Analysis

  • max time kernel
    51s
  • max time network
    53s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-06-2024 19:09

General

  • Target

    9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe

  • Size

    2.6MB

  • MD5

    9bb3638f28f1184c0ca0c1500d6698d6

  • SHA1

    4b0d028f70841dc794cb9eb696366ce6eb4ba6f0

  • SHA256

    1e7fb271b11372c8168c3b5eccbc903d330e9bf8cd2135c9dc13eb14d11c2518

  • SHA512

    6cf483a1ffa7aec827e7512dd3909a3e21cb2afd97518d95fcdc736985732b13d118db6c4c9e4dc3bcb665646a080338f389eed149520a0803bc8f2a20a38d64

  • SSDEEP

    49152:JUHl/k49nQVhOojoeokJYaBuIx/rRt7dLiT4AQkrEoMjlsm8GwJIc1JqCV:G959Q6C7oBoF371UIZDc9WK

Malware Config

Extracted

Family

azorult

C2

http://51.75.122.235/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\9bb3638f28f1184c0ca0c1500d6698d6_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:4048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\SPOON\CACHE\0x1C1A85E55832CA3F\sxs\Manifests\10765.exe_0x89c79f2c61b4b5ba913dadccfc2509e1.1.manifest

    Filesize

    379B

    MD5

    73102579f0cc3777bdd0ba96bab8d6f4

    SHA1

    08512e731aed9cdfeebf2e8fdc24a35ea23e3477

    SHA256

    03c937a5aba7fd7eab8ae959606ea4598e474da06b7ec63701255e7325a9e435

    SHA512

    e3928e509d852ae8f62b6378f984013345ddff9f5073e77323703acf20ca44bebff1753f09e7343cd948559bcafe766edce38e767efc5e7e7a5fd42c37be2e13

  • C:\Users\Admin\AppData\Local\Turbo.net\Sandbox\Notepad++\7.55\xsandbox.bin

    Filesize

    16B

    MD5

    ec3d19e8e9b05d025cb56c2a98ead8e7

    SHA1

    748532edeb86496c8efe5e2327501d89ec1f13df

    SHA256

    edb7be3ef6098a1e24d0c72bbc6f968dea773951a0dd07b63bad6d9009ae3bf4

    SHA512

    175fb8432472b6795bb5db0eba61bc7b57331720825df5b048f3086815ba844df4f7e83e42ff9e8fe5ab01700675a774cb916677953d6e0088ffbf1fa2775349

  • memory/4048-27-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/4048-11-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-26-0x0000000010000000-0x000000001006A000-memory.dmp

    Filesize

    424KB

  • memory/4048-18-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-15-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-25-0x0000000010000000-0x000000001006A000-memory.dmp

    Filesize

    424KB

  • memory/4048-41-0x0000000000430000-0x0000000000457000-memory.dmp

    Filesize

    156KB

  • memory/4048-40-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/4048-42-0x0000000010000000-0x000000001006A000-memory.dmp

    Filesize

    424KB

  • memory/4048-39-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/4048-38-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/4048-37-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/4048-7-0x00000000779B3000-0x00000000779B4000-memory.dmp

    Filesize

    4KB

  • memory/4048-31-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/4048-50-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-6-0x00000000779B2000-0x00000000779B3000-memory.dmp

    Filesize

    4KB

  • memory/4048-24-0x0000000010000000-0x000000001006A000-memory.dmp

    Filesize

    424KB

  • memory/4048-19-0x0000000010000000-0x000000001006A000-memory.dmp

    Filesize

    424KB

  • memory/4048-13-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-10-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-9-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-16-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-14-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-12-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-43-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB

  • memory/4048-44-0x00000000779B2000-0x00000000779B3000-memory.dmp

    Filesize

    4KB

  • memory/4048-45-0x0000000000E20000-0x0000000000E21000-memory.dmp

    Filesize

    4KB

  • memory/4048-8-0x0000000000E20000-0x0000000000E21000-memory.dmp

    Filesize

    4KB

  • memory/4048-49-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

  • memory/4048-5-0x0000000000AD0000-0x0000000000E1A000-memory.dmp

    Filesize

    3.3MB