Resubmissions

15-06-2024 18:07

240615-wqpksstdnm 9

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15-06-2024 18:07

General

  • Target

    CookiesCreator v1.2.exe

  • Size

    3.3MB

  • MD5

    30c33f45545b68bd1e0d7ec79a090883

  • SHA1

    086e1fadee4a61091250dedb616785c73b50950c

  • SHA256

    4e95226cce6e17fdc39f3a5f9050720d7848bb34ce2df72e63c878235c5be630

  • SHA512

    d76e6d64147d185a07b819cc9fe26daa1c1ae72af6a01b5467ae0b7f07239a8c0edc0c9066fff22c08241025909b492af9cc1f4e3d0eb136a54ee3b7a0d5a6f4

  • SSDEEP

    49152:14AQHxRXGKijAKG+TAdrdBpNIty0YwIs349UnzIYua0+v8li9IiFqVsf/z452nZ5:1lAnrVKGNhdBEIs3IuUw085qKf/z45

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CookiesCreator v1.2.exe
    "C:\Users\Admin\AppData\Local\Temp\CookiesCreator v1.2.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3252

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3252-0-0x0000000000840000-0x0000000001132000-memory.dmp
    Filesize

    8.9MB

  • memory/3252-2-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-1-0x0000000076700000-0x0000000076701000-memory.dmp
    Filesize

    4KB

  • memory/3252-5-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-4-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-3-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-6-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-8-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-7-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-12-0x0000000000840000-0x0000000001132000-memory.dmp
    Filesize

    8.9MB

  • memory/3252-13-0x0000000000840000-0x0000000001132000-memory.dmp
    Filesize

    8.9MB

  • memory/3252-14-0x0000000005CD0000-0x0000000006274000-memory.dmp
    Filesize

    5.6MB

  • memory/3252-15-0x0000000005720000-0x00000000057B2000-memory.dmp
    Filesize

    584KB

  • memory/3252-16-0x0000000005820000-0x000000000582A000-memory.dmp
    Filesize

    40KB

  • memory/3252-17-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-19-0x0000000000840000-0x0000000001132000-memory.dmp
    Filesize

    8.9MB

  • memory/3252-20-0x0000000076700000-0x0000000076701000-memory.dmp
    Filesize

    4KB

  • memory/3252-21-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-22-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-23-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-24-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-26-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-27-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-28-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB

  • memory/3252-29-0x00000000766E0000-0x00000000767D0000-memory.dmp
    Filesize

    960KB