Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
12-05-2024 08:51
General
-
Target
394562ac3d66f466549579a315cf0b70_JaffaCakes118.exe
-
Size
149KB
-
MD5
394562ac3d66f466549579a315cf0b70
-
SHA1
ff54ae78c9ee170a661ca2b2fbeaae4139731713
-
SHA256
f6dda4098d5ce57f68ce47d524d2944a6d62b5dcb65a6135f8c0420ecff32622
-
SHA512
d73edf112df8438dc7f4deedb6af1a9be437f5b70e0b90ec44ed8eef443d49e25d0818788a452a470d905133a0d9bc0157b6dc87ece43a219f01d226425b2b60
-
SSDEEP
3072:j1cO+2nfMi6cBX3ZNjBDpwpL7ddBtXpcEoHK3R7/R43:m2nfxt3H1KpPddBGyVZ43
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\394562ac3d66f466549579a315cf0b70_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\394562ac3d66f466549579a315cf0b70_JaffaCakes118.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1344 -s 14402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1344 -ip 13441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272KB
-
Filesize
1024KB
-
Filesize
132KB
-
Filesize
272KB
-
Filesize
1024KB
-
Filesize
132KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
132KB