Malware Analysis Report

2024-08-06 13:49

Sample ID 240518-pjl3rsbc86
Target 54b1ee633e49544e5bb6099dd576663e_JaffaCakes118
SHA256 2bdf9811d9fdc64acc21f88900c8f8054c900c009a98bb1efed40f64be259115
Tags
azorult infostealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2bdf9811d9fdc64acc21f88900c8f8054c900c009a98bb1efed40f64be259115

Threat Level: Known bad

The file 54b1ee633e49544e5bb6099dd576663e_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

azorult infostealer trojan

Azorult

Suspicious use of SetThreadContext

Drops file in Windows directory

Unsigned PE

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

MITRE ATT&CK Matrix

N/A

Analysis: static1

Detonation Overview

Reported

2024-05-18 12:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-18 12:21

Reported

2024-05-18 12:24

Platform

win7-20240221-en

Max time kernel

122s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"

Signatures

Azorult

trojan infostealer azorult

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2256 set thread context of 1876 N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2256 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
PID 2256 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
PID 2256 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
PID 2256 wrote to memory of 1876 N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 gebbatrip.club udp
US 8.8.8.8:53 gebbatrip.club udp

Files

memory/2256-2-0x0000000002730000-0x0000000002770000-memory.dmp

memory/2256-3-0x0000000002730000-0x0000000002770000-memory.dmp

memory/2256-5-0x0000000077201000-0x0000000077302000-memory.dmp

memory/2256-6-0x0000000077200000-0x00000000773A9000-memory.dmp

C:\Windows\win.ini

MD5 d2a2412bddba16d60ec63bd9550d933f
SHA1 deb3d3bdc9055f0b4909b31d3048446848fae0e1
SHA256 79ff2254e38192be1626d05bec6c82e10c85e1cf91df7440c4c443380a1e877a
SHA512 8fecada107f72e59e43a689eeb8e2e18fa6134d0941c122025ed5bd00e5eab8114d7125bd289505be75641385a0c3f112d402c693f142c3ddc870d5fa8116e31

memory/1876-11-0x0000000000400000-0x000000000046E000-memory.dmp

memory/1876-13-0x0000000077200000-0x00000000773A9000-memory.dmp

memory/1876-15-0x0000000000400000-0x000000000046E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-18 12:21

Reported

2024-05-18 12:24

Platform

win10v2004-20240508-en

Max time kernel

140s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"

Signatures

Azorult

trojan infostealer azorult

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
File opened for modification C:\Windows\win.ini C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4968 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
PID 4968 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe
PID 4968 wrote to memory of 3396 N/A C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\54b1ee633e49544e5bb6099dd576663e_JaffaCakes118.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3924,i,13640054265074968359,8146127767143474550,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 gebbatrip.club udp
US 8.8.8.8:53 gebbatrip.club udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 93.65.42.20.in-addr.arpa udp

Files

memory/4968-4-0x0000000004C50000-0x0000000004C60000-memory.dmp

memory/4968-3-0x0000000004C50000-0x0000000004C60000-memory.dmp

memory/4968-5-0x0000000076ED1000-0x0000000076FF1000-memory.dmp

C:\Windows\win.ini

MD5 6bf517432f65eb7f0d18d574bf14124c
SHA1 5b9f37c1dd1318ebbec3bd2f07c109eb9d22c727
SHA256 6e2b70dfccabf3cc651545676a3a566c9cfae03f15f772886646abce1da35b46
SHA512 7b0cb8c20034585ec8bf4b45eda5eda5993a56e24931a7426dc5a9f081ec1f82545f3e26a48a4df885c8691fc6e8026d0808aebe3cc3358ba85ddca08ac4cb06

memory/3396-10-0x0000000004A50000-0x0000000004A60000-memory.dmp

memory/3396-11-0x0000000000400000-0x000000000046E000-memory.dmp

memory/3396-13-0x0000000004A10000-0x0000000004A37000-memory.dmp

memory/3396-15-0x0000000000400000-0x000000000046E000-memory.dmp