Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/03/2025, 21:32

250312-1dmynatxey 10

11/03/2025, 16:10

250311-tmgdxaxnx4 10

06/03/2025, 02:30

250306-cze8yav1az 10

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2025, 02:30

General

  • Target

    cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe

  • Size

    471KB

  • MD5

    ab1a54b9bc677256e1757897de53211e

  • SHA1

    d8dff0fc44fb65c2ec1f4d43fb69f979b78c8c29

  • SHA256

    cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f

  • SHA512

    d434d9ba2ccef628e4e8288557e22578ddfe7128daf3b626e480cbae887ef81278f9a6b9824b7e67b392a982f116e84f6b73f36fa976f23cc6869f4643854615

  • SSDEEP

    3072:Pkk8u4dv5/Jml3CKACe7HQreetoSII52wAtdGl4QrIM4T9QTWQc7iXRURKx4onSM:PZUJ7sZXIM4TTQc7ZxCSIp0byrDukk

Malware Config

Extracted

Family

azorult

C2

https://guifenergy.co.ke/bin/32/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Azorult family
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe
    "C:\Users\Admin\AppData\Local\Temp\cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2772
    • C:\Users\Admin\AppData\Local\Temp\cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe
      "C:\Users\Admin\AppData\Local\Temp\cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2664
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:1328
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe" "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2008
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {8BA9DD77-2D1C-4A6C-B369-95E6A34824F4} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
      C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:980
      • C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
        "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:364
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2072
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe" "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2164
    • C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
      C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:736
      • C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
        "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1764
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2312
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:812
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe" "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe

    Filesize

    471KB

    MD5

    ab1a54b9bc677256e1757897de53211e

    SHA1

    d8dff0fc44fb65c2ec1f4d43fb69f979b78c8c29

    SHA256

    cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f

    SHA512

    d434d9ba2ccef628e4e8288557e22578ddfe7128daf3b626e480cbae887ef81278f9a6b9824b7e67b392a982f116e84f6b73f36fa976f23cc6869f4643854615

  • memory/364-36-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/736-41-0x00000000012E0000-0x000000000135C000-memory.dmp

    Filesize

    496KB

  • memory/980-24-0x00000000002A0000-0x000000000031C000-memory.dmp

    Filesize

    496KB

  • memory/1764-53-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2664-11-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2664-16-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2664-10-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2664-9-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2664-7-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2664-6-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2664-14-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2664-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2664-17-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2664-21-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/2772-18-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2772-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

    Filesize

    4KB

  • memory/2772-4-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2772-3-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

    Filesize

    4KB

  • memory/2772-2-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2772-1-0x0000000000DB0000-0x0000000000E2C000-memory.dmp

    Filesize

    496KB