Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
18-05-2024 12:21
General
-
Target
54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
-
Size
420KB
-
MD5
54b1ee633e49544e5bb6099dd576663e
-
SHA1
0c844bf459777740a4d7fa71510da4d5d6ee1530
-
SHA256
2bdf9811d9fdc64acc21f88900c8f8054c900c009a98bb1efed40f64be259115
-
SHA512
2c0bfebd90c434f5b710eb27d2833f0c3010a6c301b8941de825e44d8a2420c53d086d794e39a9d3bbeca450111f59fd6e59895694552a8ee23adcadad0531ac
-
SSDEEP
6144:Ft7UUAVmnPbDLl9QsHvcrEi78gJ9KEXV4/lX:rUUEmXLl9QsGQE9KEFml
Malware Config
Extracted
azorult
http://gebbatrip.club/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Drops file in Windows directory 2 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"2⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3924,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:81⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123B
MD56bf517432f65eb7f0d18d574bf14124c
SHA15b9f37c1dd1318ebbec3bd2f07c109eb9d22c727
SHA2566e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46
SHA5127b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06
-
Filesize
64KB
-
Filesize
440KB
-
Filesize
156KB
-
Filesize
440KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB