Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/01/2025, 04:45
Behavioral task
behavioral1
Sample
c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe
Resource
win10v2004-20241007-en
General
-
Target
c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe
-
Size
2.0MB
-
MD5
e21005f9f38d0924120f1e4d0c36ed04
-
SHA1
5c0e2fbb3ee586b4e2f7eacf11bf6840b732326f
-
SHA256
c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79
-
SHA512
390de9b3e8cb8d48a4c7a0b678f1f219f0d9f75e50cdfa45585c1a554b413726caa690b866f66d594c0f732e442443b449e2f42f4fab09859869398508391eff
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYV:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Yb
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral2/memory/556-31-0x00000000000A0000-0x00000000000FE000-memory.dmp family_quasar behavioral2/files/0x0007000000023c95-28.dat family_quasar behavioral2/files/0x0007000000023c97-45.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe -
Executes dropped EXE 3 IoCs
pid Process 1544 vnc.exe 556 windef.exe 3880 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\b: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\j: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\l: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\o: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\v: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\w: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\x: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\a: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\n: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\p: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\h: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\i: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\m: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\u: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\y: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\e: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\g: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\k: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\q: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\r: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\s: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe File opened (read-only) \??\t: c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0007000000023c97-45.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3780 set thread context of 2224 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
pid pid_target Process procid_target 3940 1544 WerFault.exe 3576 4512 WerFault.exe 99 2256 3880 WerFault.exe 95 2384 3140 WerFault.exe 121 -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 976 PING.EXE 1616 PING.EXE -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 976 PING.EXE 1616 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2864 schtasks.exe 3460 schtasks.exe 3088 schtasks.exe 3380 schtasks.exe 1544 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 556 windef.exe Token: SeDebugPrivilege 3880 winsock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3880 winsock.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 3780 wrote to memory of 1544 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 82 PID 3780 wrote to memory of 1544 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 82 PID 3780 wrote to memory of 1544 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 82 PID 1544 wrote to memory of 4272 1544 vnc.exe 85 PID 1544 wrote to memory of 4272 1544 vnc.exe 85 PID 3780 wrote to memory of 556 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 84 PID 3780 wrote to memory of 556 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 84 PID 3780 wrote to memory of 556 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 84 PID 3780 wrote to memory of 2224 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 86 PID 3780 wrote to memory of 2224 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 86 PID 3780 wrote to memory of 2224 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 86 PID 3780 wrote to memory of 2224 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 86 PID 3780 wrote to memory of 2224 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 86 PID 1544 wrote to memory of 4272 1544 vnc.exe 85 PID 3780 wrote to memory of 2864 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 89 PID 3780 wrote to memory of 2864 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 89 PID 3780 wrote to memory of 2864 3780 c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe 89 PID 556 wrote to memory of 3460 556 windef.exe 93 PID 556 wrote to memory of 3460 556 windef.exe 93 PID 556 wrote to memory of 3460 556 windef.exe 93 PID 556 wrote to memory of 3880 556 windef.exe 95 PID 556 wrote to memory of 3880 556 windef.exe 95 PID 556 wrote to memory of 3880 556 windef.exe 95 PID 3880 wrote to memory of 3088 3880 winsock.exe 96 PID 3880 wrote to memory of 3088 3880 winsock.exe 96 PID 3880 wrote to memory of 3088 3880 winsock.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe"C:\Users\Admin\AppData\Local\Temp\c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:4272
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 5483⤵
- Program crash
PID:3940
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3460
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3088
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\JFbhTUKXWP0I.bat" "4⤵PID:2764
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:3592
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:976
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:3140
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:1544
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D35t5QFIEgy2.bat" "6⤵PID:2232
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵PID:1696
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1616
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 22166⤵
- Program crash
PID:2384
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 22604⤵
- Program crash
PID:2256
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe"C:\Users\Admin\AppData\Local\Temp\c1f0ecfd3774383b24916124901636d6de84eb0af364db54712329f6fff50c79.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2224
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2864
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1544 -ip 15441⤵PID:1060
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:4512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 5283⤵
- Program crash
PID:3576
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:3152
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:2888
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:3380
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4512 -ip 45121⤵PID:1200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3880 -ip 38801⤵PID:3656
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3140 -ip 31401⤵PID:316
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2972
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:5012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD53d009e1bb7c9fe1862276c35cf0e8f21
SHA18b63b686705ba525b6ddad53cd941ab4ef6dbaaf
SHA256f29c1ca745a855d3ab72c5eb28a101deca7958f98374d238db2d64ebd380f7b1
SHA5122072ae7e3d2fd9b0e2a7ac8709272250a1fab59c9fc6270c185d864dcf17d5522916b6d9ead097ba4f5d56329da1fea711fbbcfaa95d07bd06aaaaed685e3366
-
Filesize
208B
MD5acd66156590e3c87b46dc6f033836410
SHA1dd050672d05b27d00b6f049fe5ed6e666c92f009
SHA256b48cc9ed3aafda38ec0775f55ae2af73fcfd9c13b3b75e0a50582aca069bbe21
SHA51266c381d1508a97d2cf8ead2978cc8cfacde8ffd20ebef077f0f4a73380eb916c06737915587c91643cfec2412d2d0905a3a9661a081b1708cf4ba5e11d47e859
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD505b9880b8c05bc4a0ba7f96be2383eb3
SHA141a0b3a9c04e9e68e0aa1849dd2d7a5ddfa1be23
SHA256e5ba9ce042fdbe859e66f7a1652c1fc96804a4858d3b00d63045fa51f94971e9
SHA512d5511fb8284cda70b3719d517efdf75c4f40f74d0aabb1ee721a109b194b40aadae2498ea6c1fdb8537c804973e06c2bd5dbda7f73dd948e7e876511de89df7c
-
Filesize
2.0MB
MD5d09307571cc1b5c6f4c24cd9e85d39cb
SHA10500fab447b60b691150f417fbec081ec58001ed
SHA2563519d308f6dd2506efb37a9ee0ff7637c16b213ad7c8643d76a4f8c24acb4d2b
SHA512971d59a0089cc05426e07953be246b51ea3179a958f5e306ba066a10d75860113d5e4cef0cfc9d4694eeb2818fb674aa9206b82841539e8cccaf9f2e70fe82e9