Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

random.dll

windows10-2004-x64

10

Resubmissions

14/08/2024, 23:31

240814-3hse2sxalr 10

14/08/2024, 16:54

240814-vejdzashka 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    random.dll.exe

  • Size

    155KB

  • Sample

    240814-3hse2sxalr

  • MD5

    7a799f4f9aa63745a75b901a392aff29

  • SHA1

    b9983463f637191ba12c2270ac52a547676a7037

  • SHA256

    f4d2c9470b322af29b9188a3a590cbe85bacb9cc8fcd7c2e94d82271ded3f659

  • SHA512

    e9eeb340dd620256d543ab43d08ccc23b555afa332c744c629fd8f40760f20a24e234955fc8d2e78a150f09028ca7a11650e0da157fff64833f13ce89a208c23

  • SSDEEP

    3072:0lCt2jrijQEjnMUWzsjhVPbuGHUluQj6vkZD4vP5iZWyLr:QCIrijNMv6XPbr0kuNr

Score
10/10
warmcookiebackdoordiscovery

Malware Config

Targets

    • Target

      random.dll.exe

    • Size

      155KB

    • MD5

      7a799f4f9aa63745a75b901a392aff29

    • SHA1

      b9983463f637191ba12c2270ac52a547676a7037

    • SHA256

      f4d2c9470b322af29b9188a3a590cbe85bacb9cc8fcd7c2e94d82271ded3f659

    • SHA512

      e9eeb340dd620256d543ab43d08ccc23b555afa332c744c629fd8f40760f20a24e234955fc8d2e78a150f09028ca7a11650e0da157fff64833f13ce89a208c23

    • SSDEEP

      3072:0lCt2jrijQEjnMUWzsjhVPbuGHUluQj6vkZD4vP5iZWyLr:QCIrijNMv6XPbr0kuNr

    Score
    10/10
    warmcookiebackdoordiscovery

    • Detect Warmcookie payload.

      Detects Warmcookie payload.

      backdoor

    • Warmcookie, Badspace

      Warmcookie aka Badspace is a backdoor written in C++.

      backdoorwarmcookie

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks