Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
02/06/2024, 18:28
Behavioral task
behavioral1
Sample
0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe
Resource
win10v2004-20240426-en
General
-
Target
0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe
-
Size
2.0MB
-
MD5
40fe3f6effff7596e593c7ecd56502a3
-
SHA1
4b384c82d3cca32ea9e9bae8dc7af1e4334fed51
-
SHA256
0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca
-
SHA512
1b3426aef8e0eaff11b2fed8cec1db85bacec1027bc5c0e32aea329fc7f809747c5a961ada6b9bd7f93c509dde91b3051efeac8af5d8e216e04bb80fa5246109
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYJ:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y/
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x000700000002341f-12.dat family_quasar behavioral2/memory/3504-30-0x00000000009A0000-0x00000000009FE000-memory.dmp family_quasar behavioral2/files/0x0007000000023422-50.dat family_quasar -
Detects Windows executables referencing non-Windows User-Agents 3 IoCs
resource yara_rule behavioral2/files/0x000700000002341f-12.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/memory/3504-30-0x00000000009A0000-0x00000000009FE000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA behavioral2/files/0x0007000000023422-50.dat INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
Detects executables containing common artifacts observed in infostealers 3 IoCs
resource yara_rule behavioral2/files/0x000700000002341f-12.dat INDICATOR_SUSPICIOUS_GENInfoStealer behavioral2/memory/3504-30-0x00000000009A0000-0x00000000009FE000-memory.dmp INDICATOR_SUSPICIOUS_GENInfoStealer behavioral2/files/0x0007000000023422-50.dat INDICATOR_SUSPICIOUS_GENInfoStealer -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe -
Executes dropped EXE 3 IoCs
pid Process 1204 vnc.exe 3504 windef.exe 464 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\y: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\b: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\e: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\m: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\n: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\p: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\t: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\v: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\a: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\r: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\u: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\w: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\i: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\k: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\l: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\q: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\s: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\x: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\g: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\h: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\j: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\o: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe File opened (read-only) \??\z: 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023422-50.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1492 set thread context of 1044 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 88 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 1480 1204 WerFault.exe 81 3724 464 WerFault.exe 96 4640 1528 WerFault.exe 115 -
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1108 schtasks.exe 3004 schtasks.exe 1008 schtasks.exe 4752 schtasks.exe 5072 schtasks.exe 4964 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2280 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3504 windef.exe Token: SeDebugPrivilege 464 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 464 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1204 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 81 PID 1492 wrote to memory of 1204 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 81 PID 1492 wrote to memory of 1204 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 81 PID 1204 wrote to memory of 1924 1204 vnc.exe 84 PID 1204 wrote to memory of 1924 1204 vnc.exe 84 PID 1204 wrote to memory of 1924 1204 vnc.exe 84 PID 1492 wrote to memory of 3504 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 86 PID 1492 wrote to memory of 3504 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 86 PID 1492 wrote to memory of 3504 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 86 PID 1492 wrote to memory of 1044 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 88 PID 1492 wrote to memory of 1044 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 88 PID 1492 wrote to memory of 1044 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 88 PID 1492 wrote to memory of 1044 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 88 PID 1492 wrote to memory of 1044 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 88 PID 1492 wrote to memory of 1008 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 90 PID 1492 wrote to memory of 1008 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 90 PID 1492 wrote to memory of 1008 1492 0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe 90 PID 3504 wrote to memory of 4752 3504 windef.exe 94 PID 3504 wrote to memory of 4752 3504 windef.exe 94 PID 3504 wrote to memory of 4752 3504 windef.exe 94 PID 3504 wrote to memory of 464 3504 windef.exe 96 PID 3504 wrote to memory of 464 3504 windef.exe 96 PID 3504 wrote to memory of 464 3504 windef.exe 96 PID 464 wrote to memory of 5072 464 winsock.exe 98 PID 464 wrote to memory of 5072 464 winsock.exe 98 PID 464 wrote to memory of 5072 464 winsock.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe"C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1924
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 5483⤵
- Program crash
PID:1480
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:4752
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:5072
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FMuBq8rjts1i.bat" "4⤵PID:1212
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:4928
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
PID:2280
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:2364
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 464 -s 22604⤵
- Program crash
PID:3724
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe"C:\Users\Admin\AppData\Local\Temp\0881f92d55c68fa3a6001b44493e546123fa9a2fb7c1e8683a375ff344bc7fca.exe"2⤵PID:1044
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1008
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1204 -ip 12041⤵PID:2396
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 464 -ip 4641⤵PID:1216
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:1528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:3604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1528 -s 5283⤵
- Program crash
PID:4640
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:868
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:1108
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵PID:2672
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:3004
-
-
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:1480
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1528 -ip 15281⤵PID:2396
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1748
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4496
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD59aa08a70e00ef6a963aa1dd4e896534f
SHA1844c24f7b0d228305e636cd8b032103c25956816
SHA256eafe0f6cd2b94ea0eba4737b502b03937ace5770169874babc16e052b5fe29ff
SHA51241ab412fad3e5d84ed69c28599aec08593c8f2e056f5e54666756baf730c57c40085b0fec9d4bc5cec500eec1eba1a78b804537af0bdd4341f045395ca973afb
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD52618416e95995a8d48a18190601e74cf
SHA1595089555f925813e87d21a68b8c455c3ac02c8b
SHA2563ede1dd7708aaa6aa386423ab25ceab45b1b4d05020dec27e444021225577960
SHA512ba1929748c6f427365981cf91da6361fafa5ceb3d7ad65222527a8a7f4c0c13ae5a1062c01164cb194ca445cd14195a918ed26806558436b0aa13cd96c9c531f
-
Filesize
2.0MB
MD5b4e0a38cd66ba5365efab5e20e0d6999
SHA1cf93ec38f8b222e1890dd39b424f5babb7f8eb21
SHA256fc909a48d7513e880a534b50a4d0bfc8e08df43669d89508aca6a3e567841aa9
SHA512ae09ae5f894dc49b8c969d4e802245e12a83543ae534752e38c6fc3b94b6eed21ccececc478f7d4c9e402b2a5d280e113116bc6a09d0471d7f48d81a3991f403