Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2024, 01:41
Behavioral task
behavioral1
Sample
471f39f758c3c50f62d295dd22e3a060.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
471f39f758c3c50f62d295dd22e3a060.exe
Resource
win10v2004-20240611-en
General
-
Target
471f39f758c3c50f62d295dd22e3a060.exe
-
Size
2.0MB
-
MD5
471f39f758c3c50f62d295dd22e3a060
-
SHA1
6fa6bcab273ec548205d4f38723b227e1f4edfc7
-
SHA256
8ee25c1d81e4220271ae3b191791e0e5b794331dd12710daa9a1650574c3294c
-
SHA512
213a2b4aceb19b120474a45116bd410f7491763562e12e971c8144a72a9e806cb183484040bdae2d1a0abf6f3980134be4cf51f02a1573e92fe848b30dac9607
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYv:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yh
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x0008000000023427-12.dat family_quasar behavioral2/memory/752-30-0x00000000009D0000-0x0000000000A2E000-memory.dmp family_quasar behavioral2/files/0x000700000002342b-46.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation 471f39f758c3c50f62d295dd22e3a060.exe -
Executes dropped EXE 3 IoCs
pid Process 3516 vnc.exe 752 windef.exe 4432 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\n: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\o: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\p: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\a: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\b: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\g: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\h: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\r: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\y: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\v: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\x: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\e: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\j: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\l: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\t: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\i: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\m: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\u: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\q: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\s: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\w: 471f39f758c3c50f62d295dd22e3a060.exe File opened (read-only) \??\z: 471f39f758c3c50f62d295dd22e3a060.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000700000002342b-46.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1084 set thread context of 4784 1084 471f39f758c3c50f62d295dd22e3a060.exe 89 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 4148 3516 WerFault.exe 82 624 1060 WerFault.exe 102 468 4432 WerFault.exe 96 4696 4484 WerFault.exe 117 -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3780 schtasks.exe 768 schtasks.exe 2728 schtasks.exe 3176 schtasks.exe 4324 schtasks.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 852 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1084 471f39f758c3c50f62d295dd22e3a060.exe 1084 471f39f758c3c50f62d295dd22e3a060.exe 1084 471f39f758c3c50f62d295dd22e3a060.exe 1084 471f39f758c3c50f62d295dd22e3a060.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 752 windef.exe Token: SeDebugPrivilege 4432 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4432 winsock.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1084 wrote to memory of 3516 1084 471f39f758c3c50f62d295dd22e3a060.exe 82 PID 1084 wrote to memory of 3516 1084 471f39f758c3c50f62d295dd22e3a060.exe 82 PID 1084 wrote to memory of 3516 1084 471f39f758c3c50f62d295dd22e3a060.exe 82 PID 3516 wrote to memory of 700 3516 vnc.exe 84 PID 3516 wrote to memory of 700 3516 vnc.exe 84 PID 1084 wrote to memory of 752 1084 471f39f758c3c50f62d295dd22e3a060.exe 85 PID 1084 wrote to memory of 752 1084 471f39f758c3c50f62d295dd22e3a060.exe 85 PID 1084 wrote to memory of 752 1084 471f39f758c3c50f62d295dd22e3a060.exe 85 PID 1084 wrote to memory of 4784 1084 471f39f758c3c50f62d295dd22e3a060.exe 89 PID 1084 wrote to memory of 4784 1084 471f39f758c3c50f62d295dd22e3a060.exe 89 PID 1084 wrote to memory of 4784 1084 471f39f758c3c50f62d295dd22e3a060.exe 89 PID 1084 wrote to memory of 4784 1084 471f39f758c3c50f62d295dd22e3a060.exe 89 PID 1084 wrote to memory of 4784 1084 471f39f758c3c50f62d295dd22e3a060.exe 89 PID 1084 wrote to memory of 768 1084 471f39f758c3c50f62d295dd22e3a060.exe 91 PID 1084 wrote to memory of 768 1084 471f39f758c3c50f62d295dd22e3a060.exe 91 PID 1084 wrote to memory of 768 1084 471f39f758c3c50f62d295dd22e3a060.exe 91 PID 752 wrote to memory of 2728 752 windef.exe 94 PID 752 wrote to memory of 2728 752 windef.exe 94 PID 752 wrote to memory of 2728 752 windef.exe 94 PID 752 wrote to memory of 4432 752 windef.exe 96 PID 752 wrote to memory of 4432 752 windef.exe 96 PID 752 wrote to memory of 4432 752 windef.exe 96 PID 4432 wrote to memory of 3176 4432 winsock.exe 97 PID 4432 wrote to memory of 3176 4432 winsock.exe 97 PID 4432 wrote to memory of 3176 4432 winsock.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\471f39f758c3c50f62d295dd22e3a060.exe"C:\Users\Admin\AppData\Local\Temp\471f39f758c3c50f62d295dd22e3a060.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:700
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3516 -s 5483⤵
- Program crash
PID:4148
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
PID:2728
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
PID:3176
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5lONcFZGkP4Q.bat" "4⤵PID:640
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:228
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- Runs ping.exe
PID:852
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:4484
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Creates scheduled task(s)
PID:3780
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6AaefKcC5MHY.bat" "6⤵PID:2732
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4484 -s 22166⤵
- Program crash
PID:4696
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4432 -s 19844⤵
- Program crash
PID:468
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\471f39f758c3c50f62d295dd22e3a060.exe"C:\Users\Admin\AppData\Local\Temp\471f39f758c3c50f62d295dd22e3a060.exe"2⤵PID:4784
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:768
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3516 -ip 35161⤵PID:3988
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:1060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1400
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1060 -s 5203⤵
- Program crash
PID:624
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:1300
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:548
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4324
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1060 -ip 10601⤵PID:4592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4432 -ip 44321⤵PID:4404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4484 -ip 44841⤵PID:5092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4484 -ip 44841⤵PID:3864
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3016
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:3216
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4028
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:2632
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:4076
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1532
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD55eab9b1df79e460342b77d2b6b214df1
SHA14cd7d0aabe02dadbcab24ebb5d7106f6b195d3ca
SHA256249aaa1887fb7cf7c7cfad3fde43a1e78395e150b1bdddd880a21d73415f84d4
SHA512693e0c0c10c5cffa3446e5f211fd07a0990f8490030f308045b8d614f8db043d1ae9493bafc278cb54a8f4f56cadd6fe7e1aec1ddcb9af57c837d328b4136c1b
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD50c1bf8822271d86d23ba21cfe34b6b1a
SHA135154d78fce077ff8abc68dc3eb5faf6877b1fe6
SHA2561fcecba8df719f55e74dd6e073e6a4c74e1c0fc1a8959fbd9d126f5bd4757fe8
SHA5122f5b5b661f41deb69b84cea8f5ce5e9081de0e3d14212da95f3cd26a6d0ff8ae155820d7dbc3deb99e6891a7f3c021d6685e2d0768c9b21ee5119de14fe0fef2
-
Filesize
2.0MB
MD538b26767d3112854d0eb4fb03de57a08
SHA1073aa46a0d9e581ba9f6093ed1ab62e419c27c90
SHA25643bd304a8d7e18d05d396b0686c734fec507573f2c14f4b0f2b0ca6bc6ec1d15
SHA512fbf4f6b51c116f37e1de3e9b61f120590bcfece30d9cc4d9e54104ca62f42797407738d4da39d1e223a034fb6309165570edaac995c6405c6de097930b213424