Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
08-05-2024 14:21
General
-
Target
253f2634f49b429623ee33b9523d05bd_JaffaCakes118.exe
-
Size
162KB
-
MD5
253f2634f49b429623ee33b9523d05bd
-
SHA1
efab3a443f5aa931dbbcad6ef0a1aae3f83dd90e
-
SHA256
fe7e3ce36c54f630e0047680c8878bf618568e5e4c22b36ae4c283ddc608c3d8
-
SHA512
fe4eb06cfbbf8d4028bee82c3985d961b24cd5628172080a8e3686dd7b4616067359f08328eea3a0eeacff9be32843515b0a8caeaca51fcdde4c4c9ce66ee602
-
SSDEEP
3072:aKyX0uho/5Fywx0S4os5W+si+dnktV8Ce+eYyRu16muk/Tfajgqnxd:a5k5FPzx+R+utj7yk162CjJ
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://51.15.62.59/AED77D05-A028-477C-B013-04F33F1385C3/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\253f2634f49b429623ee33b9523d05bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\253f2634f49b429623ee33b9523d05bd_JaffaCakes118.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 12362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 620 -ip 6201⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
352KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
352KB
-
Filesize
128KB