Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    rad59AD5.exe

  • Size

    53KB

  • Sample

    250125-z1pv4azphs

  • MD5

    1a28984d6db3abdb967c0c19b56f887d

  • SHA1

    b815a93dedd5575a77b5fa9c0d77a9bc783cdb27

  • SHA256

    b2b67092d3978b0a199c949591bb1872cbc49b91494726a513be407abc2ca6a9

  • SHA512

    63e255c48e9c36485e6e7bc31319fd407027829713cef93dd61edf132949ce3c2de741a70f6ba90347e3d0aa7112acc95b71a7405711eab925f5a491cd5d513f

  • SSDEEP

    768:g9QHl5zJLsXpwnPA9KYMGZC7SNichPH/kGFyHxr6a6GPxxoqMo5ydqP+qL3i3:g2dJn7dSfjof2Jo5PM

Score
10/10

Malware Config

Extracted

Family

warmcookie

C2

149.248.58.85

Attributes
  • mutex

    3e4d7a5b-aa72-4d5f-8f8c-b292257af55c

  • user_agent

    Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0

Targets

    • Target

      rad59AD5.exe

    • Size

      53KB

    • MD5

      1a28984d6db3abdb967c0c19b56f887d

    • SHA1

      b815a93dedd5575a77b5fa9c0d77a9bc783cdb27

    • SHA256

      b2b67092d3978b0a199c949591bb1872cbc49b91494726a513be407abc2ca6a9

    • SHA512

      63e255c48e9c36485e6e7bc31319fd407027829713cef93dd61edf132949ce3c2de741a70f6ba90347e3d0aa7112acc95b71a7405711eab925f5a491cd5d513f

    • SSDEEP

      768:g9QHl5zJLsXpwnPA9KYMGZC7SNichPH/kGFyHxr6a6GPxxoqMo5ydqP+qL3i3:g2dJn7dSfjof2Jo5PM

    Score
    10/10
    • Warmcookie family

    • Warmcookie, Badspace

      Warmcookie aka Badspace is a backdoor written in C++.

    • Blocklisted process makes network request

    • Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks