Analysis
-
max time kernel
139s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2024 15:37
Static task
static1
Behavioral task
behavioral1
Sample
c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe
-
Size
488KB
-
MD5
c548ce11e698e058dd93f10830a598fd
-
SHA1
1030b5fe253e087b2a84c4d8e8a07d5b7f39313f
-
SHA256
8d707e04a8233293ec48b3bad843363388808911da22e3ceeb6ca340b3044bc8
-
SHA512
7d75bc0500c2e3aa1860f792a69ca661096b1bd5ec753c8f290c0f188785d13b97634853a94bd2573db1e7319ecc3050d8881e0b05f0aa63e4ba36ee8e85bfb9
-
SSDEEP
12288:eLcoLmD8td+uQCqHmvHDh0l8asK+TWOndaW7Zvf:eCod1QCfDal8vvPdZ7x
Malware Config
Extracted
azorult
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exepid process 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exeregasm.exedescription pid process target process PID 2896 set thread context of 3080 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe regasm.exe PID 3080 set thread context of 972 3080 regasm.exe regasm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1800 972 WerFault.exe regasm.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exeregasm.exeregasm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regasm.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exepid process 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
regasm.exedescription pid process Token: SeDebugPrivilege 3080 regasm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exepid process 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exeregasm.exedescription pid process target process PID 2896 wrote to memory of 4064 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe regasm.exe PID 2896 wrote to memory of 4064 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe regasm.exe PID 2896 wrote to memory of 4064 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe regasm.exe PID 2896 wrote to memory of 4064 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe regasm.exe PID 2896 wrote to memory of 3080 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe regasm.exe PID 2896 wrote to memory of 3080 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe regasm.exe PID 2896 wrote to memory of 3080 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe regasm.exe PID 2896 wrote to memory of 3080 2896 c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe regasm.exe PID 3080 wrote to memory of 972 3080 regasm.exe regasm.exe PID 3080 wrote to memory of 972 3080 regasm.exe regasm.exe PID 3080 wrote to memory of 972 3080 regasm.exe regasm.exe PID 3080 wrote to memory of 972 3080 regasm.exe regasm.exe PID 3080 wrote to memory of 972 3080 regasm.exe regasm.exe PID 3080 wrote to memory of 972 3080 regasm.exe regasm.exe PID 3080 wrote to memory of 972 3080 regasm.exe regasm.exe PID 3080 wrote to memory of 972 3080 regasm.exe regasm.exe PID 3080 wrote to memory of 972 3080 regasm.exe regasm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c548ce11e698e058dd93f10830a598fd_JaffaCakes118.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵PID:4064
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"3⤵
- System Location Discovery: System Language Discovery
PID:972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 5724⤵
- Program crash
PID:1800
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:81⤵PID:4156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 972 -ip 9721⤵PID:448