Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
6s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2024, 00:54
Behavioral task
behavioral1
Sample
8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe
Resource
win10v2004-20240802-en
General
-
Target
8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe
-
Size
2.0MB
-
MD5
932d32437e6120b963696ebd3a4209d5
-
SHA1
76bb55de4272b024c011bb469ae836777b7326ce
-
SHA256
8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59
-
SHA512
2e840a24f432b2696bc816f77291a412577a0b571eec73e383a0db7b8c8d7cddfe0c88cf754668792a0eb8520e53eeea72b0520c3315d8c2d6e151ad7500c87a
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYq:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YQ
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 4 IoCs
resource yara_rule behavioral2/files/0x00080000000233a1-12.dat family_quasar behavioral2/memory/4976-30-0x00000000007A0000-0x00000000007FE000-memory.dmp family_quasar behavioral2/files/0x000c0000000233a9-51.dat family_quasar behavioral2/memory/976-81-0x0000000000650000-0x000000000085A000-memory.dmp family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe -
Executes dropped EXE 3 IoCs
pid Process 3068 vnc.exe 4976 windef.exe 3968 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\i: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\z: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\h: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\j: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\o: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\t: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\x: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\y: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\a: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\e: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\g: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\k: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\m: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\q: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\r: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\s: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\w: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\l: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\n: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\p: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\u: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe File opened (read-only) \??\v: 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 9 ip-api.com -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000c0000000233a9-51.dat autoit_exe behavioral2/memory/976-81-0x0000000000650000-0x000000000085A000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 976 set thread context of 636 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 1332 3068 WerFault.exe 86 3320 3968 WerFault.exe 100 4492 3836 WerFault.exe 118 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1972 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1972 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4916 schtasks.exe 2052 schtasks.exe 4300 schtasks.exe 4624 schtasks.exe 3516 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4976 windef.exe Token: SeDebugPrivilege 3968 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3968 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 976 wrote to memory of 3068 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 86 PID 976 wrote to memory of 3068 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 86 PID 976 wrote to memory of 3068 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 86 PID 976 wrote to memory of 4976 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 89 PID 976 wrote to memory of 4976 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 89 PID 976 wrote to memory of 4976 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 89 PID 3068 wrote to memory of 1912 3068 vnc.exe 90 PID 3068 wrote to memory of 1912 3068 vnc.exe 90 PID 3068 wrote to memory of 1912 3068 vnc.exe 90 PID 976 wrote to memory of 636 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 91 PID 976 wrote to memory of 636 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 91 PID 976 wrote to memory of 636 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 91 PID 976 wrote to memory of 636 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 91 PID 976 wrote to memory of 636 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 91 PID 976 wrote to memory of 4916 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 94 PID 976 wrote to memory of 4916 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 94 PID 976 wrote to memory of 4916 976 8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe 94 PID 4976 wrote to memory of 2052 4976 windef.exe 98 PID 4976 wrote to memory of 2052 4976 windef.exe 98 PID 4976 wrote to memory of 2052 4976 windef.exe 98 PID 4976 wrote to memory of 3968 4976 windef.exe 100 PID 4976 wrote to memory of 3968 4976 windef.exe 100 PID 4976 wrote to memory of 3968 4976 windef.exe 100 PID 3968 wrote to memory of 4300 3968 winsock.exe 101 PID 3968 wrote to memory of 4300 3968 winsock.exe 101 PID 3968 wrote to memory of 4300 3968 winsock.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe"C:\Users\Admin\AppData\Local\Temp\8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 5523⤵
- Program crash
PID:1332
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2052
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4300
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MdVzIEnNl8fl.bat" "4⤵PID:1028
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:2156
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1972
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:4684
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:4624
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3968 -s 22364⤵
- Program crash
PID:3320
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe"C:\Users\Admin\AppData\Local\Temp\8ee37bf3dbd24c8d2fbe52742fa58a7f03843d029e651adbb497211c05508c59.exe"2⤵
- System Location Discovery: System Language Discovery
PID:636
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3068 -ip 30681⤵PID:816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3968 -ip 39681⤵PID:1704
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:3836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:3800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 5203⤵
- Program crash
PID:4492
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:4016
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:1792
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:3516
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3836 -ip 38361⤵PID:2052
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1984
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD58e4444cfe9243b9d6fb542d3a2172868
SHA1d932a1c837ed2f303090f1dd70ef1880d53f6942
SHA256651b6f7d40d32b811077eaed9a241e0667d0d8ab58fddb470322c1a93c0c9a03
SHA5122ce017964a884afbed6d2c1b8c27050086d7806d93b3abbb7e46a6532986df117889d9eb5db99de788b4b32e6ef5c6fe1bc388f07ded16ea7307d4fce6021045
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD57307603d15e59f6685816a48e70dba27
SHA138c17c8e2e0b89e7014a8fb5ea8ae47fcb180f3e
SHA25665321a393d85ca86231f4c8a0adb4d6a01326c2690b575d14eda3e34853b7785
SHA512f00e8d70d49455c9d2ccf5613932542f2e511cdaec44ecf3c34de2818254fe989826bd5a1370117775d5d974a639d4785c0f0a6c6d7471ecb268d0f27a61e494
-
Filesize
2.0MB
MD5f080263a6700e9343e509146d85e976b
SHA113ec1347db6c8496f652f9b8904498ba8c9ee7fe
SHA2566eddcd14ec0be4fca3964ed4e4ec7041e88c7eca0800b3d2e29422481b7f6cc0
SHA512ca7798b33f9979cb405355517e300cebb38c3b04c6c47e87c7860caef5807ddeecaa2ae8861fac70774e4664cbe2a1f8ebd436016d916f35dc313926d4c60dae