Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2024, 14:36
Behavioral task
behavioral1
Sample
3b412a971394882cb2d7be867ab7af20N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
3b412a971394882cb2d7be867ab7af20N.exe
Resource
win10v2004-20240802-en
General
-
Target
3b412a971394882cb2d7be867ab7af20N.exe
-
Size
2.0MB
-
MD5
3b412a971394882cb2d7be867ab7af20
-
SHA1
2234683a124d00e68170182b49c510f381252b66
-
SHA256
c5b5763bad6c7e17bd8a9943267cc5ff022c06a66cb95736bd77b105f84164e1
-
SHA512
c4ce2cfb0b2adee7ff2aba84d790b621f2de5c02793238a9cae4d90ac5c06eda248d908276477b5e59ebbe5a5183357e1ca24c4d1573d53f1d91aa47712feed4
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYc:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y2
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x000800000002339f-12.dat family_quasar behavioral2/memory/4660-30-0x0000000000430000-0x000000000048E000-memory.dmp family_quasar behavioral2/files/0x00080000000233aa-46.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation 3b412a971394882cb2d7be867ab7af20N.exe -
Executes dropped EXE 3 IoCs
pid Process 2408 vnc.exe 4660 windef.exe 3016 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\b: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\i: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\j: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\k: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\p: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\t: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\w: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\n: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\o: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\s: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\u: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\x: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\y: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\z: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\a: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\h: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\l: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\r: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\v: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\e: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\g: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\m: 3b412a971394882cb2d7be867ab7af20N.exe File opened (read-only) \??\q: 3b412a971394882cb2d7be867ab7af20N.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x00080000000233aa-46.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3672 set thread context of 1928 3672 3b412a971394882cb2d7be867ab7af20N.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 2488 2408 WerFault.exe 87 4228 3748 WerFault.exe 110 5100 3016 WerFault.exe 100 1332 4140 WerFault.exe 126 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b412a971394882cb2d7be867ab7af20N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b412a971394882cb2d7be867ab7af20N.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 348 PING.EXE 4212 PING.EXE -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 348 PING.EXE 4212 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4336 schtasks.exe 1940 schtasks.exe 1332 schtasks.exe 1384 schtasks.exe 856 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3672 3b412a971394882cb2d7be867ab7af20N.exe 3672 3b412a971394882cb2d7be867ab7af20N.exe 3672 3b412a971394882cb2d7be867ab7af20N.exe 3672 3b412a971394882cb2d7be867ab7af20N.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4660 windef.exe Token: SeDebugPrivilege 3016 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3016 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3672 wrote to memory of 2408 3672 3b412a971394882cb2d7be867ab7af20N.exe 87 PID 3672 wrote to memory of 2408 3672 3b412a971394882cb2d7be867ab7af20N.exe 87 PID 3672 wrote to memory of 2408 3672 3b412a971394882cb2d7be867ab7af20N.exe 87 PID 2408 wrote to memory of 4368 2408 vnc.exe 89 PID 2408 wrote to memory of 4368 2408 vnc.exe 89 PID 2408 wrote to memory of 4368 2408 vnc.exe 89 PID 3672 wrote to memory of 4660 3672 3b412a971394882cb2d7be867ab7af20N.exe 90 PID 3672 wrote to memory of 4660 3672 3b412a971394882cb2d7be867ab7af20N.exe 90 PID 3672 wrote to memory of 4660 3672 3b412a971394882cb2d7be867ab7af20N.exe 90 PID 3672 wrote to memory of 1928 3672 3b412a971394882cb2d7be867ab7af20N.exe 92 PID 3672 wrote to memory of 1928 3672 3b412a971394882cb2d7be867ab7af20N.exe 92 PID 3672 wrote to memory of 1928 3672 3b412a971394882cb2d7be867ab7af20N.exe 92 PID 3672 wrote to memory of 1928 3672 3b412a971394882cb2d7be867ab7af20N.exe 92 PID 3672 wrote to memory of 1928 3672 3b412a971394882cb2d7be867ab7af20N.exe 92 PID 3672 wrote to memory of 1332 3672 3b412a971394882cb2d7be867ab7af20N.exe 94 PID 3672 wrote to memory of 1332 3672 3b412a971394882cb2d7be867ab7af20N.exe 94 PID 3672 wrote to memory of 1332 3672 3b412a971394882cb2d7be867ab7af20N.exe 94 PID 4660 wrote to memory of 1384 4660 windef.exe 98 PID 4660 wrote to memory of 1384 4660 windef.exe 98 PID 4660 wrote to memory of 1384 4660 windef.exe 98 PID 4660 wrote to memory of 3016 4660 windef.exe 100 PID 4660 wrote to memory of 3016 4660 windef.exe 100 PID 4660 wrote to memory of 3016 4660 windef.exe 100 PID 3016 wrote to memory of 856 3016 winsock.exe 101 PID 3016 wrote to memory of 856 3016 winsock.exe 101 PID 3016 wrote to memory of 856 3016 winsock.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b412a971394882cb2d7be867ab7af20N.exe"C:\Users\Admin\AppData\Local\Temp\3b412a971394882cb2d7be867ab7af20N.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:4368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 5483⤵
- Program crash
PID:2488
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1384
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:856
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\yzFLAhongKrw.bat" "4⤵PID:1004
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:3304
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:348
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:4140
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:1940
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kLhmJ98c6vCX.bat" "6⤵PID:3232
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:4744
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4212
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 19966⤵
- Program crash
PID:1332
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 22524⤵
- Program crash
PID:5100
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3b412a971394882cb2d7be867ab7af20N.exe"C:\Users\Admin\AppData\Local\Temp\3b412a971394882cb2d7be867ab7af20N.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1928
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2408 -ip 24081⤵PID:4752
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:3748
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 5203⤵
- Program crash
PID:4228
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:2196
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:2980
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:4336
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3748 -ip 37481⤵PID:4212
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3016 -ip 30161⤵PID:628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4140 -ip 41401⤵PID:3964
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:688
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:4660
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD51c5f5ae38b251a4e1c096264a5d31cef
SHA1890f1abdfd288f980b0398949ad2fd1515325717
SHA2561340dda5681fbefbc6ccd4ca95849a7bf06e6322df95cd3c701920635084b0a3
SHA512b89dfaabc991f88efdd40526efe50c5eef167928ba48cdf63f9acb2c5410c70c0fbe0066feff56a5eeb5a857b766332af45d258feaaa70a02ed67349f2d8a148
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
208B
MD5560a2e5834bfe0e972121174c9451a9f
SHA1b4dcaeb83f003298a721bc88930348942a04efb4
SHA256a1df08ca681aa658cd4a81cf46140961c915f7f8fffaafc7ad7b91eaa6caea16
SHA51235fafa2249c14561950f65d47261434499c8d5584c8845dc6a9868e67a06b0f5eaaeedda2531a1cc45b810b7f47360c1ce8919e3489e1fb902cbd2b5fe7de13e
-
Filesize
224B
MD530ffa231d3a340b32410b94fa34558a6
SHA18996cb1350a03032a8d4c561d7c8b6b4e9c4586a
SHA256372102c33397664979edb8c19e8dec339204b354fe6aef58fbf6a3dc31e00dc4
SHA51279e54e141d94bf79851d6fb922dc5ea4bfdb4b1ec74b5b22eed608bb95ae7bf0390998199d9ee7270004b27eae0109f437942cb912627fdaef40bae4b3e9b9b0
-
Filesize
2.0MB
MD5ab6a467ec26c7d81bbcf4b383f96810c
SHA1157869a290404e7a3973d57632b2271ec009926c
SHA2563432fd9b25f96d9f464cb332843982442c9f78c8dc916278da6075dfc651fd82
SHA5128e5c0e6aaa52729323de31feddf72010a9342a1b598f96aa7dd616f3b7afc663a628e65b0c2c3cb86337c7fe2507494ba802ff6088ebbc0c77262da69ff5320c