Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

Cookie-LoggerV1.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    12s
  • max time network
    14s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2024, 07:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Cookie-LoggerV1.exe

  • Size

    11.8MB

  • MD5

    66111d5be5891f58653d85770cb6773c

  • SHA1

    061592ce4a461c98a3aca5638b9f83362f09a281

  • SHA256

    b05e79b2c9ce3b0f13b75295bb62edb0d32cc52b93daf4ef061be545296a4c22

  • SHA512

    e3a9f9da951f9af8b9e8f897fbef96cd9ffcabe26529c9a7bfe9b24e49b226b86c617e5a1a5bcf2914241077ce7e808dbb7502f2990566a034d8020111a3f725

  • SSDEEP

    196608:TG8dj2i/OCoDtutcV+ZqTfyahZc9yOdTfldN5PIC+4r3FZZaZ9gh20gkzDKM/q3n:btnaUKzf7hZcXRflf5PLZZQ9ugoDKMyL

Score
9/10
credential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 43 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cookie-LoggerV1.exe
    "C:\Users\Admin\AppData\Local\Temp\Cookie-LoggerV1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\audifylogger.exe
      "C:\Users\Admin\AppData\Local\Temp\Cookie-LoggerV1.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Cryptodome\Cipher\_raw_cfb.pyd
    Filesize

    13KB

    MD5

    7256877dd2b76d8c6d6910808222acd8

    SHA1

    c6468db06c4243ce398beb83422858b3fed76e99

    SHA256

    dbf703293cff0446dfd15bbaeda52fb044f56a353dda3beca9aadd8a959c5798

    SHA512

    a14d460d96845984f052a8509e8fc44439b616eeae46486df20f21ccaa8cfb1e55f1e4fa2f11a7b6ab0a481de62636cef19eb5bef2591fe83d415d67eb605b8e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Cryptodome\Hash\_SHA1.pyd
    Filesize

    19KB

    MD5

    74daaab71f93bce184d507a45a88985c

    SHA1

    3d09d69e94548ec6975177b482b68f86eda32bb8

    SHA256

    e781d6daf2baaa2c1a45bd1cddb21ba491442d49a03255c1e367f246f17e13bf

    SHA512

    870ec2752304f12f2f91be688a34812ac1c75d444a0107284e3c45987639d8d07116eb98db76931f9c8487666e1b2c163fc5743bbfc5a72f20f040670cdeb509

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_brotli.pyd
    Filesize

    801KB

    MD5

    ee3d454883556a68920caaedefbc1f83

    SHA1

    45b4d62a6e7db022e52c6159eef17e9d58bec858

    SHA256

    791e7195d7df47a21466868f3d7386cff13f16c51fcd0350bf4028e96278dff1

    SHA512

    e404adf831076d27680cc38d3879af660a96afc8b8e22ffd01647248c601f3c6c4585d7d7dc6bbd187660595f6a48f504792106869d329aa1a0f3707d7f777c6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd
    Filesize

    78KB

    MD5

    b45e82a398713163216984f2feba88f6

    SHA1

    eaaf4b91db6f67d7c57c2711f4e968ce0fe5d839

    SHA256

    4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8

    SHA512

    b9c4f22dc4b52815c407ab94d18a7f2e1e4f2250aecdb2e75119150e69b006ed69f3000622ec63eabcf0886b7f56ffdb154e0bf57d8f7f45c3b1dd5c18b84ec8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd
    Filesize

    57KB

    MD5

    cfb9e0a73a6c9d6d35c2594e52e15234

    SHA1

    b86042c96f2ce6d8a239b7d426f298a23df8b3b9

    SHA256

    50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6

    SHA512

    22a5fd139d88c0eee7241c5597d8dbbf2b78841565d0ed0df62383ab50fde04b13a203bddef03530f8609f5117869ed06894a572f7655224285823385d7492d2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd
    Filesize

    26KB

    MD5

    c9ee37e9f3bffd296ade10a27c7e5b50

    SHA1

    b7eee121b2918b6c0997d4889cff13025af4f676

    SHA256

    9ecec72c5fe3c83c122043cad8ceb80d239d99d03b8ea665490bbced183ce42a

    SHA512

    c63bb1b5d84d027439af29c4827fa801df3a2f3d5854c7c79789cad3f5f7561eb2a7406c6f599d2ac553bc31969dc3fa9eef8648bed7282fbc5dc3fb3ba4307f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd
    Filesize

    72KB

    MD5

    5dd51579fa9b6a06336854889562bec0

    SHA1

    99c0ed0a15ed450279b01d95b75c162628c9be1d

    SHA256

    3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c

    SHA512

    7aa6c6587890ae8c3f9a5e97ebde689243ac5b9abb9b1e887f29c53eef99a53e4b4ec100c03e1c043e2f0d330e7af444c3ca886c9a5e338c2ea42aaacae09f3e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd
    Filesize

    152KB

    MD5

    11c5008e0ba2caa8adf7452f0aaafd1e

    SHA1

    764b33b749e3da9e716b8a853b63b2f7711fcc7c

    SHA256

    bf63f44951f14c9d0c890415d013276498d6d59e53811bbe2fa16825710bea14

    SHA512

    fceb022d8694bce6504d6b64de4596e2b8252fc2427ee66300e37bcff297579cc7d32a8cb8f847408eaa716cb053e20d53e93fbd945e3f60d58214e6a969c9dd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem
    Filesize

    283KB

    MD5

    302b49c5f476c0ae35571430bb2e4aa0

    SHA1

    35a7837a3f1b960807bf46b1c95ec22792262846

    SHA256

    cf9d37fa81407afe11dcc0d70fe602561422aa2344708c324e4504db8c6c5748

    SHA512

    1345af52984b570b1ff223032575feb36cdfb4f38e75e0bd3b998bc46e9c646f7ac5c583d23a70460219299b9c04875ef672bf5a0d614618731df9b7a5637d0a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md.pyd
    Filesize

    10KB

    MD5

    f33ca57d413e6b5313272fa54dbc8baa

    SHA1

    4e0cabe7d38fe8d649a0a497ed18d4d1ca5f4c44

    SHA256

    9b3d70922dcfaeb02812afa9030a40433b9d2b58bcf088781f9ab68a74d20664

    SHA512

    f17c06f4202b6edbb66660d68ff938d4f75b411f9fab48636c3575e42abaab6464d66cb57bce7f84e8e2b5755b6ef757a820a50c13dd5f85faa63cd553d3ff32

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md__mypyc.pyd
    Filesize

    117KB

    MD5

    494f5b9adc1cfb7fdb919c9b1af346e1

    SHA1

    4a5fddd47812d19948585390f76d5435c4220e6b

    SHA256

    ad9bcc0de6815516dfde91bb2e477f8fb5f099d7f5511d0f54b50fa77b721051

    SHA512

    2c0d68da196075ea30d97b5fd853c673e28949df2b6bf005ae72fd8b60a0c036f18103c5de662cac63baaef740b65b4ed2394fcd2e6da4dfcfbeef5b64dab794

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-1_1.dll
    Filesize

    3.3MB

    MD5

    63c4f445b6998e63a1414f5765c18217

    SHA1

    8c1ac1b4290b122e62f706f7434517077974f40e

    SHA256

    664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2

    SHA512

    aa7bdb3c5bc8aeefbad70d785f2468acbb88ef6e6cac175da765647030734453a2836f9658dc7ce33f6fff0de85cb701c825ef5c04018d79fa1953c8ef946afd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libssl-1_1.dll
    Filesize

    678KB

    MD5

    bd857f444ebbf147a8fcd1215efe79fc

    SHA1

    1550e0d241c27f41c63f197b1bd669591a20c15b

    SHA256

    b7c0e42c1a60a2a062b899c8d4ebd0c50ef956177ba21785ce07c517c143aeaf

    SHA512

    2b85c1521edeadf7e118610d6546fafbbad43c288a7f0f9d38d97c4423a541dfac686634cde956812916830fbb4aad8351a23d95cd490c4a5c0f628244d30f0a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\pywintypes310.dll
    Filesize

    131KB

    MD5

    ceb06a956b276cea73098d145fa64712

    SHA1

    6f0ba21f0325acc7cf6bf9f099d9a86470a786bf

    SHA256

    c8ec6429d243aef1f78969863be23d59273fa6303760a173ab36ab71d5676005

    SHA512

    05bab4a293e4c7efa85fa2491c32f299afd46fdb079dcb7ee2cc4c31024e01286daaf4aead5082fc1fd0d4169b2d1be589d1670fcf875b06c6f15f634e0c6f34

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\unicodedata.pyd
    Filesize

    1.1MB

    MD5

    a40ff441b1b612b3b9f30f28fa3c680d

    SHA1

    42a309992bdbb68004e2b6b60b450e964276a8fc

    SHA256

    9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08

    SHA512

    5f9142b16ed7ffc0e5b17d6a4257d7249a21061fe5e928d3cde75265c2b87b723b2e7bd3109c30d2c8f83913134445e8672c98c187073368c244a476ac46c3ef

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\win32crypt.pyd
    Filesize

    121KB

    MD5

    acc2c2a7dd9ba8603ac192d886ff2ace

    SHA1

    eae213d0b86a7730161d8cc9568d91663948c638

    SHA256

    4805c4903e098f0ae3c3cbebd02b44df4d73ab19013784f49a223f501da3c853

    SHA512

    23b97707843d206833e7d4f0dfcad79a597de0867bab629026dd26bff9f1c640bb4cd1bc6bce7abe48353feac8c367e93ea7b15425d6ff8b1aea07a716f5e491

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd
    Filesize

    512KB

    MD5

    4652c4087b148d08adefedf55719308b

    SHA1

    30e06026fea94e5777c529b479470809025ffbe2

    SHA256

    003f439c27a532d6f3443706ccefac6be4152bebc1aa8bdf1c4adfc095d33795

    SHA512

    d4972c51ffbce63d2888ddfead2f616166b6f21a0c186ccf97a41c447c1fac6e848f464e4acde05bea5b24c73c5a03b834731f8807a54ee46ca8619b1d0c465d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\Cryptodome\Cipher\_raw_cbc.pyd
    Filesize

    12KB

    MD5

    6840f030df557b08363c3e96f5df3387

    SHA1

    793a8ba0a7bdb5b7e510fc9a9dde62b795f369ae

    SHA256

    b7160ed222d56925e5b2e247f0070d5d997701e8e239ec7f80bce21d14fa5816

    SHA512

    edf5a4d5a3bfb82cc140ce6ce6e9df3c8ed495603dcf9c0d754f92f265f2dce6a83f244e0087309b42930d040bf55e66f34504dc1c482a274ad8262aa37d1467

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\Cryptodome\Cipher\_raw_ctr.pyd
    Filesize

    14KB

    MD5

    b063d73e5aa501060c303cafbc72dad3

    SHA1

    8c1ca04a8ed34252eb233c993ddba17803e0b81e

    SHA256

    98baca99834de65fc29efa930cd9dba8da233b4cfdfc4ab792e1871649b2fe5c

    SHA512

    8c9ad249f624bdf52a3c789c32532a51d3cc355646bd725553a738c4491ea483857032fb20c71fd3698d7f68294e3c35816421dff263d284019a9a4774c3af05

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\Cryptodome\Cipher\_raw_ecb.pyd
    Filesize

    10KB

    MD5

    1c74e15ec55bd8767968024d76705efc

    SHA1

    c590d1384d2207b3af01a46a5b4f7a2ae6bcad93

    SHA256

    0e3ec56a1f3c86be1caa503e5b89567aa91fd3d6da5ad4e4de4098f21270d86b

    SHA512

    e96ca56490fce7e169cc0ab803975baa8b5acb8bbab5047755ae2eeae177cd4b852c0620cd77bcfbc81ad18bb749dec65d243d1925288b628f155e8facdc3540

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\Cryptodome\Cipher\_raw_ofb.pyd
    Filesize

    12KB

    MD5

    134f891de4188c2428a2081e10e675f0

    SHA1

    22cb9b0fa0d1028851b8d28dafd988d25e94d2fd

    SHA256

    f326aa2a582b773f4df796035ec9bf69ec1ad11897c7d0ecfab970d33310d6ba

    SHA512

    43ce8af33630fd907018c62f100be502565bad712ad452a327ae166bd305735799877e14be7a46d243d834f3f884abf6286088e30533050ed9cd05d23aacaeab

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\Cryptodome\Hash\_BLAKE2s.pyd
    Filesize

    14KB

    MD5

    c3ba97b2d8fffdb05f514807c48cabb2

    SHA1

    7bc7fbde6a372e5813491bbd538fd49c0a1b7c26

    SHA256

    4f78e61b376151ca2d0856d2e59976670f5145fbabab1eec9b2a3b5bebb4eef6

    SHA512

    57c1a62d956d8c6834b7ba81c2d125a40bf466e833922ae3759cf2c1017f8caf29f4502a5a0bcbc95d74639d86baf20f0335a45f961cfcac39b4ed81e318f4eb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\Cryptodome\Util\_strxor.pyd
    Filesize

    10KB

    MD5

    16f42de194aaefb2e3cdee7fa63d2401

    SHA1

    be2ab72a90e0342457a9d13be5b6b1984875edea

    SHA256

    61e23970b6ced494e11dc9de9cb889c70b7ff7a5afe5242ba8b29aa3da7bc60e

    SHA512

    a671ea77bc8ca75aedb26b73293b51b780e26d6b8046fe1b85ae12bc9cc8f1d2062f74de79040ad44d259172f99781c7e774fe40768dc0a328bd82a48bf81489

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\VCRUNTIME140.dll
    Filesize

    94KB

    MD5

    11d9ac94e8cb17bd23dea89f8e757f18

    SHA1

    d4fb80a512486821ad320c4fd67abcae63005158

    SHA256

    e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e

    SHA512

    aa6afd6bea27f554e3646152d8c4f96f7bcaaa4933f8b7c04346e410f93f23cfa6d29362fd5d51ccbb8b6223e094cd89e351f072ad0517553703f5bf9de28778

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\_cffi_backend.pyd
    Filesize

    177KB

    MD5

    ebb660902937073ec9695ce08900b13d

    SHA1

    881537acead160e63fe6ba8f2316a2fbbb5cb311

    SHA256

    52e5a0c3ca9b0d4fc67243bd8492f5c305ff1653e8d956a2a3d9d36af0a3e4fd

    SHA512

    19d5000ef6e473d2f533603afe8d50891f81422c59ae03bead580412ec756723dc3379310e20cd0c39e9683ce7c5204791012e1b6b73996ea5cb59e8d371de24

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\_lzma.pyd
    Filesize

    149KB

    MD5

    5a77a1e70e054431236adb9e46f40582

    SHA1

    be4a8d1618d3ad11cfdb6a366625b37c27f4611a

    SHA256

    f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e

    SHA512

    3c14297a1400a93d1a01c7f8b4463bfd6be062ec08daaf5eb7fcbcde7f4fa40ae06e016ff0de16cb03b987c263876f2f437705adc66244d3ee58f23d6bf7f635

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\_sqlite3.pyd
    Filesize

    91KB

    MD5

    6486e5c8512bddc5f5606d11fe8f21e0

    SHA1

    650861b2c4a1d6689ff0a49bb916f8ff278bb387

    SHA256

    728d21be4d47dd664caf9fa60c1369fe059bc0498edd383b27491d0dee23e439

    SHA512

    f2c9267a3cab31190079037e3cc5614f19c1235852454708c4978008ea9da345892191750980aebc809cc83dd1f5788b60f8cf39a6a41623210c96af916d1821

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\audifylogger.exe
    Filesize

    18.0MB

    MD5

    0e6a411855aa50a9ce1ea320d747fc5a

    SHA1

    83987be0895c0ee4f1a3e695d3aff2f9af035fe7

    SHA256

    b1a59af2804bb041fc16f43b850ab0d73332e3b73e01619e9c4e2680a273dbaf

    SHA512

    06160522d243a4c19a39121461a726b73b76d7bdb171bed0d496691e0e49ae52e5bc9e61d8f5f881b2b653b9b9db49f9023ac30f10221033034acbfe49a107dd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\python310.dll
    Filesize

    4.2MB

    MD5

    384349987b60775d6fc3a6d202c3e1bd

    SHA1

    701cb80c55f859ad4a31c53aa744a00d61e467e5

    SHA256

    f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8

    SHA512

    6bf3ef9f08f4fc07461b6ea8d9822568ad0a0f211e471b990f62c6713adb7b6be28b90f206a4ec0673b92bae99597d1c7785381e486f6091265c7df85ff0f9b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\select.pyd
    Filesize

    25KB

    MD5

    78d421a4e6b06b5561c45b9a5c6f86b1

    SHA1

    c70747d3f2d26a92a0fe0b353f1d1d01693929ac

    SHA256

    f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823

    SHA512

    83e02963c9726a40cd4608b69b4cdf697e41c9eedfb2d48f3c02c91500e212e7e0ab03e6b3f70f42e16e734e572593f27b016b901c8aa75f674b6e0fbb735012

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\sqlite3.dll
    Filesize

    1.4MB

    MD5

    7bb1d577405f1129faf3ea0225c9d083

    SHA1

    60472de4b1c7a12468d79994d6d0d684c91091ef

    SHA256

    831ba87cb1a91d4581f0abbcc4966c6f4b332536f70cf481f609c44cc3d987c2

    SHA512

    33b1fd3a289193bff168c967caebc0131732bd04562a770cf2edac602ab6d958f7bde7a0e57bb125a7598852bdac30f96d0db46cb4a2460a61a0d914b011ed20

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\onefile_4284_133683550195087711\vcruntime140_1.dll
    Filesize

    36KB

    MD5

    7667b0883de4667ec87c3b75bed84d84

    SHA1

    e6f6df83e813ed8252614a46a5892c4856df1f58

    SHA256

    04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d

    SHA512

    968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74

    Download Submit

  • memory/4284-153-0x00007FF7D3E30000-0x00007FF7D4A16000-memory.dmp

    Filesize

    11.9MB

    Download

  • memory/4524-138-0x00007FF64C360000-0x00007FF64D5B0000-memory.dmp

    Filesize

    18.3MB

    Download