Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
03/08/2024, 13:26
Behavioral task
behavioral1
Sample
warmcookie.bin.dll
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
warmcookie.bin.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
warmcookie.bin.dll
-
Size
141KB
-
MD5
2492aca399dfaf75e761586844734980
-
SHA1
c7d147e588fe5ec6101bf69ec0dbc5d2252fbad6
-
SHA256
0b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce
-
SHA512
1ce1a434b2cc5498b5547720d4eaf14a907b359492a1694847bb3119ca4b0b6ba8bfad02e2a39c71111aacd637db224a6b44c77c7469d19b9cbea4deab4b15fd
-
SSDEEP
3072:HACxLpcTIhjZM3VhHSkYl8CagwurZvE9vV1ZQ6R:HTtpcPlJSTl4Pu8
Score
10/10
Malware Config
Extracted
Family
warmcookie
C2
185.49.69.41
Attributes
-
mutex
0b664cde-8833-4945-8aff-b301b3bfebe8
-
user_agent
Mozilla / 4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;.NET CLR 1.0.3705)
Signatures
-
Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
-
Blocklisted process makes network request 28 IoCs
flow pid Process 4 2276 rundll32.exe 5 2276 rundll32.exe 6 2276 rundll32.exe 7 2276 rundll32.exe 8 2276 rundll32.exe 9 2276 rundll32.exe 11 2276 rundll32.exe 12 2276 rundll32.exe 13 2276 rundll32.exe 14 2276 rundll32.exe 15 2276 rundll32.exe 16 2276 rundll32.exe 18 2276 rundll32.exe 19 2276 rundll32.exe 20 2276 rundll32.exe 21 2276 rundll32.exe 22 2276 rundll32.exe 23 2276 rundll32.exe 25 2276 rundll32.exe 26 2276 rundll32.exe 27 2276 rundll32.exe 28 2276 rundll32.exe 29 2276 rundll32.exe 30 2276 rundll32.exe 32 2276 rundll32.exe 33 2276 rundll32.exe 34 2276 rundll32.exe 35 2276 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 2276 rundll32.exe 2276 rundll32.exe 2276 rundll32.exe 2276 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\RtlUpd.job regsvr32.exe -
Modifies data under HKEY_USERS 31 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F940D03C-4B85-4E82-9D61-6E4A4173ED38}\2a-2f-97-37-cb-b5 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2f-97-37-cb-b5\WpadDecisionTime = d0ddfbdba8e5da01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2f-97-37-cb-b5\WpadDecisionTime = 104bc30ca9e5da01 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F940D03C-4B85-4E82-9D61-6E4A4173ED38}\WpadNetworkName = "Network 3" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F940D03C-4B85-4E82-9D61-6E4A4173ED38}\WpadDecisionTime = 104bc30ca9e5da01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2f-97-37-cb-b5 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2f-97-37-cb-b5\WpadDecisionReason = "1" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f006e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2f-97-37-cb-b5\WpadDetectedUrl rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f006e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2f-97-37-cb-b5\WpadDecisionTime = 10ac441ba9e5da01 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2f-97-37-cb-b5\WpadDecision = "0" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2f-97-37-cb-b5\WpadDecisionTime = d0705de7a8e5da01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-2f-97-37-cb-b5\WpadDecisionTime = 10ac2ef5a8e5da01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f006e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F940D03C-4B85-4E82-9D61-6E4A4173ED38}\WpadDecisionTime = 10ac441ba9e5da01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F940D03C-4B85-4E82-9D61-6E4A4173ED38} rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F940D03C-4B85-4E82-9D61-6E4A4173ED38}\WpadDecisionTime = d0705de7a8e5da01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f006e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F940D03C-4B85-4E82-9D61-6E4A4173ED38}\WpadDecisionReason = "1" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F940D03C-4B85-4E82-9D61-6E4A4173ED38}\WpadDecisionTime = d0ddfbdba8e5da01 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F940D03C-4B85-4E82-9D61-6E4A4173ED38}\WpadDecision = "0" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F940D03C-4B85-4E82-9D61-6E4A4173ED38}\WpadDecisionTime = 10ac2ef5a8e5da01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f006e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2276 1960 taskeng.exe 32 PID 1960 wrote to memory of 2276 1960 taskeng.exe 32 PID 1960 wrote to memory of 2276 1960 taskeng.exe 32
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\warmcookie.bin.dll1⤵
- Drops file in Windows directory
PID:1500
-
C:\Windows\system32\taskeng.exetaskeng.exe {366ED8D1-D340-425E-866C-F53E58EC3A6C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe "C:\ProgramData\RtlUpd\RtlUpd.dll",Start /p2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
141KB
MD52492aca399dfaf75e761586844734980
SHA1c7d147e588fe5ec6101bf69ec0dbc5d2252fbad6
SHA2560b26abc692b7a2877b6b6fce6aa99b29af125b063f1c41b507362def59f8dfce
SHA5121ce1a434b2cc5498b5547720d4eaf14a907b359492a1694847bb3119ca4b0b6ba8bfad02e2a39c71111aacd637db224a6b44c77c7469d19b9cbea4deab4b15fd