Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07-10-2024 01:08
General
-
Target
1aa97711314612b3413c935969590bae_JaffaCakes118.exe
-
Size
693KB
-
MD5
1aa97711314612b3413c935969590bae
-
SHA1
257ebb345989c07bae2b6acddb5bc848d0656bb0
-
SHA256
d59e0a9e77727cec2c7423c014a9c9dbab64fa54dec2e49482b262e00c9756de
-
SHA512
d755954df88b17cad3cf5abaa59e250043e2cc03340c3d7452ddf1da96d132c34ecc9a6caa8ba2dbf4b75cabf91a3f33c519dbbc62f765cc8d85f7c5bdacec2b
-
SSDEEP
12288:Vejv6Ky6XgWqQUElL1Y0UlT52pE/WuJIAu7n7rGPsUFRAp+9ZNN:Vejvg3RLC13UpT+d9yPhRAyNN
Malware Config
Extracted
azorult
http://gess.bit/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Unexpected DNS network traffic destination 17 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1aa97711314612b3413c935969590bae_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1aa97711314612b3413c935969590bae_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
712KB