Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
295s -
max time network
296s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/11/2024, 03:42
Behavioral task
behavioral1
Sample
Updater.dll
Resource
win7-20241010-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
Updater.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
300 seconds
Behavioral task
behavioral3
Sample
launcher.bat
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral4
Sample
launcher.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
launcher.bat
-
Size
61B
-
MD5
71fc33d2c87facdfbb2499300fc2bedd
-
SHA1
40ab3ac01282ce3c4df44afc5e73c6d7a7502430
-
SHA256
2f36e33a436d6f565230ba1dafc9dea801599d47a9ff3fbb940a200f43d8b3ae
-
SHA512
588b393c79c7ca748f4b4cc8fbffd7d221956bfcf9e8c4b73a0fd6d84527ecad050c5a9312fb608fc1cf276fb0149777a8d551b64af0869680beb17ff0670f2d
Score
10/10
Malware Config
Extracted
Family
warmcookie
Attributes
-
mutex
65abfc80-a660-4691-a919-130dc9b75b98
Signatures
-
Warmcookie family
-
Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
-
Blocklisted process makes network request 58 IoCs
flow pid Process 4 2892 rundll32.exe 5 2892 rundll32.exe 6 2892 rundll32.exe 7 2892 rundll32.exe 8 2892 rundll32.exe 9 2892 rundll32.exe 11 2892 rundll32.exe 12 2892 rundll32.exe 13 2892 rundll32.exe 14 2892 rundll32.exe 15 2892 rundll32.exe 16 2892 rundll32.exe 18 2892 rundll32.exe 19 2892 rundll32.exe 20 2892 rundll32.exe 21 2892 rundll32.exe 22 2892 rundll32.exe 23 2892 rundll32.exe 25 2892 rundll32.exe 26 2892 rundll32.exe 27 2892 rundll32.exe 28 2892 rundll32.exe 29 2892 rundll32.exe 30 2892 rundll32.exe 32 2892 rundll32.exe 33 2892 rundll32.exe 34 2892 rundll32.exe 35 2892 rundll32.exe 36 2892 rundll32.exe 37 2892 rundll32.exe 39 2892 rundll32.exe 40 2892 rundll32.exe 41 2892 rundll32.exe 42 2892 rundll32.exe 43 2892 rundll32.exe 44 2892 rundll32.exe 46 2892 rundll32.exe 47 2892 rundll32.exe 48 2892 rundll32.exe 49 2892 rundll32.exe 50 2892 rundll32.exe 51 2892 rundll32.exe 53 2892 rundll32.exe 54 2892 rundll32.exe 55 2892 rundll32.exe 56 2892 rundll32.exe 57 2892 rundll32.exe 58 2892 rundll32.exe 60 2892 rundll32.exe 61 2892 rundll32.exe 62 2892 rundll32.exe 63 2892 rundll32.exe 64 2892 rundll32.exe 65 2892 rundll32.exe 67 2892 rundll32.exe 68 2892 rundll32.exe 69 2892 rundll32.exe 70 2892 rundll32.exe -
Loads dropped DLL 4 IoCs
pid Process 2892 rundll32.exe 2892 rundll32.exe 2892 rundll32.exe 2892 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\SoftServe.job rundll32.exe -
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionTime = e05b7b5e9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionTime = 60ab5b909031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000008000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionTime = 2066a2a19031db01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionReason = "1" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionTime = e01b33509031db01 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadNetworkName = "Network 3" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionTime = a06d7cd69031db01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionTime = 20b2f16f9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionTime = 00683d7f9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionTime = 8080c9c39031db01 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDetectedUrl rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000007000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionTime = 8080c9c39031db01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0} rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000009000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionTime = a06d7cd69031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionTime = 00675fe59031db01 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecision = "0" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000006000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionTime = 200e15b49031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000b000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionTime = 60ab5b909031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionTime = e05b7b5e9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionTime = 00683d7f9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionTime = 20b2f16f9031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionTime = 2066a2a19031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecisionTime = 200e15b49031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000a000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionReason = "1" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionTime = e01b33509031db01 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 460000000c000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0177000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-c3-a9-eb-ea-38\WpadDecisionTime = 00675fe59031db01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\0a-c3-a9-eb-ea-38 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA2D1478-0DD4-4213-AC7C-37711A83D4D0}\WpadDecision = "0" rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2788 wrote to memory of 1772 2788 cmd.exe 31 PID 2788 wrote to memory of 1772 2788 cmd.exe 31 PID 2788 wrote to memory of 1772 2788 cmd.exe 31 PID 2720 wrote to memory of 2892 2720 taskeng.exe 34 PID 2720 wrote to memory of 2892 2720 taskeng.exe 34 PID 2720 wrote to memory of 2892 2720 taskeng.exe 34 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\launcher.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\system32\rundll32.exerundll32.exe Updater.dll,Start2⤵
- Drops file in Windows directory
PID:1772
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {48D88D47-7AFB-4773-9FDB-86C6217A7A05} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe "C:\ProgramData\SoftServe\Updater.dll",Start /u2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2892
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD5e08edc1510052adc297d6af47022a70b
SHA1f08af6d4a2f9655beb8219aca5711400efed8670
SHA256915a80abb43f04fcdfb9ba2ced3b38f3524c050b6c0a36d97f4e7827916248b2
SHA5122b91019e3d96b57362719b9bddb7b894239977266d23e2c8b9ebbcd93a9ba748491b96a92c1b4fd1876e74a3b7f3da99b89bb0e38a463a8ae9f357d9d9f66652