Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

086ad72464...18.exe

windows7-x64

10

086ad72464...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    55s
  • max time network
    55s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2024, 19:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    086ad72464c81ec4d085884aa9c907a3_JaffaCakes118.exe

  • Size

    141KB

  • MD5

    086ad72464c81ec4d085884aa9c907a3

  • SHA1

    302439b844d811e1edbb5b96a4716dfaa5b6ad3f

  • SHA256

    484df75609f0617fa19580c4572f21bbef0f3861c803a100774084b805c7544b

  • SHA512

    b7272bf4bde47e669356ca1118c1f0a56c9a1e47c9e26e72764f23c6af126338451342da4eb89196ef01192649c737aa9b9161e8fe63458178a72aeda9b11d55

  • SSDEEP

    3072:nPACH0VQkWZ67j82BJwV5Hym4NAw6EtaO8RFf6GmuoOCs2uMRjHK:nJZWTNJz83C3DOC8M1q

Score
10/10
azorultinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://cg78822.tmweb.ru/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 20 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\086ad72464c81ec4d085884aa9c907a3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\086ad72464c81ec4d085884aa9c907a3_JaffaCakes118.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2340
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 716
      2⤵
      • Program crash
      PID:3544
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2340 -ip 2340
    1⤵
      PID:3020

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2340-0-0x00000000004D0000-0x00000000004E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2340-1-0x0000000000400000-0x0000000000431000-memory.dmp

      Filesize

      196KB

      Download

    • memory/2340-2-0x0000000000400000-0x0000000000431000-memory.dmp

      Filesize

      196KB

      Download

    • memory/2340-3-0x0000000000400000-0x0000000000431000-memory.dmp

      Filesize

      196KB

      Download

    • memory/2340-4-0x00000000004D0000-0x00000000004E0000-memory.dmp

      Filesize

      64KB

      Download