Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/03/2025, 21:32

250312-1dmynatxey 10

11/03/2025, 16:10

250311-tmgdxaxnx4 10

06/03/2025, 02:30

250306-cze8yav1az 10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/03/2025, 02:30

General

  • Target

    cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe

  • Size

    471KB

  • MD5

    ab1a54b9bc677256e1757897de53211e

  • SHA1

    d8dff0fc44fb65c2ec1f4d43fb69f979b78c8c29

  • SHA256

    cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f

  • SHA512

    d434d9ba2ccef628e4e8288557e22578ddfe7128daf3b626e480cbae887ef81278f9a6b9824b7e67b392a982f116e84f6b73f36fa976f23cc6869f4643854615

  • SSDEEP

    3072:Pkk8u4dv5/Jml3CKACe7HQreetoSII52wAtdGl4QrIM4T9QTWQc7iXRURKx4onSM:PZUJ7sZXIM4TTQc7ZxCSIp0byrDukk

Malware Config

Extracted

Family

azorult

C2

https://guifenergy.co.ke/bin/32/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • Azorult family
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe
    "C:\Users\Admin\AppData\Local\Temp\cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Users\Admin\AppData\Local\Temp\cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe
      "C:\Users\Admin\AppData\Local\Temp\cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3004
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4804
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2684
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f.exe" "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1708
  • C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
    C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4420
    • C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
      "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4392
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3372
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:632
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe" "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1760
  • C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
    C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1160
    • C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe
      "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3136
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4736
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nano" /tr "'C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe'" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2372
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe" "C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Filemanager.exe.log

    Filesize

    1KB

    MD5

    c1e2960afcfc38deeb25781bab99faf2

    SHA1

    f7af0c85d203333ae5ac292d443a675d88008fe8

    SHA256

    742d6cff0910b1c9de9bc5406e6caec19c8cc462b28c5e9eafea28dd01624f3a

    SHA512

    3c88c4118148f651d5e424f14079fb95d1109e3f34a26ff06e933adaaaee442b88cbded64cf9259645e104a02d83a7bac5f437297e0ea5ea989771069bf685cd

  • C:\Users\Admin\AppData\Roaming\Filemanager\Filemanager.exe

    Filesize

    471KB

    MD5

    ab1a54b9bc677256e1757897de53211e

    SHA1

    d8dff0fc44fb65c2ec1f4d43fb69f979b78c8c29

    SHA256

    cbee3a2ab943816de40704ed266962b9d84d1a9b58a4a79f0200eb2a7258197f

    SHA512

    d434d9ba2ccef628e4e8288557e22578ddfe7128daf3b626e480cbae887ef81278f9a6b9824b7e67b392a982f116e84f6b73f36fa976f23cc6869f4643854615

  • memory/1404-8-0x00000000748C0000-0x0000000075070000-memory.dmp

    Filesize

    7.7MB

  • memory/1404-15-0x00000000748C0000-0x0000000075070000-memory.dmp

    Filesize

    7.7MB

  • memory/1404-4-0x0000000005750000-0x00000000057B6000-memory.dmp

    Filesize

    408KB

  • memory/1404-5-0x00000000748C0000-0x0000000075070000-memory.dmp

    Filesize

    7.7MB

  • memory/1404-6-0x0000000005B00000-0x0000000005B0A000-memory.dmp

    Filesize

    40KB

  • memory/1404-7-0x00000000748CE000-0x00000000748CF000-memory.dmp

    Filesize

    4KB

  • memory/1404-0-0x00000000748CE000-0x00000000748CF000-memory.dmp

    Filesize

    4KB

  • memory/1404-3-0x0000000005690000-0x0000000005722000-memory.dmp

    Filesize

    584KB

  • memory/1404-1-0x0000000000790000-0x000000000080C000-memory.dmp

    Filesize

    496KB

  • memory/1404-2-0x0000000005BA0000-0x0000000006144000-memory.dmp

    Filesize

    5.6MB

  • memory/3004-9-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/3004-14-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/3004-12-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/3004-11-0x0000000000400000-0x0000000000420000-memory.dmp

    Filesize

    128KB

  • memory/4420-20-0x0000000000140000-0x00000000001BC000-memory.dmp

    Filesize

    496KB