Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    12/05/2024, 08:51

General

  • Target

    394562ac3d66f466549579a315cf0b70_JaffaCakes118.exe

  • Size

    149KB

  • MD5

    394562ac3d66f466549579a315cf0b70

  • SHA1

    ff54ae78c9ee170a661ca2b2fbeaae4139731713

  • SHA256

    f6dda4098d5ce57f68ce47d524d2944a6d62b5dcb65a6135f8c0420ecff32622

  • SHA512

    d73edf112df8438dc7f4deedb6af1a9be437f5b70e0b90ec44ed8eef443d49e25d0818788a452a470d905133a0d9bc0157b6dc87ece43a219f01d226425b2b60

  • SSDEEP

    3072:j1cO+2nfMi6cBX3ZNjBDpwpL7ddBtXpcEoHK3R7/R43:m2nfxt3H1KpPddBGyVZ43

Malware Config

Extracted

Family

azorult

C2

http://195.245.112.115/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

Processes

  • C:\Users\Admin\AppData\Local\Temp\394562ac3d66f466549579a315cf0b70_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\394562ac3d66f466549579a315cf0b70_JaffaCakes118.exe"
    1⤵
      PID:2932

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2932-0-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2932-2-0x00000000004C0000-0x00000000005C0000-memory.dmp

      Filesize

      1024KB

    • memory/2932-3-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2932-4-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2932-6-0x00000000004C0000-0x00000000005C0000-memory.dmp

      Filesize

      1024KB

    • memory/2932-7-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB

    • memory/2932-8-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2932-10-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

    • memory/2932-11-0x0000000000400000-0x0000000000421000-memory.dmp

      Filesize

      132KB