Resubmissions

15-06-2024 18:07

240615-wqpksstdnm 9

Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-06-2024 18:07

General

  • Target

    CookiesCreator v1.2.exe

  • Size

    3.3MB

  • MD5

    30c33f45545b68bd1e0d7ec79a090883

  • SHA1

    086e1fadee4a61091250dedb616785c73b50950c

  • SHA256

    4e95226cce6e17fdc39f3a5f9050720d7848bb34ce2df72e63c878235c5be630

  • SHA512

    d76e6d64147d185a07b819cc9fe26daa1c1ae72af6a01b5467ae0b7f07239a8c0edc0c9066fff22c08241025909b492af9cc1f4e3d0eb136a54ee3b7a0d5a6f4

  • SSDEEP

    49152:14AQHxRXGKijAKG+TAdrdBpNIty0YwIs349UnzIYua0+v8li9IiFqVsf/z452nZ5:1lAnrVKGNhdBEIs3IuUw085qKf/z45

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CookiesCreator v1.2.exe
    "C:\Users\Admin\AppData\Local\Temp\CookiesCreator v1.2.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2932-0-0x0000000000D70000-0x0000000001662000-memory.dmp
    Filesize

    8.9MB

  • memory/2932-1-0x0000000075404000-0x0000000075405000-memory.dmp
    Filesize

    4KB

  • memory/2932-3-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-4-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-5-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-17-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-2-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-23-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-26-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-25-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-24-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-22-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-21-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-20-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-19-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-18-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-16-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-15-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-14-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-13-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-27-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-12-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-11-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-10-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-9-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-8-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-7-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-6-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-31-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-32-0x0000000000D70000-0x0000000001662000-memory.dmp
    Filesize

    8.9MB

  • memory/2932-33-0x0000000000D70000-0x0000000001662000-memory.dmp
    Filesize

    8.9MB

  • memory/2932-34-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-35-0x0000000000D70000-0x0000000001662000-memory.dmp
    Filesize

    8.9MB

  • memory/2932-37-0x0000000075404000-0x0000000075405000-memory.dmp
    Filesize

    4KB

  • memory/2932-38-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-39-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-41-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB

  • memory/2932-42-0x00000000753F0000-0x0000000075500000-memory.dmp
    Filesize

    1.1MB