Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1196s -
max time network
1198s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
13/11/2024, 13:52
Behavioral task
behavioral1
Sample
Updater.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Updater.dll
Resource
win11-20241007-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
launcher.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
launcher.bat
Resource
win11-20241007-en
windows11-21h2-x64
General
-
Target
Updater.dll
-
Size
129KB
-
MD5
e08edc1510052adc297d6af47022a70b
-
SHA1
f08af6d4a2f9655beb8219aca5711400efed8670
-
SHA256
915a80abb43f04fcdfb9ba2ced3b38f3524c050b6c0a36d97f4e7827916248b2
-
SHA512
2b91019e3d96b57362719b9bddb7b894239977266d23e2c8b9ebbcd93a9ba748491b96a92c1b4fd1876e74a3b7f3da99b89bb0e38a463a8ae9f357d9d9f66652
-
SSDEEP
3072:Jhw2Pja55J8hTGMjctYnc/F5ipfVMFY3lz:Jhwv55WT7ctiiF5cV
Malware Config
Extracted
warmcookie
-
mutex
65abfc80-a660-4691-a919-130dc9b75b98
Signatures
-
Warmcookie family
-
Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
-
Blocklisted process makes network request 64 IoCs
flow pid Process 1 952 rundll32.exe 2 952 rundll32.exe 4 952 rundll32.exe 5 952 rundll32.exe 6 952 rundll32.exe 7 952 rundll32.exe 8 952 rundll32.exe 9 952 rundll32.exe 10 952 rundll32.exe 11 952 rundll32.exe 12 952 rundll32.exe 13 952 rundll32.exe 14 952 rundll32.exe 16 952 rundll32.exe 17 952 rundll32.exe 18 952 rundll32.exe 19 952 rundll32.exe 20 952 rundll32.exe 21 952 rundll32.exe 22 952 rundll32.exe 23 952 rundll32.exe 24 952 rundll32.exe 25 952 rundll32.exe 26 952 rundll32.exe 27 952 rundll32.exe 28 952 rundll32.exe 29 952 rundll32.exe 30 952 rundll32.exe 31 952 rundll32.exe 32 952 rundll32.exe 33 952 rundll32.exe 34 952 rundll32.exe 35 952 rundll32.exe 36 952 rundll32.exe 37 952 rundll32.exe 38 952 rundll32.exe 39 952 rundll32.exe 40 952 rundll32.exe 41 952 rundll32.exe 42 952 rundll32.exe 43 952 rundll32.exe 44 952 rundll32.exe 45 952 rundll32.exe 46 952 rundll32.exe 47 952 rundll32.exe 48 952 rundll32.exe 49 952 rundll32.exe 50 952 rundll32.exe 51 952 rundll32.exe 52 952 rundll32.exe 53 952 rundll32.exe 54 952 rundll32.exe 55 952 rundll32.exe 56 952 rundll32.exe 57 952 rundll32.exe 58 952 rundll32.exe 59 952 rundll32.exe 60 952 rundll32.exe 61 952 rundll32.exe 62 952 rundll32.exe 63 952 rundll32.exe 64 952 rundll32.exe 65 952 rundll32.exe 66 952 rundll32.exe -
Loads dropped DLL 1 IoCs
pid Process 952 rundll32.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\SoftServe.job regsvr32.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" rundll32.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\Updater.dll1⤵
- Drops file in Windows directory
PID:2960
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe "C:\ProgramData\SoftServe\Updater.dll",Start /u1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129KB
MD5e08edc1510052adc297d6af47022a70b
SHA1f08af6d4a2f9655beb8219aca5711400efed8670
SHA256915a80abb43f04fcdfb9ba2ced3b38f3524c050b6c0a36d97f4e7827916248b2
SHA5122b91019e3d96b57362719b9bddb7b894239977266d23e2c8b9ebbcd93a9ba748491b96a92c1b4fd1876e74a3b7f3da99b89bb0e38a463a8ae9f357d9d9f66652