Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2024, 07:43
Static task
static1
Behavioral task
behavioral1
Sample
Copy0761000025pdf.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Copy0761000025pdf.exe
Resource
win10v2004-20240426-en
General
-
Target
Copy0761000025pdf.exe
-
Size
195KB
-
MD5
0089e341efa862f22d3af9894d1c5448
-
SHA1
4d55c851eccec68786c88b064bcf35c1233393f3
-
SHA256
bfc1cdded42adb884fb46ba53e2f023d0c27d46cf8645614094f5714ebbfb9a8
-
SHA512
ea2c3b6cd6759b11017c58f7948d04fbafc96474190ca2162ff2486dddcd4fc83074ffd055a3367bb783475787cecb6401248344eb0cec787ef7b5dd7fb96ad4
-
SSDEEP
3072:oiwqHidIcWy4F1qiYD56979Z9+p7NVMsvKi1EcUWAQ+iULWafUvjfH:OqCd7WrYQ979ZItNWJi1EccnbsLH
Malware Config
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" Copy0761000025pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3368 set thread context of 2132 3368 Copy0761000025pdf.exe 92 -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3368 Copy0761000025pdf.exe Token: SeDebugPrivilege 3368 Copy0761000025pdf.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3368 wrote to memory of 2132 3368 Copy0761000025pdf.exe 92 PID 3368 wrote to memory of 2132 3368 Copy0761000025pdf.exe 92 PID 3368 wrote to memory of 2132 3368 Copy0761000025pdf.exe 92 PID 3368 wrote to memory of 2132 3368 Copy0761000025pdf.exe 92 PID 3368 wrote to memory of 2132 3368 Copy0761000025pdf.exe 92 PID 3368 wrote to memory of 2132 3368 Copy0761000025pdf.exe 92 PID 3368 wrote to memory of 2132 3368 Copy0761000025pdf.exe 92 PID 3368 wrote to memory of 2132 3368 Copy0761000025pdf.exe 92 PID 3368 wrote to memory of 2132 3368 Copy0761000025pdf.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Copy0761000025pdf.exe"C:\Users\Admin\AppData\Local\Temp\Copy0761000025pdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2132
-