Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11/12/2024, 15:53
General
-
Target
f75158de839346c9a029d30fb806cb6b4cefa12cd2eb2fe6b58703e91261c27aN.exe
-
Size
4.3MB
-
MD5
df396cf675609c231fa1a10db500a580
-
SHA1
650ebb9a215dd32d170030bab5f0c146fcb8728b
-
SHA256
f75158de839346c9a029d30fb806cb6b4cefa12cd2eb2fe6b58703e91261c27a
-
SHA512
a0898ce8ebf4521e356765ba962b1788c250ba2b5236d8923ed31a7ef95cc8fe03bb19d53db083cbff4665add99199569c42b329bd3d529208f41a150811fc12
-
SSDEEP
98304:hd+YP3dtWIHT04RKrWavmJa9bVu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996KcK:hhP3/WIw3+aNVu0VLGMb5Cx0taAUgLdD
Malware Config
Extracted
warmcookie
149.248.7.220
-
mutex
1616f1db-46d4-41cb-8e3d-6472fa64014d
-
user_agent
Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0
Signatures
-
Warmcookie family
-
Warmcookie, Badspace
Warmcookie aka Badspace is a backdoor written in C++.
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\f75158de839346c9a029d30fb806cb6b4cefa12cd2eb2fe6b58703e91261c27aN.exe"C:\Users\Admin\AppData\Local\Temp\f75158de839346c9a029d30fb806cb6b4cefa12cd2eb2fe6b58703e91261c27aN.exe"1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
28.7MB
-
Filesize
28.7MB