Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
300s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08/11/2024, 03:42
Behavioral task
behavioral1
Sample
Updater.dll
Resource
win7-20241010-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
Updater.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral3
Sample
launcher.bat
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral4
Sample
launcher.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
Updater.dll
-
Size
129KB
-
MD5
e08edc1510052adc297d6af47022a70b
-
SHA1
f08af6d4a2f9655beb8219aca5711400efed8670
-
SHA256
915a80abb43f04fcdfb9ba2ced3b38f3524c050b6c0a36d97f4e7827916248b2
-
SHA512
2b91019e3d96b57362719b9bddb7b894239977266d23e2c8b9ebbcd93a9ba748491b96a92c1b4fd1876e74a3b7f3da99b89bb0e38a463a8ae9f357d9d9f66652
-
SSDEEP
3072:Jhw2Pja55J8hTGMjctYnc/F5ipfVMFY3lz:Jhwv55WT7ctiiF5cV
Score
10/10
Malware Config
Extracted
Family
warmcookie
Attributes
-
mutex
65abfc80-a660-4691-a919-130dc9b75b98
Signatures
-
Warmcookie family
-
Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
-
Blocklisted process makes network request 60 IoCs
flow pid Process 4 1920 rundll32.exe 5 1920 rundll32.exe 6 1920 rundll32.exe 7 1920 rundll32.exe 8 1920 rundll32.exe 9 1920 rundll32.exe 11 1920 rundll32.exe 12 1920 rundll32.exe 13 1920 rundll32.exe 14 1920 rundll32.exe 15 1920 rundll32.exe 16 1920 rundll32.exe 18 1920 rundll32.exe 19 1920 rundll32.exe 20 1920 rundll32.exe 21 1920 rundll32.exe 22 1920 rundll32.exe 23 1920 rundll32.exe 25 1920 rundll32.exe 26 1920 rundll32.exe 27 1920 rundll32.exe 28 1920 rundll32.exe 29 1920 rundll32.exe 30 1920 rundll32.exe 32 1920 rundll32.exe 33 1920 rundll32.exe 34 1920 rundll32.exe 35 1920 rundll32.exe 36 1920 rundll32.exe 37 1920 rundll32.exe 39 1920 rundll32.exe 40 1920 rundll32.exe 41 1920 rundll32.exe 42 1920 rundll32.exe 43 1920 rundll32.exe 44 1920 rundll32.exe 46 1920 rundll32.exe 47 1920 rundll32.exe 48 1920 rundll32.exe 49 1920 rundll32.exe 50 1920 rundll32.exe 51 1920 rundll32.exe 53 1920 rundll32.exe 54 1920 rundll32.exe 55 1920 rundll32.exe 56 1920 rundll32.exe 57 1920 rundll32.exe 58 1920 rundll32.exe 60 1920 rundll32.exe 61 1920 rundll32.exe 62 1920 rundll32.exe 63 1920 rundll32.exe 64 1920 rundll32.exe 65 1920 rundll32.exe 67 1920 rundll32.exe 68 1920 rundll32.exe 69 1920 rundll32.exe 70 1920 rundll32.exe 71 1920 rundll32.exe 72 1920 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe 1920 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\Uncorked Studios.job regsvr32.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionTime = 806c665e9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionTime = 60c391b09031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionTime = 60c391b09031db01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92} rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionTime = e09833509031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000008000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000009000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionTime = 200dd0c29031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionTime = 200dd0c29031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionTime = c03551d39031db01 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionReason = "1" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\ee-64-e1-f6-da-ea rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDetectedUrl rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionTime = c033e56e9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionTime = 60611ce29031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionTime = 60611ce29031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionTime = 806c665e9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionTime = 204998a09031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionTime = c03551d39031db01 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecision = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionReason = "1" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecision = "0" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionTime = 007f48809031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionTime = 007f48809031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000a000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionTime = c033e56e9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000c000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionTime = 204998a09031db01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionTime = e09833509031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-64-e1-f6-da-ea\WpadDecisionTime = 00d5b68e9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000b000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f017f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadNetworkName = "Network 3" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CA843D61-7B15-4019-8DCB-8AFD80A83F92}\WpadDecisionTime = 00d5b68e9031db01 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2448 wrote to memory of 1920 2448 taskeng.exe 32 PID 2448 wrote to memory of 1920 2448 taskeng.exe 32 PID 2448 wrote to memory of 1920 2448 taskeng.exe 32 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\Updater.dll1⤵
- Drops file in Windows directory
PID:2520
-
C:\Windows\system32\taskeng.exetaskeng.exe {F6E90B05-A8AA-44E1-B3EF-83DEBDA966E0} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe "C:\ProgramData\Uncorked Studios\Updater.dll",Start /u2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD5e08edc1510052adc297d6af47022a70b
SHA1f08af6d4a2f9655beb8219aca5711400efed8670
SHA256915a80abb43f04fcdfb9ba2ced3b38f3524c050b6c0a36d97f4e7827916248b2
SHA5122b91019e3d96b57362719b9bddb7b894239977266d23e2c8b9ebbcd93a9ba748491b96a92c1b4fd1876e74a3b7f3da99b89bb0e38a463a8ae9f357d9d9f66652