Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
04-06-2024 01:49
General
-
Target
9353fc884263a518e0cf9d081d74ad16_JaffaCakes118.exe
-
Size
678KB
-
MD5
9353fc884263a518e0cf9d081d74ad16
-
SHA1
0a455439ea499ab7885d5882ae9c966dbb7fd389
-
SHA256
4c6b583d199e8459dfcf57eeb6a2044c06c71b195a9fbd81e002610f13e5a660
-
SHA512
a47decf3c59d963aed3b66d1012a9e348a8404f2bd25d72400530c676484550f89a6cf0696584b18164e4bab3f6c2472570d5a190a571afff58296c43a21796a
-
SSDEEP
12288:QSVOqyYsnTd7hZrnl6EgXDHNLaY1tjTsK3vIg5HxkOmmoqSO/WI0lPnKxBeyY75o:wLdNZrnl6EgXDHVaY1tjTzQX2o9tABLF
Score
10/10
Malware Config
Extracted
Family
azorult
C2
http://blog.tideisun.com.cn/wp-obtain/new/file/js/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9353fc884263a518e0cf9d081d74ad16_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9353fc884263a518e0cf9d081d74ad16_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
180KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
180KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
700KB