Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    08112024_0341_24102024_Updater.dll

  • Size

    129KB

  • Sample

    241108-d83k9svcqb

  • MD5

    e08edc1510052adc297d6af47022a70b

  • SHA1

    f08af6d4a2f9655beb8219aca5711400efed8670

  • SHA256

    915a80abb43f04fcdfb9ba2ced3b38f3524c050b6c0a36d97f4e7827916248b2

  • SHA512

    2b91019e3d96b57362719b9bddb7b894239977266d23e2c8b9ebbcd93a9ba748491b96a92c1b4fd1876e74a3b7f3da99b89bb0e38a463a8ae9f357d9d9f66652

  • SSDEEP

    3072:Jhw2Pja55J8hTGMjctYnc/F5ipfVMFY3lz:Jhwv55WT7ctiiF5cV

Malware Config

Extracted

Family

warmcookie

Attributes
  • mutex

    65abfc80-a660-4691-a919-130dc9b75b98

Targets

    • Target

      08112024_0341_24102024_Updater.dll

    • Size

      129KB

    • MD5

      e08edc1510052adc297d6af47022a70b

    • SHA1

      f08af6d4a2f9655beb8219aca5711400efed8670

    • SHA256

      915a80abb43f04fcdfb9ba2ced3b38f3524c050b6c0a36d97f4e7827916248b2

    • SHA512

      2b91019e3d96b57362719b9bddb7b894239977266d23e2c8b9ebbcd93a9ba748491b96a92c1b4fd1876e74a3b7f3da99b89bb0e38a463a8ae9f357d9d9f66652

    • SSDEEP

      3072:Jhw2Pja55J8hTGMjctYnc/F5ipfVMFY3lz:Jhwv55WT7ctiiF5cV

    • Warmcookie family

    • Warmcookie, Badspace

      Warmcookie aka Badspace is a backdoor written in C++.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks