Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

07537a8f7e...18.exe

windows7-x64

10

07537a8f7e...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/04/2024, 09:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118.exe

  • Size

    5.5MB

  • MD5

    07537a8f7e1a4207eb82c253fe296a8f

  • SHA1

    85d2beb1cd30e8342eabacb82bcdaa9f01018857

  • SHA256

    b30e0fbf03f4bc7481aae8d625a127105c8a601096408f99ed62878a9579425e

  • SHA512

    c29529f41f382b66a77952949795bb0bb48127070db97436cf1efa3538a257a0e562824177665aa570c5d11adf17ab7cc5d66f0c9aca76d8b85d82a8fb7d269a

  • SSDEEP

    98304:XfN28AUgZFJiJaOht/IIn3qWw7spWOpJoCt6XEki7/A5DDyb3dQLBDlhaHkwEA5L:vA7UgZFJiJJ/IIn1YOICtENJ5D2ZoBO7

Score
10/10
azorultkpotdiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://163.172.175.132/1A6B3831-A96D-4936-815A-6F7C904EF9C0/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

    trojanstealerkpot
  • KPOT Core Executable 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 23 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 57 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup1829.exe" /verysilent
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2056
      • C:\Users\Admin\AppData\Local\Temp\Setup1829.exe
        "C:\Users\Admin\AppData\Local\Temp\Setup1829.exe" /verysilent
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:2716
        • C:\Program Files (x86)\Crystall Idea\Uninstall Tool\1.exe
          "C:\Program Files (x86)\Crystall Idea\Uninstall Tool\1.exe" /silent
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:2608
          • C:\Users\Admin\AppData\Local\Temp\is-C8MMM.tmp\1.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-C8MMM.tmp\1.tmp" /SL5="$401A4,3102762,185856,C:\Program Files (x86)\Crystall Idea\Uninstall Tool\1.exe" /silent
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2476
            • C:\Windows\system32\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\utshellext.dll"
              6⤵
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Registers COM server for autorun
              • Modifies registry class
              PID:2036
            • C:\Windows\system32\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\utshellext_x86.dll"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1880
              • C:\Windows\SysWOW64\regsvr32.exe
                /s "C:\Program Files\Uninstall Tool\utshellext_x86.dll"
                7⤵
                • Loads dropped DLL
                • Modifies system executable filetype association
                • Modifies registry class
                PID:624
            • C:\Program Files\Uninstall Tool\UninstallTool.exe
              "C:\Program Files\Uninstall Tool\UninstallTool.exe" /install_service_silent
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:908
              • C:\Windows\system32\rundll32.exe
                rundll32.exe setupapi.dll, InstallHinfSection DefaultInstall 132 .\CisUtMonitor.inf
                7⤵
                • Drops file in Drivers directory
                • Adds Run key to start application
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:2252
                • C:\Windows\system32\runonce.exe
                  "C:\Windows\system32\runonce.exe" -r
                  8⤵
                  • Checks processor information in registry
                  PID:2360
                  • C:\Windows\System32\grpconv.exe
                    "C:\Windows\System32\grpconv.exe" -o
                    9⤵
                      PID:1772
              • C:\Program Files\Uninstall Tool\UninstallTool.exe
                "C:\Program Files\Uninstall Tool\UninstallTool.exe" /init
                6⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of SetWindowsHookEx
                PID:896
              • C:\Program Files\Uninstall Tool\UninstallTool.exe
                "C:\Program Files\Uninstall Tool\UninstallTool.exe" /add_control_panel_icon
                6⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:2056
              • C:\Program Files\Uninstall Tool\UninstallTool.exe
                "C:\Program Files\Uninstall Tool\UninstallTool.exe" /pin_to_taskbar
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2732
              • C:\Program Files\Uninstall Tool\UninstallToolExec.exe
                "C:\Program Files\Uninstall Tool\UninstallToolExec.exe"
                6⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                PID:2700
                • C:\Program Files\Uninstall Tool\UninstallTool.exe
                  "C:\Program Files\Uninstall Tool\UninstallTool.exe"
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Windows directory
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:2704
                  • C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
                    UninstallToolHelper.exe
                    8⤵
                    • Executes dropped EXE
                    PID:2772
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\File001.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1248
        • C:\Users\Admin\AppData\Local\Temp\File001.exe
          "C:\Users\Admin\AppData\Local\Temp\File001.exe"
          3⤵
          • Executes dropped EXE
          PID:2932
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\File002.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2712
        • C:\Users\Admin\AppData\Local\Temp\File002.exe
          "C:\Users\Admin\AppData\Local\Temp\File002.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:2180
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:584
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1272 CREDAT:275457 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1876

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\PROGRA~1\UNINST~2\CISUTM~1.SYS
        Filesize

        52KB

        MD5

        ce7f6aef1b27d41e7365700e74afc969

        SHA1

        eca24811ab520c1b3fc7dc07179311dc76ea8be8

        SHA256

        d03ae146525b6a0b43f9cc94cac672d65f91a57b9898e1093932561b22fdb50e

        SHA512

        e65b5871c1e711b3e3f866cb7c91fb62bde24bc6b1a1c1b5cf4a32cfd577a86b4615f44fb2bb629bca92b6e87deaa8fa6d8f0b00ad1677e3e75a3bb6dd7c6bc1

        Download Submit

      • C:\Program Files (x86)\Crystall Idea\Uninstall Tool\1.exe
        Filesize

        3.5MB

        MD5

        cc54a313a8e23a64e501056c6ba25bc7

        SHA1

        83a34de9ce945da1c8d582b322047a0ce9db1a4d

        SHA256

        1242f58b0f3825ca07e262e9c37e32731bf687374642870550bdbfb092e3bb97

        SHA512

        72092129f64a790a7a608fdb350ab6b635150ee4b4e76b694d1a2d354d505532b24b1d40b45aa9880d0d30ced7b2c3bcc9b8e779f836c13a77ed99a0da3cb3d0

        Download Submit

      • C:\Program Files (x86)\Crystall Idea\Uninstall Tool\Uninstall.exe
        Filesize

        97KB

        MD5

        9607e8cc411112371a34e7701a80b230

        SHA1

        e471940c6d0ab75ed87f41e1ebeafde459fe60b4

        SHA256

        da0d9e96f00c804e968ad99e683dcfb5a9e9703fda1291f09a9db2918c2be567

        SHA512

        d812fb36ed2df7be9e5b152a53205c5bb35979300097399b0be6f334a2cb64f62d53027cf30424eda26d0b1678ff772a792fb607b8523ce4c9098fb497d8ed2f

        Download Submit

      • C:\Program Files\Uninstall Tool\CisUtMonitor.inf
        Filesize

        2KB

        MD5

        ab33006d71573c73ea639a4d90923bf7

        SHA1

        3fb74cc71b41ca0c2abec7008e88737fef9ad66c

        SHA256

        416ca112938536cdc8191eea469479398e6ce01ec25a4830991d93142a46422f

        SHA512

        35df4cad9d9cfecc1e649b25daa052141d530dfafc57607fc806e3b7267fb802529867bbf5c508b14f82ac320a472d883b7e62fef081dfe865d7a1c61c77cc32

        Download Submit

      • C:\Program Files\Uninstall Tool\UninstallToolExec.exe
        Filesize

        218KB

        MD5

        ccda58e3bcd4da4fe22d5e80c3cfb27f

        SHA1

        71c23b3b6bc611d0030dde422d98e4a3659a4319

        SHA256

        f52683e6b16634a5ed2f5e99ec1d6e1f1d585e7f3feae88a47b200fea70375a7

        SHA512

        52a1bb1dbf2e50c66cca1aa81583daa0e1e55b42f6940334c5ed524e65d71bd3c49742f9664dd436772f3fc37406b800cb9284ab55b03814d61b5003a62f11ca

        Download Submit

      • C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
        Filesize

        423KB

        MD5

        4d454f8abe7860306da91c55ba9be042

        SHA1

        a83ce432ada547eac181e20e0249ea9c4b484843

        SHA256

        d323ce72e2cf82f061b4a62dfc212472f7850b4dffd3658193298c2232a04d0b

        SHA512

        1f099152c4f81135a18a5c8b52f4543505dba145c16879f37ff62815cd5adccd9b332d3b9164736acb411443f05ce4ef3e89c2d605e94b3593e770f0f8dce21b

        Download Submit

      • C:\Program Files\Uninstall Tool\languages\English.xml
        Filesize

        36KB

        MD5

        0fdb3264d678d048ecae17799df05cb4

        SHA1

        df4887043e8f437aa2a879b47772040f8347fc9f

        SHA256

        cd9a38aa64c6cfa2391a5f89b0c7cdf4cbfd63bf6d69d6620f12c736ce4d5892

        SHA512

        a4c9e76fd22c1ec8e44193d26355f6fdb067e6bdfe2084f6993ddbb18d790dacc71d6c9e28553dc6118ec31a96e9241cc5d38db6b53671ad6a69576ba611dedd

        Download Submit

      • C:\Program Files\Uninstall Tool\utshellext_x86.dll
        Filesize

        335KB

        MD5

        2f9c5a77aec3e3e4387320267d996f89

        SHA1

        a023bd77be6784e80b6381010e5a867c5f7ce542

        SHA256

        595df900ddd426ba124198782a027a09d356cfe7924b7f69fa51696377535e0f

        SHA512

        f283d6a163ad08348a35c347dd7f0c92746a6ebfb9709e8029f608eb0ba97309726c7aa17414f58a77672e56d8c6dacc062a537ab44dd552bc9110e726b1c220

        Download Submit

      • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uninstall Tool\UnÑ–nstall Tool.lnk
        Filesize

        904B

        MD5

        2b523bfa635d5305cf067e0f7d84d777

        SHA1

        cb9728394f8c1159caa75601acc05de300309360

        SHA256

        81d6e1aaa05341d0a1538af33700549f8b6ed9ce9b8378437813e10d84826ea8

        SHA512

        be8a1f3dea6eb84b1469ca06f222ff737d478631a612bd043a1745d905c7cb0029865263fcfe6931dceeb1f6961a195ed7d1936199a4b50b71802add7b63bd93

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\File001.exe
        Filesize

        481KB

        MD5

        3372d01659f43b8dffd5b14914b03890

        SHA1

        9c09efd4ff70674eafd1238525fc1bb127948404

        SHA256

        68d658155beff9b517aae6a26c3735c26ca6e1e026089403876e188cb23848a6

        SHA512

        5830689beaf260f2cbdc0d90029bf0b73246cf46f3346e4825c8d6613ce92c926132de35f9fe016f00441a5aa79a7c4288f6883566c15e54d89422dc2ea1dada

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\File002.exe
        Filesize

        195KB

        MD5

        71ca31e32c62557a91c072255c79b9ad

        SHA1

        1c03cc0471ac7b289b49f4ef9b2691d4282d3f5c

        SHA256

        59b790491d763421741300e1473d1d302ad96130cc26c1c87edaf7469d4d5885

        SHA512

        13691125da737a3915784db6ef9e990850ebb6f78c034ab98ca9676f9bf4b1b2b7bc8195f00e0a47d598c0a84582c7bf3291d1691d099c4374e7b1a1beba5876

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-C8MMM.tmp\1.tmp
        Filesize

        1.2MB

        MD5

        b7d0813e1f27e5b6b01b65a518731759

        SHA1

        b942b56e9cf826ea46c7e27b139f75e6d2605cfc

        SHA256

        7c0a7db43a4b649b3cd9e5ca8c1e0041a167a7339668b75dd1ec1c972b20fac4

        SHA512

        cbb7d217197af7ac375910df142d09c68d1c118f4e44652339494a1de5d7d57cc223c0b08d62597b66d01a6fba325ea1c94cce11d4bce128e0e7c1d03ecf1604

        Download Submit

      • C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\CachedData.dat
        Filesize

        2KB

        MD5

        b6356c3a9532dc9bb93407d397b9c747

        SHA1

        d8a8ba11982a8ad03d2c37ddd89d82df5054e7a3

        SHA256

        77ef749241a7666c2dbe5eacbad008bdfddb65dc8740f6df706fad7c0ac99817

        SHA512

        342e9c0fc75d099ef0a9ba3a75de6be3b41239a3a8e5cdc2d386cc6feb8f7431070150443ccbcd226a45d6b560682116600cc0bd263bfcea8eeedd50f1da0b3b

        Download Submit

      • C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\preferences.xml
        Filesize

        1KB

        MD5

        b686c239de5bc638271322d247c89bb4

        SHA1

        4986d1748bf439e299f19bf64df4d721770cfb77

        SHA256

        c0af4a2d740c7a45a69ff544b5173ad1ea6038e75af87b5306242f30fd3a6882

        SHA512

        ab2d036746e4f25f38710b26594a9fd463600d63da2d6ad8fcc0553f39c162738ed43e39b507e729690c67be993e34ee99d0cc13688532a79fb9a35a3350e067

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\269c0465f0b4b6ee.customDestinations-ms
        Filesize

        2KB

        MD5

        07b841e43db0bd9c75a6f9b00c2a8ce4

        SHA1

        960cc690f605884b3b0febe95df347ce8493f05d

        SHA256

        faabd5886447f7a07d5b2c3c981304e80716796879e8b6243e91ea77acbc1b1d

        SHA512

        d0f309d8b15fa79c4fb53b1900d65b231b3dbe479a7fd9c0bfc45057128f247696ca1fa61031955cad6e4e5d7c1a01c232887b8da4bdd4b720f161d8ef65ae33

        Download Submit

      • \Program Files\Uninstall Tool\UninstallTool.exe
        Filesize

        4.6MB

        MD5

        07acf83bda719741025b34a0671fc754

        SHA1

        426e6e512fb52290f49bd606a05bf12abb05e7ba

        SHA256

        61d9f616d3c1f22df0e7668e181b1c7910ea48a51b57519837dd5cadebc1cf04

        SHA512

        f27f17ccb2c486310fa1ee33115d349fa7a7708b5be216366a9ecc031d6d1a84073604446624568230fbcd4792beb6112f4b9f960213b517d5ba22a9ec26366a

        Download Submit

      • \Program Files\Uninstall Tool\utshellext.dll
        Filesize

        379KB

        MD5

        b45a9b037e1686b7c217bc406bc933af

        SHA1

        c3ef67fb58ced40c1312f0855d5c897c08b4e1bb

        SHA256

        e589ba19b06772570ab1d36675fe1f0a201760f6b16f1a1f3b374b695070fe7f

        SHA512

        6b47f29d9df2ab22735bfe7cede43ac3af7cefc75a58c90daeebf10c2e5fd92a1132f035d78e47573524ad0091152422779b74957be897e6777ef6a9de065919

        Download Submit

      • \Users\Admin\AppData\Local\Temp\Setup1829.exe
        Filesize

        3.7MB

        MD5

        811c36d10c8cb9d7eb4023755939c389

        SHA1

        f77c8cc3369d341fe5f4e8a0ada22aacbe5dd2d6

        SHA256

        0b37b021a61d3352ff8e5d43f185d08ad1245938ab22123c9b58d661ff731620

        SHA512

        c16cb83746b0108566d2c74c86cafd03ded6cc6d57fd0e71f44598f8ad72fed03ebe6f2d4fa4d33937477656e1231bb38104a53ff26a9ce744c08e57d07effe7

        Download Submit

      • memory/1976-7-0x0000000076880000-0x0000000076881000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1976-9-0x0000000000400000-0x0000000000FAB000-memory.dmp

        Filesize

        11.7MB

        Download

      • memory/1976-251-0x0000000000400000-0x0000000000FAB000-memory.dmp

        Filesize

        11.7MB

        Download

      • memory/1976-3-0x0000000077C50000-0x0000000077C51000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1976-1-0x0000000077C50000-0x0000000077C51000-memory.dmp

        Filesize

        4KB

        Download

      • memory/1976-0-0x0000000000400000-0x0000000000FAB000-memory.dmp

        Filesize

        11.7MB

        Download

      • memory/1976-11-0x0000000077C50000-0x0000000077C51000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2180-200-0x0000000000400000-0x0000000000919000-memory.dmp

        Filesize

        5.1MB

        Download

      • memory/2476-237-0x0000000000400000-0x000000000053D000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/2608-242-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/2608-47-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/2716-45-0x0000000000400000-0x0000000000433000-memory.dmp

        Filesize

        204KB

        Download

      • memory/2772-248-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2772-252-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2932-158-0x0000000000400000-0x000000000047D000-memory.dmp

        Filesize

        500KB

        Download

      • memory/2932-250-0x0000000000400000-0x000000000047D000-memory.dmp

        Filesize

        500KB

        Download

      • memory/2932-259-0x0000000000400000-0x000000000047D000-memory.dmp

        Filesize

        500KB

        Download

      • memory/2932-263-0x0000000000400000-0x000000000047D000-memory.dmp

        Filesize

        500KB

        Download