We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
25 August 2024, 16:58
Analysis environment:
Windows 10 Pro, build 19045, x64
0f60a3e7baecf2748b1c8183ed37d1e4
MD5:
59B7B8D29252A9128536FBD08D24375F
SHA1:
7221B9125608A54F9DD706166F936C16EE23164A
SHA256:
B7AEC5F73D2A6BBD8CD920EDB4760E2EDADC98C3A45BF4FA994D47CA9CBD02F6
Analysis result
Threat level:
Malicious activity
Tags:
warmcookie
backdoor
Full analysis:
Analysis 0f60a3e7baecf2748b1c8183ed37d1e4 (MD5: 59B7B8D29252A9128536FBD08D24375F) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
WARMCOOKIE has been detected (YARA)
regsvr32.exe (PID: 6504)
rundll32.exe (PID: 7088)
SUSPICIOUS
Executable content was dropped or overwritten
regsvr32.exe (PID: 6504)
The process executes via Task Scheduler
rundll32.exe (PID: 7088)
Drops the executable file immediately after the start
regsvr32.exe (PID: 6504)
INFO
Creates files in the program directory
regsvr32.exe (PID: 6504)
Reads security settings of Internet Explorer
rundll32.exe (PID: 7088)
Checks proxy server information
rundll32.exe (PID: 7088)
Threats
No threats detected