2fc9c826723fc0e847ab8cdad9686b48d8c291397264ac5ee9bef2805cca37a5

Analysis

max time kernel
119s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66829eff38c8ffccd321ddfdc8b33a1e.exe
Size

1.5MB
MD5

66829eff38c8ffccd321ddfdc8b33a1e
SHA1

867ac5e250fc06a9f6964170e077ea40ed8f5f72
SHA256

2fc9c826723fc0e847ab8cdad9686b48d8c291397264ac5ee9bef2805cca37a5
SHA512

10d06c7336162b91df7cf67a0665ac35dfd993c4d4f4ec7871b93bbd9e3aa27dcbced328f29719222f75f125498e3e344132bf46ba50a99ce551ff83e0e984ab
SSDEEP

24576:t2RtsxfT5Ecc6hwjZhWlkPzYiPnoIs9WoyZpGeWJkRUndufH5NTQ9ljnOAJI6g:0kfTNEfWlQzBPnoIs9WoynWaaAfXTYlK

Score

7^/10

evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2572	cookieman.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	66829eff38c8ffccd321ddfdc8b33a1e.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	66829eff38c8ffccd321ddfdc8b33a1e.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2440	66829eff38c8ffccd321ddfdc8b33a1e.exe
2440	66829eff38c8ffccd321ddfdc8b33a1e.exe
2544	66829eff38c8ffccd321ddfdc8b33a1e.exe
2544	66829eff38c8ffccd321ddfdc8b33a1e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2544	66829eff38c8ffccd321ddfdc8b33a1e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2544	2440	66829eff38c8ffccd321ddfdc8b33a1e.exe	27
PID 2440 wrote to memory of 2544	2440	66829eff38c8ffccd321ddfdc8b33a1e.exe	27
PID 2440 wrote to memory of 2544	2440	66829eff38c8ffccd321ddfdc8b33a1e.exe	27
PID 2440 wrote to memory of 2544	2440	66829eff38c8ffccd321ddfdc8b33a1e.exe	27

C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe
"C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe
  "C:\Users\Admin\AppData\Local\Temp\66829eff38c8ffccd321ddfdc8b33a1e.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_223627f0"
  2⤵
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2544
- - C:\Users\Admin\AppData\LocalLow\cookieman.exe
    "C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
    3⤵
    - Executes dropped EXE
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\cookie.ini

Filesize
34B

MD5
3f4519b56cb1e006dfe4341e72112913

SHA1
0ff5675d359c898b6a6bdc1dff10f71097bc9927

SHA256
125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2

SHA512
78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40

Download Submit
C:\Users\Admin\AppData\LocalLow\cookieman.exe

Filesize
45KB

MD5
3e382f6385bf86f976aecc9c2c3c6552

SHA1
d8c658bc164cb8bce72e5cca0597406841105685

SHA256
f2327ccb290c23f00af6555afc7f1c2855ef599ae387022a7f785d6cb47fceae

SHA512
656ee17c403d6aef18faad8eff0e4c305cb0f18ac22fe55b5b6b3400a560f45445f5fe0f21140ee36fb0de6cbe9abb3185a3c2caf0cbafd4d0bcdbf9ae20396b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\66829eff38c8ffccd321ddfdc8b33a1e.log

Filesize
10KB

MD5
1f381c4c6affb0a6773c99718339372c

SHA1
58fb4138f6a09c8f22557260093fd49725b122da

SHA256
d2a1b80b6eb84e45e05a428b0e0468719515a75b3389c3fae5bfcf49e4bf8dc5

SHA512
58dd92bc40b2992a55a0079d65b3e2e486127d7bb4df9ce1b1bac587d42e6db481c8b2c1f5a20a7d5fdcb4a978a3e0bc1b592a11b375a39d5f4f0092c034c77d

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\autorun.txt

Filesize
278B

MD5
9b6c004dfeefaed424318580a790a2bd

SHA1
07f2d026bf55d3c25902d570741b0c183b6df73d

SHA256
983389374c9d4e12c57f9fd96f12242c9ed0844f5dae0e547a7b2ec0b658e465

SHA512
8ccf4c0d83755899a8b13faa025b009d4f676dd15c899b1209e96cac238bbee33f6cc34fa4827f24080a9bbcd64b6352aa2b6fb4c9177a88bc7f9344bc81ef69

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\detectionrules.dat

Filesize
1KB

MD5
c2afd72ff80f037691356ec69a5ccf3d

SHA1
4331802328684172600e2a4cdbf90b69973340b6

SHA256
9e883722d9fff021b9d47340d01efdd000406cc8e5e8fd07d8d716012aac1e74

SHA512
ad8e2d7fb6da88a44acba970debc63923f4ae159b94bcc70b99eb32a21fdd52eaa83ecf057b8fcd785175af881600876579a09c053bc71fdedd374aa3f5cb86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\postbackresponse.dat

Filesize
1KB

MD5
7e316044e1eb5ec301520109944deff6

SHA1
74788b5df4a790a8540f19e21ce0f1c3d2b99776

SHA256
792656c39ed22c508a7372cd191a738afd6828ec6e2b4573ff83f93dc41e1720

SHA512
a10e2319e6801a43a3b8fdc43612cf4807eb43a670adb8eccb576a06cd85f58e66429915cc172c21b360b827c62362bd200e6c71a2d50f673380159174152fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\stubinfo.ini

Filesize
62B

MD5
534805b650fcccfb6c3429305f30581f

SHA1
b759da4ceb80c79ba1e50a28e1602714d10e9c23

SHA256
432b1417e125442aae2e867d54ab1fcf2f92ebd4f7a44ac99d2b22061145f6e4

SHA512
b9f760cdcf4d3df24c32f879473cb61068aa60d0078d68a8352212a3ee233baa0ab3bb86814f923078f279b73a1e5838c68f994fdf071635387c00db2782d876

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\timings.txt

Filesize
386B

MD5
afc8de277154ce553a4f8cbdde2e8f7e

SHA1
c1a640662228ba967ce3d631a5bb54aa88bdf3fc

SHA256
d1911734243cd32ec2f5b38d9da17d7d120049d68db64fc6e93495063074497a

SHA512
178b919860d14669817c6404748e7a005f510962c464f6ded239d4526b8cb6b7926faf4e06f378c1a43990c1272be9f313cd2a262d682de7f937945f7c31814b

Download Submit
C:\Users\Admin\AppData\Local\Temp\pkg_223627f0\wrapper.xml

Filesize
666B

MD5
11e86fc67f1a0c0b055debfa85d59412

SHA1
8fff11073fe0418bdb39a382fd2d0be92d5c426c

SHA256
cc8bf3bd83b3043c23f9ec7bf37215e65b6e48652441ff849ab50efe2923bec0

SHA512
f4d0becba3d00ba365651dfda6a1cd5556e47f8cfa683afc07da398aac6f36941bc2e9e3128f7f6c3827c3129b501de767fcd9da63bbd885591c1c1ef9827ed1

Download Submit