA51258dd92bc40b2992a55a0079d65b3e2e486127d7bb4df9ce1b1bac587d42e6db481c8b2c1f5a20a7d5fdcb4a978a3e0bc1b592a11b375a39d5f4f0092c034c77d
-
Filesize
278B
MD59b6c004dfeefaed424318580a790a2bd
SHA107f2d026bf55d3c25902d570741b0c183b6df73d
SHA256983389374c9d4e12c57f9fd96f12242c9ed0844f5dae0e547a7b2ec0b658e465
SHA5128ccf4c0d83755899a8b13faa025b009d4f676dd15c899b1209e96cac238bbee33f6cc34fa4827f24080a9bbcd64b6352aa2b6fb4c9177a88bc7f9344bc81ef69
-
Filesize
1KB
MD5c2afd72ff80f037691356ec69a5ccf3d
SHA14331802328684172600e2a4cdbf90b69973340b6
SHA2569e883722d9fff021b9d47340d01efdd000406cc8e5e8fd07d8d716012aac1e74
SHA512ad8e2d7fb6da88a44acba970debc63923f4ae159b94bcc70b99eb32a21fdd52eaa83ecf057b8fcd785175af881600876579a09c053bc71fdedd374aa3f5cb86b
-
Filesize
1KB
MD57e316044e1eb5ec301520109944deff6
SHA174788b5df4a790a8540f19e21ce0f1c3d2b99776
SHA256792656c39ed22c508a7372cd191a738afd6828ec6e2b4573ff83f93dc41e1720
SHA512a10e2319e6801a43a3b8fdc43612cf4807eb43a670adb8eccb576a06cd85f58e66429915cc172c21b360b827c62362bd200e6c71a2d50f673380159174152fe5
-
Filesize
62B
MD5534805b650fcccfb6c3429305f30581f
SHA1b759da4ceb80c79ba1e50a28e1602714d10e9c23
SHA256432b1417e125442aae2e867d54ab1fcf2f92ebd4f7a44ac99d2b22061145f6e4
SHA512b9f760cdcf4d3df24c32f879473cb61068aa60d0078d68a8352212a3ee233baa0ab3bb86814f923078f279b73a1e5838c68f994fdf071635387c00db2782d876
-
Filesize
386B
MD5afc8de277154ce553a4f8cbdde2e8f7e
SHA1c1a640662228ba967ce3d631a5bb54aa88bdf3fc
SHA256d1911734243cd32ec2f5b38d9da17d7d120049d68db64fc6e93495063074497a
SHA512178b919860d14669817c6404748e7a005f510962c464f6ded239d4526b8cb6b7926faf4e06f378c1a43990c1272be9f313cd2a262d682de7f937945f7c31814b
-
Filesize
666B
MD511e86fc67f1a0c0b055debfa85d59412
SHA18fff11073fe0418bdb39a382fd2d0be92d5c426c
SHA256cc8bf3bd83b3043c23f9ec7bf37215e65b6e48652441ff849ab50efe2923bec0
SHA512f4d0becba3d00ba365651dfda6a1cd5556e47f8cfa683afc07da398aac6f36941bc2e9e3128f7f6c3827c3129b501de767fcd9da63bbd885591c1c1ef9827ed1