Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/05/2024, 14:36

General

  • Target

    3512d08a932b4b8d6ccdc259def8e064_JaffaCakes118.exe

  • Size

    690KB

  • MD5

    3512d08a932b4b8d6ccdc259def8e064

  • SHA1

    420113523781f62428aeb556c35e75da69292177

  • SHA256

    1f8ab348af6cbbe737f5831fd3ff5c1313615ef3c15313e42ca6688ece4a7627

  • SHA512

    c9bdc77688746f62b88a98d88603cdfb7ee63d618368493a39f839c766ee1d2d8c1fc0ab313440491ef30369705c8c10e864c274fba708477c79fcc7910cfece

  • SSDEEP

    12288:Zb7wrmUJeglq/0PwSF0/46I4jlkt4hTF0yhHMLju7Jrn6dYCY3kS5+ZRUk+/KKbw:Zb7wrPJ7lqcY9PJktcp0sz7d+YCYzcEM

Malware Config

Extracted

Family

azorult

C2

http://www.brasond.tech/eddy/Panel/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Drops startup file 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3512d08a932b4b8d6ccdc259def8e064_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\3512d08a932b4b8d6ccdc259def8e064_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
      "Powershell.exe" -ExecutionPolicy UnRestricted -NoLogo [System.Reflection.Assembly]::Load([Convert]::FromBase64String([IO.File]::ReadAllText('C:\Users\Admin\NTUSER'))).EntryPoint.Invoke($null,$null);
      2⤵
      • Drops startup file
      • Suspicious use of SetThreadContext
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
          PID:4988

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wp2hxjkc.rki.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\NTUSER

      Filesize

      340KB

      MD5

      7a837a84ff4c1ca8d8604c8fbd104273

      SHA1

      b83d6518e48730bed88066e611a06f01561f8c25

      SHA256

      8253c0a13f03dc521e7e51f2f3a2c1930456f5d544bd56d4138fd677b4eb05db

      SHA512

      3c93820f4db1351df5807510c35c13d2e276b6cf7969936ea4bc30a17e9cf68da22f4d10c5d80a0d60bce6c906c4ac9f75819b3dc2505d6e8f51fc436efd234d

    • C:\Users\Admin\NTUSER.log

      Filesize

      84B

      MD5

      1a7934d7bba9798d3b5ce26a070b5957

      SHA1

      12068b9f840e1cb96b959726f2b0ed0148160971

      SHA256

      f416b1f44f809647b7a336f5482b0038257586ce878ec17cc5bba37eca5f38dd

      SHA512

      2e0ef1631717871399073b9e25bd3170d6d24867dadc7d2aa5178b95f584715f01db01f0d50f88264c1cfc2cb1ab6362db80df60cb9d49c84539c428125a79ec

    • memory/4268-1-0x0000000000480000-0x0000000000532000-memory.dmp

      Filesize

      712KB

    • memory/4268-93-0x00000000746E0000-0x0000000074E90000-memory.dmp

      Filesize

      7.7MB

    • memory/4268-0-0x00000000746EE000-0x00000000746EF000-memory.dmp

      Filesize

      4KB

    • memory/4268-5-0x00000000746E0000-0x0000000074E90000-memory.dmp

      Filesize

      7.7MB

    • memory/4600-69-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-59-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-10-0x0000000004F90000-0x0000000004FF6000-memory.dmp

      Filesize

      408KB

    • memory/4600-21-0x00000000057C0000-0x0000000005B14000-memory.dmp

      Filesize

      3.3MB

    • memory/4600-22-0x0000000005C80000-0x0000000005C9E000-memory.dmp

      Filesize

      120KB

    • memory/4600-23-0x0000000005CD0000-0x0000000005D1C000-memory.dmp

      Filesize

      304KB

    • memory/4600-9-0x0000000004DF0000-0x0000000004E12000-memory.dmp

      Filesize

      136KB

    • memory/4600-25-0x0000000006000000-0x0000000006046000-memory.dmp

      Filesize

      280KB

    • memory/4600-8-0x0000000005020000-0x0000000005648000-memory.dmp

      Filesize

      6.2MB

    • memory/4600-26-0x0000000006060000-0x0000000006086000-memory.dmp

      Filesize

      152KB

    • memory/4600-49-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-67-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-82-0x0000000074690000-0x000000007473B000-memory.dmp

      Filesize

      684KB

    • memory/4600-81-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-79-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-78-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-75-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-74-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-71-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-6-0x0000000074690000-0x000000007473B000-memory.dmp

      Filesize

      684KB

    • memory/4600-65-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-63-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-61-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-11-0x0000000005650000-0x00000000056B6000-memory.dmp

      Filesize

      408KB

    • memory/4600-57-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-55-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-54-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-51-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-47-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-45-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-43-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-41-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-39-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-37-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-35-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-33-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-31-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-30-0x0000000006060000-0x000000000607F000-memory.dmp

      Filesize

      124KB

    • memory/4600-83-0x00000000049F0000-0x0000000004A10000-memory.dmp

      Filesize

      128KB

    • memory/4600-84-0x0000000006E50000-0x0000000006EEC000-memory.dmp

      Filesize

      624KB

    • memory/4600-7-0x0000000002380000-0x00000000023B6000-memory.dmp

      Filesize

      216KB

    • memory/4600-91-0x0000000074690000-0x000000007473B000-memory.dmp

      Filesize

      684KB

    • memory/4988-88-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/4988-87-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/4988-92-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB

    • memory/4988-85-0x0000000000400000-0x0000000000420000-memory.dmp

      Filesize

      128KB