Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 14:45
Static task
static1
Behavioral task
behavioral1
Sample
75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe
-
Size
482KB
-
MD5
75d2f7e4efad58a372fb044fce8f91cd
-
SHA1
fbe71d273cf088ff3c2fe8909b554089e75af420
-
SHA256
de223b29b8a873e16fe186d74ba40b3b074a8fae1786ffc0cfb7e8ff10f304cc
-
SHA512
471d55e22eb862838d3b54eb1adb5f5cfa76b8cdad472cae85228a60ea50c301eb87feee3b632e95af44d4853a26269e54451cc3daa59f71e8e94509a5dabc69
-
SSDEEP
12288:8ckIQPmkhhi/U2GdvqjrIXEb5XvHn+2d9hxm0Sn:9sPf26vXG5fnHSn
Malware Config
Extracted
azorult
http://t1t2.xyz/modez/3.2/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
pid Process 4976 project7312.exe 2456 project7312.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application = "C:\\Users\\Admin\\Desktop\\project7312.exe -boot" project7312.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4976 set thread context of 2456 4976 project7312.exe 106 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 3888 2456 WerFault.exe 106 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4680 75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe Token: SeDebugPrivilege 4976 project7312.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4680 wrote to memory of 232 4680 75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe 96 PID 4680 wrote to memory of 232 4680 75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe 96 PID 4680 wrote to memory of 232 4680 75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe 96 PID 4680 wrote to memory of 112 4680 75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe 102 PID 4680 wrote to memory of 112 4680 75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe 102 PID 4680 wrote to memory of 112 4680 75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe 102 PID 112 wrote to memory of 4976 112 cmd.exe 104 PID 112 wrote to memory of 4976 112 cmd.exe 104 PID 112 wrote to memory of 4976 112 cmd.exe 104 PID 4976 wrote to memory of 2456 4976 project7312.exe 106 PID 4976 wrote to memory of 2456 4976 project7312.exe 106 PID 4976 wrote to memory of 2456 4976 project7312.exe 106 PID 4976 wrote to memory of 2456 4976 project7312.exe 106 PID 4976 wrote to memory of 2456 4976 project7312.exe 106 PID 4976 wrote to memory of 2456 4976 project7312.exe 106 PID 4976 wrote to memory of 2456 4976 project7312.exe 106 PID 4976 wrote to memory of 2456 4976 project7312.exe 106 PID 4976 wrote to memory of 2456 4976 project7312.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\75d2f7e4efad58a372fb044fce8f91cd_JaffaCakes118.exe" "C:\Users\Admin\Desktop\project7312.exe"2⤵PID:232
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\Desktop\project7312.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\Desktop\project7312.exe"C:\Users\Admin\Desktop\project7312.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\Desktop\project7312.exe"C:\Users\Admin\Desktop\project7312.exe"4⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2456 -s 3605⤵
- Program crash
PID:3888
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2456 -ip 24561⤵PID:3420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
482KB
MD575d2f7e4efad58a372fb044fce8f91cd
SHA1fbe71d273cf088ff3c2fe8909b554089e75af420
SHA256de223b29b8a873e16fe186d74ba40b3b074a8fae1786ffc0cfb7e8ff10f304cc
SHA512471d55e22eb862838d3b54eb1adb5f5cfa76b8cdad472cae85228a60ea50c301eb87feee3b632e95af44d4853a26269e54451cc3daa59f71e8e94509a5dabc69