Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    f47144c7159be31d8116fdc36b66cb72c917cd91a4bbe9eaa55dec929c1cffdd

  • Size

    129KB

  • Sample

    241130-pmatxatmhw

  • MD5

    80cd37d9eb33507bf054f32ce2380b09

  • SHA1

    6e8d57dde537ace0639931569ae2b04b9cb99a26

  • SHA256

    f47144c7159be31d8116fdc36b66cb72c917cd91a4bbe9eaa55dec929c1cffdd

  • SHA512

    18f42496c4a66f11aa834e1db7f727ea7041882408a83be00f5ddacfbca439debe611f24eadd19e9453bc774d91d33d98ac25290791d501af2e706dc9ef89bde

  • SSDEEP

    3072:Jhw2Pja55J8hTGMjctYnc/F5ipfVMFY1lz:Jhwv55WT7ctiiF5cv

Malware Config

Extracted

Family

warmcookie

C2

185.161.251.26

Attributes
  • mutex

    5bba9e40-0e32-4b7f-b39a-667bbc0c2293

Targets

    • Target

      f47144c7159be31d8116fdc36b66cb72c917cd91a4bbe9eaa55dec929c1cffdd

    • Size

      129KB

    • MD5

      80cd37d9eb33507bf054f32ce2380b09

    • SHA1

      6e8d57dde537ace0639931569ae2b04b9cb99a26

    • SHA256

      f47144c7159be31d8116fdc36b66cb72c917cd91a4bbe9eaa55dec929c1cffdd

    • SHA512

      18f42496c4a66f11aa834e1db7f727ea7041882408a83be00f5ddacfbca439debe611f24eadd19e9453bc774d91d33d98ac25290791d501af2e706dc9ef89bde

    • SSDEEP

      3072:Jhw2Pja55J8hTGMjctYnc/F5ipfVMFY1lz:Jhwv55WT7ctiiF5cv

    • Warmcookie family

    • Warmcookie, Badspace

      Warmcookie aka Badspace is a backdoor written in C++.

    • Blocklisted process makes network request

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks