Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 14:15

General

  • Target

    2f86c44bc12869fe3f4b36349dc8857e_JaffaCakes118.exe

  • Size

    689KB

  • MD5

    2f86c44bc12869fe3f4b36349dc8857e

  • SHA1

    a2169f1c07e5cf666be3caa015e9c47dc08c93ac

  • SHA256

    589dddf6404f79d3832bf8cf43d42b6c99d474b307a2297087b492fa21d78570

  • SHA512

    a624127da000a5af856fc41e40ed5e1ea7e4c22295f706a8db907494c15a30a97020ad30220bc217130a018805d51dacaed69f07b5d400d5ce36c7b961ddb461

  • SSDEEP

    12288:9vAazMzw8kRQ/fQChNZ8P2yz3zHythCtsgm5wnf6t50bNyq+H+LuFUTM5IAZdNOE:1AOMzxkS/fQChNZ8P2yz3zHythCtsgmz

Malware Config

Extracted

Family

azorult

C2

http://185.195.236.168/kay/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f86c44bc12869fe3f4b36349dc8857e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2f86c44bc12869fe3f4b36349dc8857e_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3140
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
      2⤵
        PID:4496

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3140-22-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-20-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-18-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-3-0x00000000050D0000-0x00000000050F6000-memory.dmp

      Filesize

      152KB

    • memory/3140-4-0x0000000074710000-0x0000000074EC0000-memory.dmp

      Filesize

      7.7MB

    • memory/3140-38-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-32-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-56-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-57-0x0000000005120000-0x0000000005140000-memory.dmp

      Filesize

      128KB

    • memory/3140-58-0x0000000074710000-0x0000000074EC0000-memory.dmp

      Filesize

      7.7MB

    • memory/3140-54-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-50-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-48-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-46-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-44-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-42-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-41-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-30-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-28-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-52-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-1-0x0000000000720000-0x00000000007D2000-memory.dmp

      Filesize

      712KB

    • memory/3140-0-0x000000007471E000-0x000000007471F000-memory.dmp

      Filesize

      4KB

    • memory/3140-2-0x0000000005090000-0x00000000050D6000-memory.dmp

      Filesize

      280KB

    • memory/3140-16-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-36-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-14-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-59-0x0000000005490000-0x000000000552C000-memory.dmp

      Filesize

      624KB

    • memory/3140-34-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-12-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-5-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-10-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-6-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-24-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-26-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/3140-65-0x0000000074710000-0x0000000074EC0000-memory.dmp

      Filesize

      7.7MB

    • memory/3140-8-0x00000000050D0000-0x00000000050EF000-memory.dmp

      Filesize

      124KB

    • memory/4496-62-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/4496-64-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/4496-60-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/4496-66-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/4496-67-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/4496-71-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB