Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/05/2024, 01:06

General

  • Target

    21e52228ab12f2795a0413d2c07bf1f309bdbf6a85aa8cb1333f5b792163448d.exe

  • Size

    2.4MB

  • MD5

    aef7bf02a3cd2396f2f9d559aa22cf17

  • SHA1

    1ab64380eab38007080667a965f74aff91bf1ef8

  • SHA256

    21e52228ab12f2795a0413d2c07bf1f309bdbf6a85aa8cb1333f5b792163448d

  • SHA512

    ed9302b2a19665b795e67d949dd8002514586525743ba4d0113b1c04319dd52e650f493401409fedc9bd1f3fb7b6be833222980e8022a24e3dd9893e5f2c4a82

  • SSDEEP

    49152:qskSQLcOwKeOqapdyIwusi+vrbHqYgOvjkN2xgPb/vUHe:qFHcOYO3dpSPHqjzNPbn1

Malware Config

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\21e52228ab12f2795a0413d2c07bf1f309bdbf6a85aa8cb1333f5b792163448d.exe
    "C:\Users\Admin\AppData\Local\Temp\21e52228ab12f2795a0413d2c07bf1f309bdbf6a85aa8cb1333f5b792163448d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Users\Admin\AppData\Local\Temp\21e52228ab12f2795a0413d2c07bf1f309bdbf6a85aa8cb1333f5b792163448d.exe
      "C:\Users\Admin\AppData\Local\Temp\21e52228ab12f2795a0413d2c07bf1f309bdbf6a85aa8cb1333f5b792163448d.exe"
      2⤵
        PID:2480

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2400-0-0x000000007418E000-0x000000007418F000-memory.dmp

      Filesize

      4KB

    • memory/2400-1-0x0000000000F00000-0x000000000116E000-memory.dmp

      Filesize

      2.4MB

    • memory/2400-2-0x0000000074180000-0x000000007486E000-memory.dmp

      Filesize

      6.9MB

    • memory/2400-3-0x0000000005000000-0x000000000522C000-memory.dmp

      Filesize

      2.2MB

    • memory/2400-4-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-13-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-17-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-19-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-5-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-32-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-37-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-7-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-43-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-59-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-15-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-11-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-47-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-67-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-65-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-63-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-61-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-57-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-55-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-53-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-51-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-50-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-45-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-41-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-39-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-35-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-33-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-29-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-27-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-25-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-23-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-21-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-9-0x0000000005000000-0x0000000005225000-memory.dmp

      Filesize

      2.1MB

    • memory/2400-4890-0x0000000074180000-0x000000007486E000-memory.dmp

      Filesize

      6.9MB

    • memory/2400-4892-0x0000000000CE0000-0x0000000000D2C000-memory.dmp

      Filesize

      304KB

    • memory/2400-4891-0x00000000049A0000-0x0000000004A06000-memory.dmp

      Filesize

      408KB

    • memory/2400-4893-0x0000000004A10000-0x0000000004A64000-memory.dmp

      Filesize

      336KB

    • memory/2400-4914-0x0000000074180000-0x000000007486E000-memory.dmp

      Filesize

      6.9MB