Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/04/2021, 13:50
210406-gc51ndzsc2 1026/03/2021, 23:40
210326-d1ybrjhevx 1013/03/2021, 17:16
210313-8s7b52z63e 1005/03/2021, 14:52
210305-34k3zj54f2 1001/03/2021, 13:17
210301-naamxpgf4e 1028/02/2021, 20:46
210228-6q3b959xae 1028/02/2021, 20:15
210228-mbr268za12 1028/02/2021, 18:32
210228-h944b5cpxa 1028/02/2021, 15:10
210228-hnwwpyjy7j 10Analysis
-
max time kernel
678s -
max time network
676s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13/03/2021, 17:16
Static task
static1
Behavioral task
behavioral1
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe
-
Size
9.2MB
-
MD5
b806267b5f3b7760df56396b1cf05e6d
-
SHA1
5166d4c1d3e476281d9e991eababc3e4aa9ec5ad
-
SHA256
f95d12a0dbd8199d16f48d8e4cbe69a8d4ec16c534efb36e52a662664e1c1783
-
SHA512
30e393bb3898edc8ab5fb04e62ce421ddf3903075f59e3880408b300f46bb74a85088336d6e1203b2101152cebeef4c1730290b41ca77604ecb722c8f627328b
Malware Config
Extracted
Family
azorult
C2
http://kvaka.li/1210776429.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Executes dropped EXE 6 IoCs
pid Process 608 keygen-pr.exe 1152 keygen-step-1.exe 1688 keygen-step-3.exe 1532 keygen-step-4.exe 768 key.exe 784 key.exe -
Loads dropped DLL 10 IoCs
pid Process 1708 cmd.exe 1708 cmd.exe 1708 cmd.exe 1708 cmd.exe 1708 cmd.exe 608 keygen-pr.exe 608 keygen-pr.exe 608 keygen-pr.exe 608 keygen-pr.exe 768 key.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 768 set thread context of 784 768 key.exe 39 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1668 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 768 key.exe 768 key.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeImpersonatePrivilege 768 key.exe Token: SeTcbPrivilege 768 key.exe Token: SeChangeNotifyPrivilege 768 key.exe Token: SeCreateTokenPrivilege 768 key.exe Token: SeBackupPrivilege 768 key.exe Token: SeRestorePrivilege 768 key.exe Token: SeIncreaseQuotaPrivilege 768 key.exe Token: SeAssignPrimaryTokenPrivilege 768 key.exe Token: SeImpersonatePrivilege 768 key.exe Token: SeTcbPrivilege 768 key.exe Token: SeChangeNotifyPrivilege 768 key.exe Token: SeCreateTokenPrivilege 768 key.exe Token: SeBackupPrivilege 768 key.exe Token: SeRestorePrivilege 768 key.exe Token: SeIncreaseQuotaPrivilege 768 key.exe Token: SeAssignPrimaryTokenPrivilege 768 key.exe Token: SeImpersonatePrivilege 768 key.exe Token: SeTcbPrivilege 768 key.exe Token: SeChangeNotifyPrivilege 768 key.exe Token: SeCreateTokenPrivilege 768 key.exe Token: SeBackupPrivilege 768 key.exe Token: SeRestorePrivilege 768 key.exe Token: SeIncreaseQuotaPrivilege 768 key.exe Token: SeAssignPrimaryTokenPrivilege 768 key.exe Token: SeImpersonatePrivilege 768 key.exe Token: SeTcbPrivilege 768 key.exe Token: SeChangeNotifyPrivilege 768 key.exe Token: SeCreateTokenPrivilege 768 key.exe Token: SeBackupPrivilege 768 key.exe Token: SeRestorePrivilege 768 key.exe Token: SeIncreaseQuotaPrivilege 768 key.exe Token: SeAssignPrimaryTokenPrivilege 768 key.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1708 1832 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 29 PID 1832 wrote to memory of 1708 1832 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 29 PID 1832 wrote to memory of 1708 1832 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 29 PID 1832 wrote to memory of 1708 1832 [CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe 29 PID 1708 wrote to memory of 608 1708 cmd.exe 31 PID 1708 wrote to memory of 608 1708 cmd.exe 31 PID 1708 wrote to memory of 608 1708 cmd.exe 31 PID 1708 wrote to memory of 608 1708 cmd.exe 31 PID 1708 wrote to memory of 608 1708 cmd.exe 31 PID 1708 wrote to memory of 608 1708 cmd.exe 31 PID 1708 wrote to memory of 608 1708 cmd.exe 31 PID 1708 wrote to memory of 1152 1708 cmd.exe 34 PID 1708 wrote to memory of 1152 1708 cmd.exe 34 PID 1708 wrote to memory of 1152 1708 cmd.exe 34 PID 1708 wrote to memory of 1152 1708 cmd.exe 34 PID 1708 wrote to memory of 1688 1708 cmd.exe 32 PID 1708 wrote to memory of 1688 1708 cmd.exe 32 PID 1708 wrote to memory of 1688 1708 cmd.exe 32 PID 1708 wrote to memory of 1688 1708 cmd.exe 32 PID 1708 wrote to memory of 1532 1708 cmd.exe 33 PID 1708 wrote to memory of 1532 1708 cmd.exe 33 PID 1708 wrote to memory of 1532 1708 cmd.exe 33 PID 1708 wrote to memory of 1532 1708 cmd.exe 33 PID 608 wrote to memory of 768 608 keygen-pr.exe 36 PID 608 wrote to memory of 768 608 keygen-pr.exe 36 PID 608 wrote to memory of 768 608 keygen-pr.exe 36 PID 608 wrote to memory of 768 608 keygen-pr.exe 36 PID 608 wrote to memory of 768 608 keygen-pr.exe 36 PID 608 wrote to memory of 768 608 keygen-pr.exe 36 PID 608 wrote to memory of 768 608 keygen-pr.exe 36 PID 1688 wrote to memory of 1584 1688 keygen-step-3.exe 37 PID 1688 wrote to memory of 1584 1688 keygen-step-3.exe 37 PID 1688 wrote to memory of 1584 1688 keygen-step-3.exe 37 PID 1688 wrote to memory of 1584 1688 keygen-step-3.exe 37 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 768 wrote to memory of 784 768 key.exe 39 PID 1584 wrote to memory of 1668 1584 cmd.exe 40 PID 1584 wrote to memory of 1668 1584 cmd.exe 40 PID 1584 wrote to memory of 1668 1584 cmd.exe 40 PID 1584 wrote to memory of 1668 1584 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"C:\Users\Admin\AppData\Local\Temp\[CRACKHEAP.NET]PW12345Easeus_Data_Recovery_Wizard_8_keygen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
PID:784
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
PID:1668
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
PID:1532
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
PID:1152
-
-