azorult | d6af1ba026c010e4d006842da28b478419bbc4c711f907a28c52079bc7fea1bf

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-09-2024 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Azorult 3.3‌.exe
Size

1.1MB
MD5

b91fe4c246efc048b78c9e162754a7a9
SHA1

15e1c4fe989290b07b60f93340476a9ba025bfa9
SHA256

d6af1ba026c010e4d006842da28b478419bbc4c711f907a28c52079bc7fea1bf
SHA512

4538a437fb2241ee38b1ab256618bbf2ea752bab92146fbf9138c6dd9585c5a5291155e19c6004372c925f300c0c7cfa87b7dfc467b556e8dbab092d8d04a2d2
SSDEEP

24576:KMyijQZ+ZJLXrfQRTJ6/aIRQbhB0LrKqk:/D0Z+ZZr4RT/I2dB0yqk

Score

10^/10

azorult xworm discovery execution infostealer rat trojan

Malware Config

Extracted

Family

xworm

146.190.110.91:3389

Attributes

Install_directory
%AppData%
install_file
svchost.exe
telegram
https://api.telegram.org/bot7023899363:AAFEzgbfWzhyE32Lf95TKSRYEYXMd4AfMyk/sendMessage?chat_id=6354844663

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1056-22-0x00000000000D0000-0x00000000000E8000-memory.dmp	family_xworm
behavioral2/files/0x00080000000191f8-18.dat	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1288	powershell.exe
2788	powershell.exe
2276	powershell.exe
2120	powershell.exe
2928	powershell.exe
3060	powershell.exe
1552	powershell.exe
1988	powershell.exe

Drops startup file 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.lnk	csrss.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.lnk	csrss.exe

Executes dropped EXE 3 IoCs

pid	Process
2364	Azorult 3.3.exe
1056	svchost.exe
2076	csrss.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Azorult 3.3.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Azorult 3.3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Azorult 3.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000007f3cff158c5919e7a8443e3d5350a343e2c96786da7f3c741fe799a07eaf1852000000000e80000000020000200000007d6062e7dac47758d6e5bd03448af532af69921a847319ae5c4689c77afbdd36900000003463342f326fd3cc6dc177cd66cb3ff96a8b96fd344fc6f6ee9ec49f465924ac9470483ca5c10ac60a40da31cdef028efb9e0fd8d5a1c37eb2866fd2980595f7ed505c6b2bac7d888580808b173414ca7847e72891011b10652d5bc6d0072cb445d814e590a232dd932a33c0d8250d07a2528e8b0785adc493f01c7851f5fda5721de31fc93a7886781b8cd460faeb724000000059a4fc6f3287eb6816e8c0852849feb9deacc0e960038c04d8daccd45eb927e97b150657572a76117e9a5a8019916383c9a855e98ed583347e612d19f2e155c3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffe0ffffff620100006604000009040000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3DE64861-687F-11EF-8334-424588269AE0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431369986"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000846e2e4ab40ccd1d01b7cfd9d7c69909751ac05e58d712824d3dd1934d5a7aa5000000000e80000000020000200000000f576b30904febc9bf8001f417be6a9b7237cd60934626b78b6533e0ded20da720000000900cdea3537baee018ea18937266772380804eb49350c36ba7a3d325db1abecf4000000044b7bb5ed55351096637d85ff7ca8f725d4ad36de636614449102098e6560d37b708d4b189ac007a938107dcdaedd6ce1cfea5a8f31d221625db436574d15772	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20dcc2088cfcda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies registry class 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2"	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f4225481e03947bc34db131e946b44c8dd50000	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Azorult 3.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1"	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Azorult 3.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\IconSize = "16"	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_TopViewVersion = "0"	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Azorult 3.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	Azorult 3.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	Azorult 3.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	Azorult 3.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Azorult 3.3.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1056	svchost.exe
2076	csrss.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2120	powershell.exe
2928	powershell.exe
3060	powershell.exe
1552	powershell.exe
1988	powershell.exe
1288	powershell.exe
2788	powershell.exe
2276	powershell.exe
1056	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2364	Azorult 3.3.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	svchost.exe
Token: SeDebugPrivilege	2076	csrss.exe
Token: SeDebugPrivilege	2120	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	1988	powershell.exe
Token: SeDebugPrivilege	1288	powershell.exe
Token: SeDebugPrivilege	2788	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe
Token: SeDebugPrivilege	1056	svchost.exe
Token: SeBackupPrivilege	1760	vssvc.exe
Token: SeRestorePrivilege	1760	vssvc.exe
Token: SeAuditPrivilege	1760	vssvc.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2364	Azorult 3.3.exe
2364	Azorult 3.3.exe
2364	Azorult 3.3.exe
2616	iexplore.exe
2616	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1056	svchost.exe
2364	Azorult 3.3.exe
2616	iexplore.exe
2616	iexplore.exe
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
2148	IEXPLORE.EXE
1980	IEXPLORE.EXE
1980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2364	2976	Azorult 3.3‌.exe	30
PID 2976 wrote to memory of 2364	2976	Azorult 3.3‌.exe	30
PID 2976 wrote to memory of 2364	2976	Azorult 3.3‌.exe	30
PID 2976 wrote to memory of 2364	2976	Azorult 3.3‌.exe	30
PID 2976 wrote to memory of 1056	2976	Azorult 3.3‌.exe	31
PID 2976 wrote to memory of 1056	2976	Azorult 3.3‌.exe	31
PID 2976 wrote to memory of 1056	2976	Azorult 3.3‌.exe	31
PID 2976 wrote to memory of 2076	2976	Azorult 3.3‌.exe	32
PID 2976 wrote to memory of 2076	2976	Azorult 3.3‌.exe	32
PID 2976 wrote to memory of 2076	2976	Azorult 3.3‌.exe	32
PID 1056 wrote to memory of 2120	1056	svchost.exe	34
PID 1056 wrote to memory of 2120	1056	svchost.exe	34
PID 1056 wrote to memory of 2120	1056	svchost.exe	34
PID 2076 wrote to memory of 2928	2076	csrss.exe	35
PID 2076 wrote to memory of 2928	2076	csrss.exe	35
PID 2076 wrote to memory of 2928	2076	csrss.exe	35
PID 2076 wrote to memory of 3060	2076	csrss.exe	38
PID 2076 wrote to memory of 3060	2076	csrss.exe	38
PID 2076 wrote to memory of 3060	2076	csrss.exe	38
PID 1056 wrote to memory of 1552	1056	svchost.exe	40
PID 1056 wrote to memory of 1552	1056	svchost.exe	40
PID 1056 wrote to memory of 1552	1056	svchost.exe	40
PID 2076 wrote to memory of 1988	2076	csrss.exe	42
PID 2076 wrote to memory of 1988	2076	csrss.exe	42
PID 2076 wrote to memory of 1988	2076	csrss.exe	42
PID 1056 wrote to memory of 1288	1056	svchost.exe	44
PID 1056 wrote to memory of 1288	1056	svchost.exe	44
PID 1056 wrote to memory of 1288	1056	svchost.exe	44
PID 2076 wrote to memory of 2788	2076	csrss.exe	46
PID 2076 wrote to memory of 2788	2076	csrss.exe	46
PID 2076 wrote to memory of 2788	2076	csrss.exe	46
PID 1056 wrote to memory of 2276	1056	svchost.exe	48
PID 1056 wrote to memory of 2276	1056	svchost.exe	48
PID 1056 wrote to memory of 2276	1056	svchost.exe	48
PID 2364 wrote to memory of 2616	2364	Azorult 3.3.exe	55
PID 2364 wrote to memory of 2616	2364	Azorult 3.3.exe	55
PID 2364 wrote to memory of 2616	2364	Azorult 3.3.exe	55
PID 2364 wrote to memory of 2616	2364	Azorult 3.3.exe	55
PID 2616 wrote to memory of 2148	2616	iexplore.exe	56
PID 2616 wrote to memory of 2148	2616	iexplore.exe	56
PID 2616 wrote to memory of 2148	2616	iexplore.exe	56
PID 2616 wrote to memory of 2148	2616	iexplore.exe	56
PID 2616 wrote to memory of 1980	2616	iexplore.exe	58
PID 2616 wrote to memory of 1980	2616	iexplore.exe	58
PID 2616 wrote to memory of 1980	2616	iexplore.exe	58
PID 2616 wrote to memory of 1980	2616	iexplore.exe	58

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Azorult 3.3‌.exe
"C:\Users\Admin\AppData\Local\Temp\Azorult 3.3‌.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\Azorult 3.3.exe
  "C:\Users\Admin\AppData\Local\Temp\Azorult 3.3.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://xakfor.net/forum
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2148
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:406544 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1980
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1552
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svchost.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- C:\ProgramData\csrss.exe
  "C:\ProgramData\csrss.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1988
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'csrss.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2788

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1760

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
- System Location Discovery: System Language Discovery
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\csrss.exe

Filesize
30KB

MD5
0998890ccf8a3d8702db7a84fe6dd7b3

SHA1
18e561e0ef68fb08d8f391eacd45c7d573206b92

SHA256
c33e1408ea96b9ea7a72d44d7742effb4a98776711b7c94c4997a155af61b220

SHA512
8132312fb66a9d947eef3f625a4c18b8e640cec51616d0a9fd756e028d1bac5677f5de9a53c3ed32186cb238e8c46613b8c3d6641a6a953d7961412b030c6dd1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\10A18B4E3A1EFF2159C89DEBDD93AEDE

Filesize
504B

MD5
5e895f1e5fb265c96d1960f97a551d7c

SHA1
98f75337e31a863bc179f8628c1f97272812c2cd

SHA256
7360cfc093129ff3b308f5c29c6416520e5faf23ea6694d163a9ea7393723132

SHA512
b6f0abff6e220e43db512396829acfac57a3c5770290a0d9126da056174431d981186d7e1182a6c12abbc98367868357383f98678d9456da8a3fe15367c34943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
ab0ad66f97ddcab4ca6d485f92cd1cf9

SHA1
5fe04980078f6ed7d5670730cee79c35ec92da26

SHA256
c69b02d3dfda425389364045f486ac66203b3ad0b1cbbc48cb3d12188f888888

SHA512
bf733a33fad76e1211259ffbc671db1398b71eccfb248432645bb88e564b38bafe027d35bdee246d85f1a923635b170f21e653236a20c41d50e5a82ab3631bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\10A18B4E3A1EFF2159C89DEBDD93AEDE

Filesize
546B

MD5
dd16d56ac3ae8f000433e15835e7ad6a

SHA1
6c69213dcd09af9cc52af09c0635a5295e60f53d

SHA256
9b7ae127fbb9ed7d2782579496e01ed5fc6194e53b0ebac3712107d5171033c4

SHA512
4553578ec0537466216d4d20250b7b4e054e04f8def9db3298f7ac24a850326670f773113c797c523f316ba264ca48a3f864ce913878b1adacad1a4ebd5e6f2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b47ac1c52aea415244d6ae946d0a6cab

SHA1
2bbc28264b1afe43159195287b5a2ddfbaa40ab5

SHA256
c2353ed407b555fa4cb04156585d10df481b7097b1acc5a3e29e9d1f32c1d96e

SHA512
6376897fc7be8fa1fd89716c3823635dbb8c4b3e78a26a6fff4506d7a7eff7e118e6d6eb57c6c09fa19abaf1925a6dce8de1c4e14a27b132a130d37be8c8db64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
383c40ec38334466886dfddba2bf6ec9

SHA1
d9a2720174dc74511c4854e09fc727185e672835

SHA256
4f5845940d7237c9ef25af7029cf99c3011a0489967826c3ae272757ffb50a0a

SHA512
29feb2930c5b231d175b82d957130e71a76b1117b14352ab2f8bf8666c2b63797292a0cfe17a61a686e20a910592735108480fcb4d7a31822e22849a33efa709

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b9319cf04c5e1f32faef730c1c1b2fc

SHA1
b5467995e16f82f1fe8d8e801cdaadf542793e0b

SHA256
9b7c55bab5a0853f8764a10eaba7a5ce4864c02a3dc0660c460a198d56c42fba

SHA512
becd168aaf27744551a70caae2fcde81ad0b82ba63f7fe5ff9f75346f805a2e4b54bf21b51b49b31d5653db482dfa9754e0e1d60b6847a84795a57ac850de91a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d504f1bbb02c72b16034e2cf88f8303d

SHA1
0a3ee01580d5141dd8e895f9aac2b5d5edc2c320

SHA256
0845de5c5ff583ceb7ae8d947bd4a8632451666205fdf079314865e76c09fe54

SHA512
531666305c349345ad638b5417ea5177a71f1f60ef2c7e950221a90c065848bc1be927c7f1d0332a917f418489348a616ea91f5ac3feaa11193205887ca2e79d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb1ed370249fa495ef0bb7d302e4a4f5

SHA1
129af7b6ebf57d3486c434d25cd402f94d39f92f

SHA256
a467039b26aa45311e444d9857a2a313127286a0daeea488b0c0322901a603e8

SHA512
8884032e8ab2bd59434139c93fe388edfaf43abb868792c1fb52b6cc001c7e0c57e916cbc3f0a8ec1c63cfe4833a276e918035db0aad915969192191f189121c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c20c11d9ca7f98e0399e5ccdfc889030

SHA1
7b730c0bae23a1f121ca85246ecb40ac54a00d36

SHA256
c013aa27a867948cf1a466b33f39b231c4f60ae381c3189f0b5f0ff19c9544d2

SHA512
f488fba7ebbe6ea6c5c417cf9360e43af09c38b502c898a9698f68c69a104a5e81ac593ac4f24702b7913da7b9d1e1e9036b95c4ac79e5d97acbfc357f053499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b79c1cf72f34acb031475ab642c17e40

SHA1
642b355d365e04213bb73c0dcbdfd247c0b81bef

SHA256
c8362ac4623cec9eeed88cffc07f742aba55e4d4ec1877977f3ca906ead361fc

SHA512
8f8de0bebc007ad9f0c2129fa2a0f22c854293cc88272c96d6f580c1e13cf5f75fc4d45253f51faa29c50772d8f95cdf3fda14a6e36ae4f95329909a77f9015e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a120e445c6da708a4199cd6aae4b7115

SHA1
a8e1fc6912d3456d9f062609d31fd56d810523c1

SHA256
2a61ce9b7f169bdd0db3fe10d79880d26f790e125a5c5c47ee25b59413ba93b2

SHA512
c0ac1cdb84a71b1a650735720d9243b49dd275cbbce78965897212e034517ca814834a5b8b16689db2bce7373f095b1ddda2246b07036255d104c54c2475aec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bdfa34ceaeebb60322159bbc8a161b1

SHA1
dcb0775fce344f4fac8b02d17a5ee0cb4dec8251

SHA256
931c4a033771ff8a296be106dd0a8ec9de9bfbae9abdbd7496346324a95c4bb9

SHA512
ff77453eeb8a029f2f06f5d5edc671588c9f7d05ce6be4f3e0e8969b74c39affba6cb5aa2dd65112eccbe3974d7ac0892c237a1e41b5921cb31c84ca3b31a5a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d35721440539516dbf5b836e59da6b2

SHA1
71307eaa7498b1ea6862499d5174fff698baca7f

SHA256
4040a56d8409f269a7a6e12dc81bd4e6f92451a08fd2e3b1729dde8a0a1ca686

SHA512
f2b634d8f307805ac573b686beee32b348c5bbcc6a23031d4dc52f7e5a4d804712b1c56c50d8edc8cdb0a1d8c7daa4bedd898adbd81c3232478bde3313f0de16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3b6211347c8d784c7adb5043360480d

SHA1
aff0f9ddcc56bbd5d8913d4cd63111c5da78b133

SHA256
55e2195bb57017fadb47412990965d5fc7083806d1fd9662f10831fed490ae38

SHA512
b656f782e9adb2233652e0711a1cd3a09e3d54da8e1b8d2bffb2be09ac9e7d614cc5cb87fbc85e764275ea00a847b9066fd09624ee0b02a2c7f551608486ab2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9c95408628cd307317109d7a9a1b2ce

SHA1
bf998bdf6212f90bd3cb4d59a39f3d1c663d7d65

SHA256
465aa4619e95369a48c8d625190970e37f348f79c9c61b347f5140db66c81b5b

SHA512
ca9957d65b582a881864eb34d9df1a1e9de5023c49f5b6987df853b817ffa9b8fe1404aa5750794be36c6e002f44173a0ab661627e1356acd27c3eba3a421cfc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d3a0db43ad1734dadbac7f5182dc991

SHA1
9f15cf69f72594f5c46fcf7aeee1d96878dc10f6

SHA256
83c9627b238c5f3ec9870eb67ff0115a34fb5139514c762744c6ffb237b1644e

SHA512
89f9f4c90db47fbdec249d119d8d00c4ed05ef630efc93da7d1e39e0503e9f58a4fd2c056ba232bf4285635b867c22a7402ac6dd17ad134d9e9fd8a35f59d586

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e901e867fa0d8b0e0bbba1fa9a500d9b

SHA1
0c03936dbc6dd080d3b0e740c86ca3bca25f58be

SHA256
cc3fd933fa873ac4d4b587716d019d0fd81259a21fc8ffd72bcf7b711864c8c4

SHA512
d8c350bafadf0750d4c317c179cf9b87429b9cbd7b1d811be63d29a284cb7b2936261e90c790cb2e1d55ec77e3876ba94277eb2e8b4d183057871ae23cfe45a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb90e27097a7ec063cce39f0abc5d548

SHA1
ac9e96371623c8ad5e9028222655ef9e4ae6d2af

SHA256
01c942a487be30416b8abee1e3e3b59438ca90a3f115016258a2f9c5b9b8cea9

SHA512
809539ef8fc471f042cdb53361edd1838b0ba141fb7c16d31b595dd84581c13ff6067fa3862e4369fdccbc5612f51b16fc0c1301bc56fe25fcd4f53d02be2abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9617e517cecbc5c9049eb96fe13928f3

SHA1
edb1cc6426fa18aef96d1a6f73a8eea38e34e159

SHA256
a1d16e8672e30e123d7f16983616055ddcadcb8ead93a18a24d85155d30adc06

SHA512
b7407e041c971e715d795f948e50bd11cfc3ea118baa2e86861d7d00a81f2672dcee4b45db6cfa24b2a849e83001f04351df8d30802ea208531ac5273b5c3622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82bbc9da701a687cbf6cd01faa49125a

SHA1
7482a5e63f3c6f2ec0072014710ba796288826a6

SHA256
bcb46c13531aae8ac18031bd4ec8512a58a96e296910c22db2782748ef83865b

SHA512
16239e09d809b6f81f9b7d9b4a39bbb09a6a5e8a70e56f29cd203954e7347538a1848c55c8eca1c483278446055fc8bc1b3c0f1a8413afa4d72cab91a5e5f064

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2373d7862b5adc3cee7f9b3c66552b1d

SHA1
4ab749cbe23f1baa9060898bfa29bcffd0d4107c

SHA256
998728b2d78357bb9047152fae2487b8f15d92c77828d7dc5a1c0c435c719a2a

SHA512
d16664fec798b60eca9d616c28ce128b1014cbf2c4a59570bb5e1bb5dd6e68aab794d4bfda15d42e7c46dcb7fccb94a0f1199d7632ab30e9b387ce825f2840f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8c4cc4e44b9ecb3eb222ad2624dd14c

SHA1
bc00981596903d091171bff6beef8f9feeb2c316

SHA256
ba9051a54a98ad77934e637e5dea344f9d34c5c74a66703b900dc1032e3e66ee

SHA512
762cb9b748dc22ac4615deafa0fe2e2843e8fd70a2fa0cb0d6d28e95631cf5bf5c6a2cd82ce25aeea4462b011d3d92eac202651aed34b59261842f1147634b24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f0b060d1d5d6471ad24110e23e7d6a0

SHA1
87ba341de167fa573771306414837337d5b41062

SHA256
51a480328aafe803fac360db37b60a7c10dab52d862c9f590ad8148f661e3507

SHA512
e0ca46feb4aaef9aba3b5aeae8f0fb4f697a9e5dff36189d07a31161b4b5c7e3d1dc84ca156395945d620d6c4bff7b0762ee02a505acfb61ae830a35f939b434

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
01d2195b6e3122358790f0cdc732e67c

SHA1
946f983b371d301f71ff7e623e65bc723b2415b1

SHA256
32a4395abcd02d2e14040ed06b21396fc55627bc00b3da0615b6fa6f48f94a0d

SHA512
14bdea38aa9edbae40806addfd8b420f70b26d78080ca98b0c6c46620f3ee0fd913e27860021f6b3db99cf4ca9af8e49456146ecca5396ddcd8c5ab469a9efb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HHT5LGG0\btSVMKKaV[1].js

Filesize
33KB

MD5
e2ec36d427fa4a992d76c0ee5e8dfd4d

SHA1
47ec4ace4851c6c3a4fe23ad2c842885f6d973f2

SHA256
36488e81afcbc4d7018b8764c18032b10be21aa45521c9671fde0cc77f70b2d8

SHA512
d1ae29d19f65ce74b9b480c82b87315634ec2e96d199f5feb423918af9ad6e24c8b436e03904d452f71562f04c42acbb250256eed73bcd592a79c08911c74976

Download Submit
C:\Users\Admin\AppData\Local\Temp\Azorult 3.3.exe

Filesize
1.3MB

MD5
8440a861c68965a66c009b140e1bee47

SHA1
801a8c77156a2c6cbc5899f36c961dc8fdc56665

SHA256
a8add4815bce2e26df3cd492c5686e22ab842bfa52c68af3f33c23adb820d06f

SHA512
c42903216f9f35368d41853ae96aaa7a7a07ce0730ca99b26909b98f5525b4fd772e0868c683fae0ca71730c0586ad3130be4ef3e6af68e299a933d9accca266

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3F25.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3F24.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~DF376B3E66C67784AF.TMP

Filesize
16KB

MD5
e1fe10f7137e19656d6332025a7f7cd8

SHA1
7588aca4803aa9bd4fd1c0f83b78e503b7c27a13

SHA256
4cd6b829057e50c2ac92aa23a6d92fc625ec1ac89cebbb95a12d9aa299a193b0

SHA512
1f2a65d04c6c25eaa2f9a8c4319283e96828d1c301d6cd5a25d44e0202c5a517fe03a53f9f77a951443d70b8a2d49be0c6c6ce540b67ac1c8e1b00f659d193a2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AWSQ4YT7.txt

Filesize
113B

MD5
9c054e3f9261c4af34030adf6d35d0f2

SHA1
10042c1684839bc817de178fa985432d021ce194

SHA256
c8d8c4171b09c87880ef38c395dba9303f1507576200fc4f1a68af5601e17e0f

SHA512
7af60d1f89410914ab616572830f85ea55bf418d38690a961ff5c35e3013628627612b5305146449c9080a0d8d8e66db586ce3d759bb0f426dc4a6a72e9c782f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PV4UUA1D.txt

Filesize
96B

MD5
542ad0f97ffddeefb9845c19441ef7c3

SHA1
71476a18c234cfbc428bc8737d8b0bee0ef19be6

SHA256
0a52d543e6699655123d462aa8a019d751df653895c236377f241bc7ffb3c418

SHA512
da39ffef6a5e80278c7b192696f04082eb8817dfe09bc05fe6f5d3b59e5f4966e76d2c805fb5c2dfdcac0e56fd7225c22421c34e88dc912e3e4ea94c7ee792c2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
793209850878547c7f9973a626248878

SHA1
b8a9b6802819f79a6c6e0cf1e5b60b9d013634e9

SHA256
1ec676462084deca8949dc193f67c468ad18e16c9baccdf21cf1bd782f1ab663

SHA512
68e4cb18eb4b64cef6eec2c3aee47ab2102399836afdfe466ae054347cefe1bd451e976e8eda60e4af36d1d8caf1340a8888b870e4babb8d7ca90e91561785f9

Download Submit
C:\Users\Admin\AppData\Roaming\svchost.exe

Filesize
67KB

MD5
50dce71a753bad01a07904f2af283123

SHA1
1beab766071ddeff0c8e577c6717debcee0d21e6

SHA256
8fb751033d1546ce28f5dcef171857ee879bdd31d76be2ae556f246c258473f3

SHA512
7cdc64dcfa8a0cbc1375a1878f560beb083cd9778ff67c5c0f1b693927c35365b384affc9dc33cade4aeaafded11ac328001a18ccb34a559678c1f50fa886c01

Download Submit
memory/1056-22-0x00000000000D0000-0x00000000000E8000-memory.dmp

Filesize
96KB

Download
memory/2076-23-0x0000000000200000-0x000000000020E000-memory.dmp

Filesize
56KB

Download
memory/2120-37-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2120-38-0x0000000001FB0000-0x0000000001FB8000-memory.dmp

Filesize
32KB

Download
memory/2364-25-0x00000000001F0000-0x000000000034A000-memory.dmp

Filesize
1.4MB

Download
memory/2364-26-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/2364-27-0x00000000021A0000-0x0000000002208000-memory.dmp

Filesize
416KB

Download
memory/2364-76-0x0000000008EC0000-0x0000000008EC2000-memory.dmp

Filesize
8KB

Download
memory/2788-68-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2976-0-0x000007FEF57E3000-0x000007FEF57E4000-memory.dmp

Filesize
4KB

Download
memory/2976-5-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download
memory/2976-1-0x0000000000BF0000-0x0000000000D0E000-memory.dmp

Filesize
1.1MB

Download
memory/2976-24-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

Filesize
9.9MB

Download
memory/3060-44-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/3060-51-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download