Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2024, 03:50

General

  • Target

    58685083b698610e970f5b0766517eb0_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    58685083b698610e970f5b0766517eb0

  • SHA1

    d3f7173e3dbedd99482ff58f42f44a978d9761e6

  • SHA256

    eecdc674c9e86dd45fc485b0f25829367eb2e805c920d746682c16636819f7cb

  • SHA512

    11b7af2da51ae084027f3eed3e282d023660fcd8ee9daf224ad54e77053cb9910c8cc63bc408ce2f4f5c6c92662e99aab536c29c0833e267a060e4d4e285051a

  • SSDEEP

    12288:tf9hv84Qe79qQOOThLWHNsmtqxfjFSgxLK6nLyXpy41fwzjAEaYT1f9mgs8+3Rfs:t0OD3ThLWHKm4xBZxRnZ7AVYTmJrjpt

Malware Config

Extracted

Family

azorult

C2

http://kamyn9ka.com/server/gate.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58685083b698610e970f5b0766517eb0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\58685083b698610e970f5b0766517eb0_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4564
    • C:\Users\Admin\AppData\Local\Temp\58685083b698610e970f5b0766517eb0_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\58685083b698610e970f5b0766517eb0_JaffaCakes118.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:4316
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout 1 & del "C:\Users\Admin\AppData\Local\Temp\58685083b698610e970f5b0766517eb0_JaffaCakes118.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3468
        • C:\Windows\SysWOW64\timeout.exe
          timeout 1
          4⤵
          • Delays execution with timeout.exe
          PID:4472

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4316-6-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/4316-8-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/4316-9-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/4316-10-0x0000000000400000-0x0000000000483000-memory.dmp

    Filesize

    524KB

  • memory/4564-0-0x000000007440E000-0x000000007440F000-memory.dmp

    Filesize

    4KB

  • memory/4564-1-0x00000000004E0000-0x0000000000606000-memory.dmp

    Filesize

    1.1MB

  • memory/4564-2-0x0000000007940000-0x0000000007EE4000-memory.dmp

    Filesize

    5.6MB

  • memory/4564-3-0x0000000005010000-0x000000000510C000-memory.dmp

    Filesize

    1008KB

  • memory/4564-4-0x0000000000F80000-0x0000000000F8A000-memory.dmp

    Filesize

    40KB

  • memory/4564-5-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB

  • memory/4564-11-0x000000007440E000-0x000000007440F000-memory.dmp

    Filesize

    4KB

  • memory/4564-12-0x0000000074400000-0x0000000074BB0000-memory.dmp

    Filesize

    7.7MB