Analysis
-
max time kernel
134s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
03-05-2024 12:35
General
-
Target
1087dc61f973f13367ea32ba9ac5e3f9_JaffaCakes118.exe
-
Size
7.3MB
-
MD5
1087dc61f973f13367ea32ba9ac5e3f9
-
SHA1
6acb488bb5a8c1ad597988ee6f3ef6dc1e104aaf
-
SHA256
1dd2a8cfc0af9463edcdbd0ec6d78b8a9253b9e8c964543dcc2f5be9883a11de
-
SHA512
209b514840f4105acd72f54e010759f807aa532f99fc9b92e3c77b992bd64ff6bda5b022e6b51f2fa275b96205ee6d215cd2f012754dfbb43b0a236a50d51220
-
SSDEEP
196608:kYjLO64m7a5lii3/vxlC7LmaNzsZbfi4r0OK1TndtMD2c0BK+HZYw:NS64IaTicvxlC7bNg1nQR56D2cYd
Malware Config
Extracted
azorult
http://loqiworou7213.icu/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 7 IoCs
-
Registers COM server for autorun 1 TTPs 2 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 4 IoCs
-
Drops file in Program Files directory 36 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Modifies registry class 52 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 14 IoCs
-
Suspicious use of SendNotifyMessage 13 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1087dc61f973f13367ea32ba9ac5e3f9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1087dc61f973f13367ea32ba9ac5e3f9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cexplorer.exe"C:\Users\Admin\AppData\Roaming\cexplorer.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-C1LQ5.tmp\cexplorer.tmp"C:\Users\Admin\AppData\Local\Temp\is-C1LQ5.tmp\cexplorer.tmp" /SL5="$F004A,6397385,121344,C:\Users\Admin\AppData\Roaming\cexplorer.exe" /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /SP-3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /trialregister4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /replaceexplorer4⤵
- Executes dropped EXE
- Registers COM server for autorun
- Adds Run key to start application
- Modifies registry class
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonFolder.exe" /update4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe"C:\Program Files (x86)\Chameleon Explorer\ChameleonExplorer.exe" /update4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
-
-
-
-
C:\Users\Admin\AppData\Roaming\update.exe"C:\Users\Admin\AppData\Roaming\update.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 14083⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2524 -ip 25241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.4MB
MD592a3d0847fc622b31f2d0c273a676c0e
SHA1e642d694367cc98a8863d87fec82e4cf940eb48a
SHA2569a9923c08d3fc5937b6ed189e20cf416482a079bc0c898c4ed75329e0ee3ae89
SHA51201d13fd9a0dd52bc2e3f17af7a999682201c99ecf7218bca254a4944a483fd1dec2a3e6d59def501a024ad760b849787902ecb55bd33d23fa9651c0a7689cd1c
-
Filesize
4.4MB
MD55b0ae3fac33c08145dca4a9c272ebc34
SHA1940f504d835fc254602953495320bb92456177b9
SHA256137723bdd388f6e5a50b7942eff02f4cc70e6b86d8650a41f9e8956ea1e4de3b
SHA512015ffc133ad3a6937222bbc057f68b60abfe22b900b5e7c4e6ca3ec7dc6b09abaf54b595f00fa9212f370da8531af1ac5fc52b39953e1f685e81c66d1ec61f8a
-
Filesize
786KB
MD5dd5ce4d765edd75eba6f311e6e0ea10a
SHA19ea7f6516e5ad0755b74463d427055f63ed1a664
SHA25664b7f8f70a7b037d10da72eaa769078b7e4d1ac8964c5eae5515d373e816ed6d
SHA512d2782310df7cc533cc9ffaf5c1903d5bc6a500c3bbe48148c1339fb5de19c835e4a8c765da1b80b3744ea231353f76f22ba4e04c78a3d950d7ee291d6eab2216
-
Filesize
1.2MB
MD5de5f74ef4e17b2dc8ad69a3e9b8d22c7
SHA142df8fedc56761041bce47b84bd4e68ee75448d2
SHA256b89a6a57b48be10103825440d2157f2c4a56e4c6b79ad13f729429cd5393bf32
SHA512515e9b498d8cd9bb03f8d9758e891d073627dfd6fb0b931650a47d6e53722aa6e1cc3caff8c0e64f4721ad2abef7a81ef4e7b49952d3c8fc325deb5bba6b3314
-
Filesize
750KB
MD5fb76f4f533203e40ce30612a47171f94
SHA1304ba296c77a93ddb033d52578fcc147397db981
SHA2563de05f18ffe9fda589a45ea539a464e58a30f70d59d71444b018064cf831c4a6
SHA512a416a6d6efbbd69209e1867f12b9d1d11b21160f6dfe07c510b43112c22c317f805c67dd9402744a6c7e1541f6b3a061c49942fe28fa70f74aea670ba9c71995
-
Filesize
1.2MB
MD596f92c8368c1e922692f399db96da1eb
SHA11a91d68f04256ef3bc1022beb616ba65271bd914
SHA256161408b86eed7c4d9a5882aa00df3f8765ed28fa4fd9aab2c9b3dceadbd527f9
SHA512b3d3fb2d78fe2df864f0e07a8bc1610ee9d65251957e0495a34c1631895293590e0fca965ec9deb160f48a4e09a2feabd3bff6fb9a0c22888a941e308de39d14
-
Filesize
1.1MB
MD5729bc0108bcd7ec083dfa83d7a4577f2
SHA10b4efa5e1764b4ce3e3ae601c8655c7bb854a973
SHA256b1c68b1582ebb5f465512a0b834ccac095460b29136b6c7eea0475612bf16b49
SHA51249c83533ce88d346651d59d855cff18190328795401c1277f4e3d32ff34f207d2c35f026785aa6c4a85624d88bf8c927654907faf50db1d57447730d9d6ac44c
-
Filesize
6.5MB
MD5b2e5a8fe3ca4f0cd681b5662f972ea5f
SHA1b7dbcfaee55ecbf0158431d85dabdd479ab449c7
SHA256e71c48c03b8cfd37bf17e62460733a4bfe9c484e947fd9db291f65405a2ba9e8
SHA51240b7140f5c182cd51cee142a2575bd70dc9bde311ad3952119fb9769b5ceeb467695aa5a66fc90520712d9a39458930efb965496d6443665b7597cfd66247aaf
-
Filesize
154KB
MD5c07609ccb32c50d7899c5be7adc0f6fc
SHA10625171c9c42a02080cabb9edbfc765fd4bbd6c9
SHA2569996d7a97ef90eab2a2ff8f795fd064dfb9808fb206c64455a798e035ca93305
SHA512dec1b6769f8dc7f5e687badda50aaf102271a0fb443236b2f44a5237c87b7a17d6de95a843cb9e6e74f79ab26e06baf0acc3a807c36cf45c9a311cc0dd41eb42
-
Filesize
6.2MB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
68KB
-
Filesize
172KB
-
Filesize
7.9MB
-
Filesize
7.9MB
-
Filesize
16.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
16.2MB
-
Filesize
16.2MB