Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
53s -
max time network
66s -
platform
windows7_x64 -
resource
win7 -
submitted
07/07/2020, 17:24
Static task
static1
Behavioral task
behavioral1
Sample
Data Sheet.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Data Sheet.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
Data Sheet.exe
-
Size
623KB
-
MD5
c547dc9b16fab08be2031db5d1d4b115
-
SHA1
8dd7522d227d1a7e65dbdff56ec3b0ec622645fe
-
SHA256
1132a1b1791adcf0f75bbde81828976f2cf222ed605abf3d363f9fa90ee208bd
-
SHA512
71648b7ec372a364262b26c8d1532eadccbf7d00ac2fe58ce303a59d401e762222d529ddb923311537356c3212c393159b6cfe57bf81930864e2cfaf30060c74
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://165.22.238.171/index.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1100 set thread context of 1256 1100 Data Sheet.exe 24 -
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1100 Data Sheet.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1100 wrote to memory of 1256 1100 Data Sheet.exe 24 PID 1100 wrote to memory of 1256 1100 Data Sheet.exe 24 PID 1100 wrote to memory of 1256 1100 Data Sheet.exe 24 PID 1100 wrote to memory of 1256 1100 Data Sheet.exe 24 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1100 Data Sheet.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Data Sheet.exe"C:\Users\Admin\AppData\Local\Temp\Data Sheet.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\Data Sheet.exe"C:\Users\Admin\AppData\Local\Temp\Data Sheet.exe"2⤵PID:1256
-