Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/12/2024, 19:15
Behavioral task
behavioral1
Sample
950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe
Resource
win10v2004-20241007-en
General
-
Target
950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe
-
Size
2.0MB
-
MD5
bd2ffe58dc96d5800a2a5994786074d3
-
SHA1
e73cf25e648d7e3adbe1e997c01d9aacac48d78c
-
SHA256
950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89
-
SHA512
f0b82155cce0ec834e3b05784f83d46fe69a6265e3e696f2726f231df9d71e703e4e4319d8ab5310916d63482d789d085c8fa7eb06f56cafccde9ab697b636f8
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYp:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yf
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/files/0x000a000000023b7b-12.dat family_quasar behavioral2/memory/1744-31-0x00000000009C0000-0x0000000000A1E000-memory.dmp family_quasar behavioral2/files/0x000a000000023b7d-45.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe -
Executes dropped EXE 3 IoCs
pid Process 4364 vnc.exe 1744 windef.exe 1428 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\j: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\m: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\y: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\t: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\v: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\e: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\g: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\h: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\k: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\l: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\u: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\o: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\p: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\q: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\r: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\s: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\z: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\a: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\b: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\n: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\w: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe File opened (read-only) \??\x: 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 8 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000a000000023b7d-45.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3100 set thread context of 3064 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 4164 4364 WerFault.exe 82 3564 2688 WerFault.exe 105 4412 1428 WerFault.exe 95 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2368 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2368 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1484 schtasks.exe 3812 schtasks.exe 3720 schtasks.exe 2864 schtasks.exe 1484 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1744 windef.exe Token: SeDebugPrivilege 1428 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1428 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3100 wrote to memory of 4364 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 82 PID 3100 wrote to memory of 4364 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 82 PID 3100 wrote to memory of 4364 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 82 PID 3100 wrote to memory of 1744 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 84 PID 3100 wrote to memory of 1744 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 84 PID 3100 wrote to memory of 1744 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 84 PID 4364 wrote to memory of 1084 4364 vnc.exe 85 PID 4364 wrote to memory of 1084 4364 vnc.exe 85 PID 4364 wrote to memory of 1084 4364 vnc.exe 85 PID 3100 wrote to memory of 3064 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 86 PID 3100 wrote to memory of 3064 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 86 PID 3100 wrote to memory of 3064 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 86 PID 3100 wrote to memory of 3064 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 86 PID 3100 wrote to memory of 3064 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 86 PID 3100 wrote to memory of 1484 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 89 PID 3100 wrote to memory of 1484 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 89 PID 3100 wrote to memory of 1484 3100 950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe 89 PID 1744 wrote to memory of 3812 1744 windef.exe 93 PID 1744 wrote to memory of 3812 1744 windef.exe 93 PID 1744 wrote to memory of 3812 1744 windef.exe 93 PID 1744 wrote to memory of 1428 1744 windef.exe 95 PID 1744 wrote to memory of 1428 1744 windef.exe 95 PID 1744 wrote to memory of 1428 1744 windef.exe 95 PID 1428 wrote to memory of 3720 1428 winsock.exe 96 PID 1428 wrote to memory of 3720 1428 winsock.exe 96 PID 1428 wrote to memory of 3720 1428 winsock.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe"C:\Users\Admin\AppData\Local\Temp\950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:1084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 5483⤵
- Program crash
PID:4164
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3812
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3720
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oCyPRzyFHu3W.bat" "4⤵PID:1400
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:4396
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2368
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:3864
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:1484
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1428 -s 22484⤵
- Program crash
PID:4412
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe"C:\Users\Admin\AppData\Local\Temp\950c8b041fc05111e24c18c25ff7d8d0a79034ce0e22857be44ae8ee12625d89.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3064
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1484
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4364 -ip 43641⤵PID:4856
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:2688
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:4960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 5203⤵
- Program crash
PID:3564
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:1684
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:4508
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:2864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2688 -ip 26881⤵PID:4040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1428 -ip 14281⤵PID:1476
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3972
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:412
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1588
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD5489b88436a82079129a72c8cd4ba9598
SHA1c62340b5693dd699c4e597b65ff2782635d0e2e4
SHA256ebe77834afbe74ac8d0e02f0b50c7139220b5f157bcf794e50aed6205000ff89
SHA512fb8744677df2824429aee149b65c00759064b1f7c8219df1666e8cc71d187decc424abace04ae7637e60f09201e8ddd395a821ae1c0ec8b12c72fd93ac6e8cdf
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD5b5863090d1e7c5f590bda47570a2f3d0
SHA1537d24b356f85f5b006b2f3c82de156fc30803c5
SHA25632a74ce761a4ea68213cc49283e61aafdf1324b01acf67e253ba03eb439cd161
SHA5123e4f35b87bf62ccaaed93cf98963ebb427967173c2de3f6ee23f95fa9f05d371cb2c906afaae001e666258e99c1f74f4ae1ca683a18bc2797a6297279b623525
-
Filesize
2.0MB
MD5cb6bffa298c119954a5a4d411b6a7a82
SHA1155af282817f4436df644e8b847f49fd83262c6d
SHA2568b3fef54e7ad2612cddaab561c245619b8f63061e6508230fc8142730a50a1af
SHA512450248bf1048d479087a53c30d3b360f26c51ced5541962eceb53978c9b77dbdd3c57cb3a9659c6c87b308e5198bb0b66f5c2f6924a58314634ce3a1e4dae2b0